How to prepare a confidential Swiss IT company sale

Prepare the evidence before approaching the market

Confidentiality starts before the first buyer list. Resolve obvious gaps in management accounts, customer evidence, contracts, IP records, security documentation and leadership continuity. Early document gathering reduces delay and cost during due diligence, according to the Swiss SME Portal.

Create an owner brief defining timing, buyer exclusions, people who may know, communication triggers and information that must remain restricted. Separate facts you can support from forecasts and aspirations. A rushed answer or contradictory spreadsheet can reveal more than intended and weaken confidence.

Use a four-stage disclosure ladder

For every class record purpose, recipient, prerequisite, redaction, owner, access expiry and disclosure date. Progression is earned through credibility and relevance, not simply elapsed time.

Qualify the recipient before revealing the company

Ask who the legal buyer would be, who funds it, why the company fits, who makes the decision, what approvals are required and whether competitors sit in the group. Verify the person's authority and use a conflict check before identifying the business.

An NDA helps define permitted use, recipients, handling and return or destruction. It cannot prevent every leak or override duties to customers, employees and other parties. Have Swiss counsel tailor material terms to the process. Avoid treating signature alone as buyer credibility.

Maintain one approved recipient list. Advisers, financing sources and technical consultants should be covered by the relevant obligations and need-to-know rule.

Apply data protection to the data room

The Swiss Data Protection Act governs processing of personal data, including disclosure and security. The FDPIC information-security guidance supports controls that restrict access to what is necessary. The statutory framework emphasises lawfulness, proportionality, purpose limitation, accuracy and access restricted to what is necessary. A sale process does not suspend these principles.

Use aggregated or anonymised information early. Replace customer and employee names with stable codes. Remove personal contact data, signatures, bank details and unrelated correspondence. If detailed personal data becomes necessary, document the purpose and legal review. Cross-border access, processors and storage location may need specific analysis.

Anonymisation is not a magic label. A small customer set or distinctive role can still make a person or company identifiable. Test re-identification risk in context.

Operate the room as a controlled system

• Use named accounts, multi-factor authentication and least privilege.
• Separate folders by stage and recipient; avoid reusable public links.
• Log uploads, views, downloads, questions and replacements.
• Add watermarks where useful and set expiry and revocation dates.
• Keep a disclosure log recording what version went to whom and why.
• For exceptional competition sensitivity, consider clean-team or adviser-only access with counsel.

Version control matters. If a figure changes, replace it formally and explain the reason. Do not silently overwrite evidence that a recipient used for a proposal.

Plan internal communication and a leak response

Define who inside the company knows at each stage and why. Prepare messages for employees, major customers and suppliers, but activate them only at the agreed trigger. Managers who must assemble evidence need enough context to work accurately without broadening the circle unnecessarily.

Write a short incident plan: who assesses a suspected leak, who contacts counsel, how access is revoked, what logs are preserved and who decides whether stakeholders are informed. The plan reduces improvised messages under pressure.

Never use confidentiality to conceal information that must be disclosed or to mislead a counterparty. The disclosure plan controls timing and audience while preserving accuracy.

A 30-day confidential preparation plan

Week 1: define objectives, exclusions, the internal circle and disclosure classes. Week 2: assemble the evidence index, remove obvious personal data and resolve inconsistencies. Week 3: configure access roles, logs, expiry, question handling and approved NDA workflow with advisers. Week 4: rehearse the teaser-to-room sequence with a fictitious recipient and test revocation and incident response.

Connect the evidence index to the technology due diligence checklist and the overall Swiss IT sale guide. Continuum offers independent orientation and can facilitate an optional introduction if you request it. Transaction-specific legal, tax and privacy advice belongs with qualified Swiss specialists.

Worked example: disclose enough without disclosing everything

Consider an illustrative Swiss managed-services provider with 35 employees, one customer representing a material share of revenue and several contracts containing confidentiality clauses. A potential strategic buyer also competes for two customer accounts. Sending a named customer list after an NDA would still be poor information control. The recipient has a commercial incentive, the contracts may restrict disclosure and one customer name could identify the seller immediately.

At teaser stage, the seller presents revenue as bands, separates managed services from projects and hardware, and describes concentration without naming the customer. The buyer explains its rationale and confirms the acquisition entity, decision makers and funding approach. A conflict check identifies the overlapping accounts. After an NDA reviewed for the specific process, the named overview provides historical financial summaries, anonymised concentration, service mix, employee totals by function and the main technology platforms.

Before the data room opens, the seller's team creates stable customer codes. A code links recurring revenue, term, notice period, gross margin and service effort across files without revealing identity. Personal names, signatures, direct contacts and bank details are removed. Contract extracts show relevant change, assignment and confidentiality language, while counsel determines what may be shared and when. Security information starts with policies, control summaries and test dates rather than live credentials, detailed vulnerability paths or production architecture that is unnecessary at that stage.

The buyer then submits an indicative proposal and demonstrates a credible decision process. Detailed diligence opens by workstream. Finance advisers see the full reconciliation. Technical reviewers receive architecture and evidence under named accounts. The competing commercial team sees only aggregated customer data. If a named customer issue becomes decisive, counsel can design a restricted review or adviser-only confirmation instead of releasing the entire customer list.

Every upload receives an owner, version, disclosure class and review date. Questions and answers enter the same log. When one spreadsheet is corrected, the old version is preserved as superseded, recipients are notified and the change is explained. If the buyer pauses, access expires rather than remaining open indefinitely.

Release test for a sensitive document

1. What precise decision does the recipient need to make?
2. Can a summary, range, code or extract answer it?
3. What contract, personal-data or competition duties apply?
4. Who is the narrowest appropriate recipient?
5. When will access expire, and what evidence of disclosure will remain?

If the team cannot answer these questions, the document is not ready for release. The remedy is to clarify purpose and obtain specialist advice, not to upload the whole folder for convenience.

Questions are disclosures too

A question-and-answer process can reveal sensitive relationships even when the original file remains protected. Route questions through one channel, assign an owner and review answers under the same disclosure classes as documents. Avoid spontaneous replies from separate departments. An answer about a lost customer can expose personal names, pricing and product weaknesses at once. Provide the decision-relevant fact first and add detail only when justified.

Define closure for every recipient. After a rejection or pause, disable accounts, close links and apply the agreed return or deletion steps. Record revocation, confirmation and retained exceptions in the disclosure log. Internal working copies also need retention rules. An orderly process cannot prevent every misuse, but it enables a traceable response.