From data residency to key sovereignty: Thales launches UK cloud HSM

French technology and cybersecurity group Thales has launched a UK-hosted version of its Luna Cloud HSM, allowing organizations to consume hardware security module (HSM) capabilities as a cloud service while keeping the full lifecycle of their cryptographic keys within the UK.

Announced on September 14, the service addresses a growing consideration for organizations moving sensitive systems to the cloud: keeping data in the UK may not be enough if the cryptographic keys protecting that data are managed elsewhere.

From dedicated HSMs to HSM as a service

Traditionally, organizations requiring greater control over cryptographic keys could deploy and manage their own HSM hardware. That provides control, but also brings the cost and complexity of installing, maintaining and scaling specialized infrastructure.

Thales’ Luna Cloud HSM provides those capabilities as a service through its cloud marketplace for cryptographic and data-protection services. The marketplace, called Data Protection on Demand (DPoD), allows organizations to consume cryptographic capabilities without buying and managing the underlying HSM infrastructure themselves.

For UK customers, the important part is localization. Thales says cryptographic keys will be generated, stored, used, backed up and destroyed within the UK. Two UK-based DPoD instances will also provide high availability and disaster recovery within the country.

“Cloud adoption has moved beyond questions of where services are hosted,” said Paul Hampton, Data Protection Cloud Services Owner at Thales. Organizations increasingly need to know who controls the cryptographic keys protecting their applications, identities and data, he added.

Cloud HSM is not new

Thales is not the only provider addressing this. Microsoft Azure, AWS and Google Cloud all offer HSM or key-management services that can operate within specific regions, including the UK.

But their native services are primarily tied to their respective cloud environments. Thales’ model, delivered independently of any single hyperscaler, allows organizations to separate their choice of cryptographic infrastructure from the cloud hosting their applications and data.

That distinction could matter most to customers concerned about dependence on a foreign-headquartered cloud provider — the same broader jurisdictional concern underlying recent European technology decisions.

Data residency does not solve the entire sovereignty problem

Keeping sensitive data in a UK data center addresses data residency. But organizations must also consider who controls the cryptographic keys that provide access to encrypted information.

Where are those keys stored? Who can access them? Where are backups maintained? Which jurisdiction applies to the infrastructure provider?

These questions are particularly relevant for digital identity, where cryptographic keys underpin credential signing, authentication, encryption and trusted transactions.

Thales’ proposition therefore combines two requirements: consuming cryptographic infrastructure as a cloud service while maintaining domestic control over the keys protecting sensitive systems.

Sovereignty concerns are already affecting technology decisions

Recent European cases show that these concerns can influence major technology and investment decisions.

The Dutch government blocked U.S.-based Kyndryl’s proposed acquisition of Dutch cloud provider Solvinity earlier this year. Solvinity supports infrastructure behind DigiD, the Netherlands’ national authentication system, raising concerns about critical digital infrastructure coming under the control of a U.S. parent company.

Switzerland faced a related controversy over plans involving AWS infrastructure for its national electronic identity ecosystem, highlighting concerns about relying on foreign-controlled infrastructure for sensitive government systems.

The cases demonstrate why physical data residency is increasingly being separated from technological control. Encryption can reduce exposure when an infrastructure provider cannot decrypt customer data, but that moves the sovereignty question one level deeper: who controls the keys?

Independent validation adds another layer of assurance

Thales points to both FIPS 140 validation and SOC 2 compliance for its Luna HSM technology and cloud services.

Under the NIST-led Cryptographic Module Validation Program (CMVP), cryptographic modules are tested against FIPS requirements by accredited independent laboratories before their results are reviewed and validated by the program. SOC 2 provides additional independent assurance around controls governing areas such as security and availability.

For regulated and government customers, these assessments provide evidence beyond the vendor’s own claims about the infrastructure protecting their cryptographic keys.

The technology is also already being applied to digital identity infrastructure. Earlier this year, Thales and Ubiqu integrated Luna HSMs into a remote secure element for the EUDI Wallet, where the HSM provides the protected environment for cryptographic keys and operations. The solution is designed to meet eIDAS High requirements and support post-quantum cryptography.

Why now?

More sensitive workloads are moving to the cloud, bringing government systems, financial services, telecommunications and digital identity infrastructure into the migration conversation. At the same time, sovereignty requirements are expanding beyond the location of data toward questions of ownership, jurisdiction and cryptographic control.

Another transition is approaching: post-quantum cryptography. Organizations are beginning to prepare cryptographic infrastructure for algorithms designed to withstand future attacks from quantum computers. Thales positions the UK-hosted service as a crypto-agile foundation for that transition, allowing organizations to adapt their cryptographic infrastructure as standards and requirements evolve.

Thales’ own research, conducted by S&P Global Market Intelligence, found that 36 percent of respondents considered strong encryption and key management sufficient protection for their sovereignty objectives regardless of physical location.

That points to two approaches emerging around sovereign cloud: localize the infrastructure, or retain cryptographic control over the data even when infrastructure crosses borders. The UK-hosted Luna service combines elements of both.

Broader implications for the industry

First, data sovereignty is expanding beyond where data is stored. Governments and regulated organizations increasingly have to consider who controls their cloud infrastructure, cryptographic keys, backups and other technology supporting sensitive applications.

Second, the infrastructure protecting those keys is itself moving to the cloud. HSMs have traditionally been specialized appliances organizations purchased, installed and operated. They are increasingly becoming infrastructure that can be consumed as a service.

For governments and regulated enterprises, this creates a new balance between infrastructure ownership and infrastructure control. Organizations may not need to physically own every component if they can retain sufficient control over their keys, determine where they are managed and meet domestic resilience and governance requirements.

The post-quantum transition could further accelerate that shift. Crypto-agile services may make it easier for organizations to change algorithms and security policies as cryptographic standards evolve without replacing individually managed hardware across their infrastructure.

For cloud and security providers, local HSM and key-management infrastructure could therefore become an increasingly important part of sovereign cloud offerings as more sensitive government, financial and identity workloads move to the cloud.

Thales’ UK expansion suggests the next phase of cloud sovereignty will be determined not only by where data resides, but also by who controls the cryptographic infrastructure protecting it.

Article Topics