SAP secures German data-center fiber with quantum-resistant encryption

SAP has implemented encryption at the optical transmission layer for fiber links connecting its data centers in Walldorf and St. Leon-Rot, Germany. The deployment uses technology from Adva Network Security, certified by Germany’s Federal Office for Information Security (BSI) for handling material classified up to the VS-NfD level, comparable to the "For Official Use Only" designation in other jurisdictions. The initiative focuses on customers in government, critical infrastructure, and regulated industries who require strict national control over data movement and storage.

What the deployment covers

The encryption operates at Layer 1, below network and application layers, meaning it protects all traffic crossing the fiber—including replication streams, backups, management data, and internal communications—without requiring individual applications to implement their own encryption. SAP and Adva report minimal latency impact, as the solution sits beneath protocols like IPsec and TLS, avoiding disruption to existing application workflows. The approach treats the physical path between data centers as part of the security perimeter, rather than focusing solely on the facilities themselves.

Quantum resistance and limitations

SAP describes the encryption as including quantum-secure mechanisms, intended to protect data that could be intercepted today and decrypted later once quantum computing advances enough to break current encryption standards. The sources do not specify which post-quantum cryptographic algorithms or standards are used, nor how they align with emerging frameworks like NIST’s post-quantum cryptography project. While the quantum-resistant claim addresses long-term confidentiality for sensitive data, the technical details remain limited.

The deployment does not resolve all aspects of sovereign cloud security. Identity management, access controls, hardware supply chains, and legal jurisdiction remain separate challenges. However, for customers evaluating where to run highly sensitive workloads, the encrypted fiber links address a specific gap: securing data as it moves between facilities, even within national borders.

Why this matters for sovereign cloud customers

Government agencies and critical infrastructure operators often require data to remain within national borders, but this alone does not guarantee security. Data must still travel between data centers for replication, failover, and routine operations, creating a potential vulnerability if the physical network path is unprotected. SAP’s deployment mitigates this risk by encrypting the entire link, ensuring that even if traffic is intercepted, it remains confidential. The solution is particularly relevant for customers who handle data with long-term sensitivity, such as classified material or infrastructure plans, where future decryption by quantum computers is a concern.

What to watch

The deployment reflects a broader trend of cloud providers addressing physical-layer security for sovereign workloads. While SAP’s move is specific to its German data centers, similar initiatives may emerge from other providers serving regulated industries in Europe and beyond. The quantum-resistant aspect, though not yet standardized, could influence future encryption requirements for government contracts. Customers in regulated sectors should monitor how providers integrate such protections into their broader sovereign cloud offerings, particularly as post-quantum cryptography standards mature.