Sherpany and Datasite: facts for Swiss customers

Datasite, a US software company based in Minneapolis, announced on 22 February 2024 that it was acquiring Sherpany, the Zürich-based board and meeting management provider. According to the announcement, Sherpany runs as a strategic business unit within Datasite and functions as a standalone entity. An ownership change does not by itself change your contract, but it is a good moment to check the contracting party, the data processing agreement and the list of sub-processors.

What was announced, and what was not?

The press release is on Sherpany's news page and on Datasite's site, dated 22 February 2024 (Minneapolis). It says:

• Datasite acquired Sherpany, described as a Zürich-based board reporting and meeting management software provider.
• The terms were not disclosed, and closing was expected in the first quarter of 2024, subject to closing conditions.
• Sherpany "will run as a strategic business unit within Datasite and will function as a standalone entity", supported by Datasite's ongoing investment.
• Datasite's president and CEO said the company looks forward to integrating Sherpany's capabilities into the Datasite platform.
• Sherpany was founded in 2011 and has offices across Europe.

What the release does not say matters just as much for a customer. It does not say whether shares or assets were bought, so it does not tell you which legal entity your contract is with. It does not mention customer contracts, hosting, sub-processors or prices, and neither Sherpany's news page nor its home page carries a customer FAQ on the acquisition. When we read the pages on 29 October 2026, the only later item on Sherpany's news page was a June 2026 survey published with Datasite, and we found no announcement of a product or hosting change.

What does Sherpany say about hosting and security today?

On its security and compliance page, Sherpany states that its data centres are in Switzerland in a geo-redundant setup of independent data centres, that data is encrypted with AES-256 and TLS, that it offers SaaS or a hybrid-cloud option, and that it complies with GDPR and Swiss data protection law. It lists ISO/IEC 27001, ISAE 3000 Type II and compliance with FINMA 18/3, audited by BDO, and a guaranteed availability of 99.9 percent. It also describes itself as unaffected by the US Cloud Act. These are statements by the vendor, and the right way to treat them is to ask for the current certificates and the scope they cover. They are published today, which is after the acquisition.

What can an ownership change mean in general?

An acquisition does not by itself change a contract. Whether the contract party changes depends on how the deal is built: in a purchase of shares the company you contracted with stays the same, in a purchase of assets the contract may move only if it is transferred. Your agreement says which, so read the clause on assignment and on change of control. What can change over time:

• Group policies, such as security standards, support processes or product roadmaps.
• Sub-processors. A new parent may bring shared services such as support tools, email delivery or monitoring.
• The entities and countries involved in processing, and therefore which law applies to them.
• Prices and packages at renewal.

None of this is automatic, and none of it is known for Sherpany from the published sources. It is what a board should check with any vendor after a change of control.

What does Swiss data protection law add?

Where the portal holds personal data, which board papers and minutes usually do, the Swiss Federal Act on Data Protection applies. Article 9 lets you hand processing to a processor if the data is processed as you yourself could process it, and if no statutory or contractual duty of confidentiality forbids it. You must make sure the processor can guarantee data security, and the processor may only pass the processing on to a third party with your prior approval. Article 16 covers disclosure abroad: it needs an adequacy decision of the Federal Council or suitable safeguards such as standard data protection clauses, unless one of the exceptions in Article 17 applies. Both are reasons to ask about sub-processors and group access after a change of owner. Whether a particular arrangement satisfies them is a question for your lawyer or data protection adviser, not for a vendor's summary.

Which questions can customers ask?

Ask for the answers in writing and file them with the board's IT or data protection records.

How do you run the review?

1. Collect (board secretary, one afternoon): contract, order form, data processing agreement, the sub-processor list and the vendor's security page, each with its date.
2. Ask (board secretary): send the six questions to your account manager. A short email is enough: "Following the announcement of 22 February 2024, please confirm in writing which legal entity is our contracting party, where our data is processed, and which sub-processors are currently engaged, and whether any change is planned."
3. Assess (data protection adviser or IT lead): compare the answers with the DPA and your own requirements. If your organisation is supervised and has duties on outsourcing, involve compliance.
4. Decide (chair): put the result on the agenda as an information item, with one of three outcomes: continue as is, continue with a written commitment, or prepare a re-tender at contract end.
5. Record (board secretary): a minute entry such as "The board took note of the vendor's written answers of [date] on contract party, hosting and sub-processors and decided to continue the contract until [date]."

If your board has particular legal concerns about foreign jurisdictions, have them assessed by your own lawyer.

What would make a board act?

How does Konsaro answer the same questions?

Konsaro is a product of Software Vision AG in Zürich. Board data is stored in Zürich, and the application servers run in the EU. Konsaro holds no ISO 27001 certificate and no SOC 2 report today. Sub-processors are listed on the public sub-processor page, and security details are on the trust page. Minutes, agenda and the full meeting book export as PDF and the decisions and tasks register as CSV. If you plan to move, our switching checklist and the list of Sherpany alternatives are the next reads.