Table of content
For an online shop, hosting server-side tracking is often a matter of price. For a private bank, an insurer, a clinic or a public administration, it is a matter of sovereignty and legal risk. And one question keeps coming up in our audits: "If I move to server-side tracking to protect my data, should I really host that server with Google?"
In short
Three options dominate: Google Cloud (Zurich region available), Stape (sGTM specialist, EU zones) and a Swiss host such as Infomaniak.
Since 15 September 2024, transfers to US companies certified under the Swiss-U.S. DPF are covered by the FADP, but the CLOUD Act remains an issue for sectors bound by secrecy.
Google provides an official Docker image: hosting in Switzerland is possible, but requires real operations skills.
The right choice depends on your sector and risk appetite, not on your agency's preference.
Why server hosting is a legal question
The tracking server receives raw data: IP address, full URLs, identifiers. Its location, and the law that applies to its operator, matter as much as the cleaning rules.
The FADP, in force since 1 September 2023, allows disclosure abroad to states recognised as providing adequate protection (including EU states) or with appropriate safeguards.
The Swiss-U.S. Data Privacy Framework has been in force since 15 September 2024: certified US companies, such as Google, can receive data without additional safeguards.
The US CLOUD Act (2018) lets US authorities require a US provider to hand over data it controls, even when stored outside the United States. For most companies this is a theoretical risk. For a bank bound by banking secrecy (Art. 47 Banking Act) or a healthcare provider, it is something internal compliance will examine.
Google Cloud Platform: the industry standard
This is Google's default option for hosting a server-side GTM container (via Cloud Run).
Advantages
Native integration: deployment starts in a few clicks from the GTM interface.
Scalability: the infrastructure absorbs traffic peaks, Black Friday included.
Location in Switzerland: the europe-west6 region is in Zurich.
The limit for sensitive sectors
Even in Zurich, the operator remains a US company subject to the CLOUD Act. For an SME, the risk is low and covered by the DPF. For a bank, it is a point to assess and document.
A-Track verdict: suitable for most online shops, retailers and service companies looking for performance and simplicity.
Stape: the sGTM specialist
Stape does one thing: host server-side GTM containers. Agencies often prefer it for its simplicity.
Advantages
Cost: monthly plans that are often more affordable than GCP at low volumes.
Ready-made features: Custom Loader, Cookie Keeper, Anonymizer, geo headers, AI traffic detection.
Choice of infrastructure: according to its documentation, Stape offers global hosting on Google Cloud and EU hosting on Scaleway, run by a European entity (Stape Europe). There is no zone in Switzerland.
The limit
It is a third-party SaaS: you depend on its infrastructure. A large organisation that requires full control (infrastructure as code, logs, security) may run into objections from its IT department.
A-Track verdict: ideal for SMEs and agencies that want a fast setup with GDPR-compliant hosting in the EU. It is the basis of our guide to GA4 server-side with Stape.
Infomaniak and Swiss clouds: the sovereign option
This is the option we recommend to clients with the strictest FADP and sovereignty requirements: hosting the GTM Docker container on Jelastic Cloud or a virtual server at Infomaniak, whose data centres are in Switzerland.
Strategic advantages
Swiss end to end: data stored in Switzerland, by a Swiss company subject to Swiss law. The risk of foreign access is greatly reduced.
Brand image: for a public institution or a local brand, saying that data never leaves the country is a trust argument.
Full control: you manage the system, security and server logs.
The technical challenge
There is no "Deploy to Infomaniak" button. Google does provide an official Docker image and a manual setup guide, but running it takes DevOps skills: containers, SSL certificates, load balancing, preview server, monitoring. That is where we step in, with the same standards as on GCP.
A-Track tip
When self-hosting, plan from day one for updating Google's Docker image and for an alert if the server stops responding. A tracking server that goes down makes no noise: you find out in your reports, days later.
A-Track verdict: the preferred option for finance, healthcare, public administrations and brands that make "Swissness" a core value. See also our article on digital measurement in private banking.
The three options compared
Setup: very simple on GCP and Stape; expertise required in Switzerland.
Cost: pay-per-use on GCP; monthly plan at Stape; fixed server or usage-based billing at Infomaniak.
Operator's legal framework: US law (CLOUD Act) and DPF for Google; European entity and GDPR for Stape's EU hosting; Swiss law for Infomaniak.
Ideal fit: e-commerce and retail; SMEs and agencies; banking, healthcare, public sector and luxury.
Whatever the hosting, data cleaning remains essential: see our guide to cleaning GA4 data before it reaches Google.
Conclusion: which architecture for your business?
Hosting should not be decided by a media agency's habits alone. It is a data governance decision.
Running an online shop on Shopify or WooCommerce? Stape or GCP will do in most cases.
A private bank, a clinic or an administration? Have compliance validate the choice and favour a Swiss infrastructure.
At A-Track, we work across all three environments. Our job: recommend the architecture that aligns your marketing goals with your legal risk appetite. The full legal framework is covered in our FADP and GDPR compliance guide.
Which sGTM hosting fits your level of risk?
A-Track compares Google Cloud, Stape and Infomaniak against your sector and compliance requirements, then deploys and monitors the chosen server-side GTM container.
Let's talk architecture in a 30-minute call with an expert.