Switzerland Data Boundary with Access Justifications

This page describes the set of controls that are applied on Switzerland Data Boundary with Access Justifications workloads in Assured Workloads. It provides detailed information about data residency, supported Google Cloud products and their API endpoints, and any applicable restrictions or limitations on those products. The following additional information applies to Switzerland Data Boundary with Access Justifications:

• Data residency: The Switzerland Data Boundary with Access Justifications control package sets data location controls to support Switzerland-only regions. See the Google Cloud-wide organization policy constraints section for more information.
• Support: Technical support services for Switzerland Data Boundary with Access Justifications workloads are available with Enhanced or Premium Cloud Customer Care subscriptions. Switzerland Data Boundary with Access Justifications workloads support cases are routed to EU personnel located in the EU. For more information, see Getting support.
• Pricing: The Switzerland Data Boundary with Access Justifications control package is included in the Assured Workloads Premium tier, which incurs a 5% additional charge. For more information, see Assured Workloads pricing.

Prerequisites

Verify that you meet and have completed the following prerequisites before deploying workloads to Switzerland Data Boundary with Access Justifications:

• Create an Switzerland Data Boundary with Access Justifications folder using Assured Workloads and deploy your workloads only in that folder.
• Don't change the default organization policy constraint values unless you understand and are willing to accept the data residency risks that might occur.
• Don't use Google Cloud MCP servers unless otherwise noted. Switzerland Data Boundary with Access Justifications doesn't provide data residency controls for in-use data and in-transit data with Google Cloud MCP servers. To block unwanted Google Cloud MCP servers access, see the Control Google Cloud MCP servers use with IAM page.
• When accessing the Google Cloud console for Switzerland Data Boundary with Access Justifications workloads, you must use one of the following Switzerland-specific Jurisdictional Google Cloud console URLs:
  • console.ch.cloud.google.com
  • console.ch.cloud.google for federated identity users
• Consider adopting the general security best practices provided in the Google Cloud security best practices center.

Supported products and API endpoints

Unless otherwise noted, users can access all supported products through the Google Cloud console. Restrictions or limitations that affect the features of a supported product, including those that are enforced through organization policy constraint settings, are listed in the following table.

If a product is not listed, that product is unsupported and has not met the control requirements for Switzerland Data Boundary with Access Justifications. Unsupported products are not recommended for use without due diligence and a thorough understanding of your responsibilities in the shared responsibility model. Before using an unsupported product, ensure that you are aware of and are willing to accept any associated risks involved, such as negative impacts to data residency or data sovereignty.

Note: Unsupported products may share an API service endpoint with supported products, making them available to all users.

Important: Google Cloud MCP servers aren't supported for any Switzerland Data Boundary with Access Justifications products unless otherwise noted. Switzerland Data Boundary with Access Justifications doesn't provide data residency controls for in-use data and in-transit data with Google Cloud MCP servers. It's your responsibility to ensure that Google Cloud MCP servers endpoints aren't used with any Switzerland Data Boundary with Access Justifications products. To block unwanted Google Cloud MCP servers access, see the Control Google Cloud MCP servers use with IAM page.

Supported product	API endpoints	Restrictions or limitations
Identity and Access Management (IAM)	iam.googleapis.com policytroubleshooter.googleapis.com	None
Resource Manager	cloudresourcemanager.googleapis.com	None

Restrictions and limitations

The following sections describe Google Cloud-wide or product-specific restrictions or limitations for features, including any organization policy constraints that are set by default on Switzerland Data Boundary with Access Justifications folders. Other applicable organization policy constraints—even if not set by default—can provide additional defense-in-depth to further protect your organization's Google Cloud resources.

We strongly recommend not changing the values of the required organization policy constraints listed in the following sections. Doing so may undermine data residency. When such a change has been made, the effects of the change are difficult or impossible to reverse. Ensure that you understand the ramifications of changing an organization policy constraint's value before proceeding.

Additionally, ensure that any automated mechanisms your organization uses to manage organization policies are updated to prevent these values from being changed unintentionally.

Google Cloud-wide

Affected Google Cloud-wide features

Feature	Description
Google Cloud console	To access the Google Cloud console when using the Switzerland Data Boundary with Access Justifications control package, you must use one of the following URLs: console.ch.cloud.google.com console.ch.cloud.google for federated identity users

Google Cloud-wide organization policy constraints

The following organization policy constraints apply across Google Cloud.

Organization policy constraint	Description
gcp.resourceLocations	Set to the following locations in the allowedValues list: europe-west6 This value restricts creation of new resources to the selected values. When set, no resources can be created in any other regions, multi-regions, or locations outside of the selection. See Resource locations supported services for a list of resources that can be restricted by the Resource Locations organization policy constraint, as some resources may be out of scope and cannot be restricted. Changing this value by making it less restrictive potentially undermines data residency by allowing data to be created or stored outside of a compliant data boundary.
gcp.restrictCmekCryptoKeyProjects	Set to under:organizations/your-organization-name, which is your Assured Workloads organization. You can further restrict this value by specifying a project or folder. Limits the scope of approved folders or projects that can provide Cloud KMS keys for encrypting at-rest data using CMEK. This constraint prevents unapproved folders or projects from providing encryption keys, thus helping to guarantee data sovereignty for in-scope services' at-rest data.
gcp.restrictServiceUsage	Set to allow all supported products and API endpoints. Determines which services can be used by restricting runtime access to their resources. For more information, see Restricting resource usage.
gcp.restrictTLSVersion	Set to deny the following TLS versions: TLS_1_0 TLS_1_1 For more information, see Restrict TLS versions.

What's next

• Learn how to create an Assured Workloads folder
• Understand Assured Workloads pricing