Swiss banking IT operates under some of the most stringent security requirements in the world. FINMA regulations, combined with the expectations of institutional clients, have created a security culture that is decades ahead of most SaaS startups. After 30 years in Swiss banking IT infrastructure, I have identified the principles that matter most — and that any startup can implement without a banking-scale budget.
Principle 1: Defense in Depth — Never Rely on a Single Control
Banks don't have one password for the vault — they have multiple independent systems that each must be defeated separately. In software terms, this means layering controls: network segmentation, application-level authentication, database-level access controls, and audit logging. If one layer is breached, the others still hold.
- Require SSO + MFA for all internal tools and infrastructure
- Never rely on VPN alone for production access — layer with service-level authentication
- Database access should require separate credentials from application credentials
- Log every privileged action to an immutable audit trail
Principle 2: Least Privilege — Access Should Match Need
In banking, a teller cannot access trading systems. A junior developer at your startup should not have production database access. This sounds obvious but the majority of startup security breaches involve over-privileged credentials — either from current employees or former ones that were never revoked.
- Implement role-based access control (RBAC) from day one
- Production access should require separate approval and be logged
- Revoke access within 24 hours of an employee departure
- Quarterly access reviews: does every person still need their current access level?
Principle 3: Know Your Data — Classify and Protect Accordingly
Banks know exactly where every piece of customer data lives and who can touch it. Most startups do not. A data inventory is the foundation of both security and GDPR compliance. You cannot protect data you don't know you have.
- 1.Map all data flows: what data do you collect, store, process, and share
- 2.Classify data by sensitivity: public, internal, confidential, highly confidential
- 3.Apply controls appropriate to classification: encryption, access restrictions, retention limits
- 4.Document everything — regulators and enterprise customers will ask
Principle 4: Assume Breach — Plan for When, Not If
Banking systems are designed with the assumption that a breach will eventually occur. The question is whether you detect it quickly and contain it before significant damage is done. Most startups have neither detection nor containment capabilities.
- Deploy security monitoring (SIEM) — even a basic setup catches 80% of incidents
- Set up alerting on abnormal access patterns: off-hours logins, bulk data exports
- Have an incident response plan before you need it
- Define your breach notification process for GDPR 72-hour reporting requirements
Principle 5: Change Management — Every Change Is a Risk
In banking, production changes go through a formal approval process. Not because banks are bureaucratic, but because uncontrolled changes are the leading cause of incidents. For startups, this does not mean adding process for its own sake — it means having discipline about production deployments.
- Require peer code review before any production deployment
- Automated testing as a gate before deployment
- Blue/green or canary deployments for zero-downtime releases
- Rollback plan for every deployment
What Startups Can Afford to Implement Today
The good news: cloud infrastructure has democratized many controls that cost millions in traditional banking IT. You can implement all five of these principles for under CHF 2,000/month in tooling cost — the main investment is in process discipline, not budget.
- SSO + MFA: Google Workspace or Microsoft 365 (already paying for it)
- Secrets management: HashiCorp Vault, AWS Secrets Manager, or Infisical (open source)
- Log aggregation: Datadog, Grafana Cloud, or self-hosted ELK stack
- Vulnerability scanning: Snyk (free tier covers most startup needs)
- Compliance automation: Vanta or Drata (starts at ~CHF 1,000/month)