Thales Launches UK-Hosted Luna Cloud HSM Services to Strengthen Data Sovereignty, Cryptographic Control and Secure Cloud Adoption

© Thales

(IN BRIEF) Thales has expanded its Data Protection on Demand marketplace with a UK-hosted version of Luna Cloud HSM, giving organisations access to cloud-based hardware security module services while keeping cryptographic key operations within the United Kingdom. The service is aimed particularly at regulated industries, government bodies, critical national infrastructure, telecommunications providers and financial institutions that must address data sovereignty, residency, governance and resilience requirements when moving sensitive workloads to the cloud. Customer keys will be generated, stored, used, backed up and destroyed in the UK, with two UK-based service instances providing high availability and domestic disaster recovery. Luna Cloud HSM enables organisations to generate, protect and manage cryptographic keys across cloud and hybrid environments without operating dedicated HSM infrastructure and is based on established Thales Luna technology supported by FIPS 140 and SOC 2 validation programmes. Thales said the service also provides a crypto-agile foundation that can help customers prepare for evolving security requirements, including the eventual transition to post-quantum cryptography.

(PRESS RELEASE) LA DÉFENSE, 14-Sep-2026 — /EuropaWire/ — Thales has expanded its Data Protection on Demand cloud marketplace with UK-hosted availability of its Luna Cloud Hardware Security Module (HSM) services, enabling organisations to protect sensitive applications, data, digital identities and transactions while keeping cryptographic key operations within the United Kingdom.

The new service is aimed particularly at organisations operating in regulated environments and the public sector, where requirements around data residency, sovereignty, governance and operational resilience can influence cloud adoption strategies.

Through the UK-hosted deployment, customers can consume cloud-based HSM services without having to install and manage dedicated hardware security infrastructure, while retaining control over the cryptographic keys protecting their most sensitive digital assets.

Thales said customer cryptographic keys using the UK-hosted service will be generated, stored, used, backed up and destroyed within the United Kingdom.

The service is supported by two UK-based Data Protection on Demand instances, providing high availability and disaster recovery entirely within the country. This architecture is intended to help customers meet sovereignty requirements while maintaining continuity and resilience for critical cryptographic operations.

Cryptographic keys are central to securing modern digital services, including financial transactions, confidential records, digital identities and applications. As more business-critical workloads move to public, private and hybrid cloud environments, organisations are increasingly examining not only where their information is stored but also where the keys used to protect that information are generated and managed.

Thales said this issue can be particularly important for government organisations, critical national infrastructure operators, telecommunications companies and financial services providers, where uncertainty around cryptographic control and data location may restrict or delay cloud adoption.

The company noted that data sovereignty extends beyond the physical location of infrastructure. It also involves questions about who controls access to sensitive information and encryption keys, where those keys are processed and whether the security model complies with legal, operational and governance requirements.

According to the Thales Quantum and AI Threat Report, conducted by S&P Global Market Intelligence, 36% of respondents believe that strong encryption and key management can provide sufficient protection for sovereignty objectives regardless of physical location.

The study also highlights growing interest in reducing the volume of data held outside sovereign jurisdictions and strengthening cryptographic controls as organisations operate increasingly distributed cloud and artificial intelligence environments.

By offering Luna Cloud HSM through UK-based infrastructure, Thales aims to address these concerns by allowing organisations to use cloud-based cryptographic services while keeping key-management operations within the country.

Luna Cloud HSM provides capabilities for generating, storing, managing and using cryptographic keys across cloud and hybrid environments. The service can be used to protect applications, sensitive information, digital identities, connected devices and transactions without requiring customers to operate their own dedicated HSM hardware.

The cloud service is based on established Thales Luna HSM technology and is supported by recognised security validation programmes including FIPS 140 and SOC 2.

Paul Hampton, Data Protection Cloud Services Owner at Thales, said cloud adoption increasingly depends on more than the physical location of infrastructure. Organisations also need clarity over who controls the encryption keys protecting their most valuable applications, identities and data while ensuring that cryptographic services meet resilience and operational requirements.

He said the UK-hosted Luna Cloud HSM model provides organisations with greater control over their cryptographic infrastructure while reducing one of the obstacles associated with moving sensitive workloads into cloud environments.

The introduction forms part of Thales’ broader strategy to strengthen trusted digital infrastructure in the United Kingdom and support organisations adopting cloud technologies while maintaining stronger control over the cryptographic mechanisms securing their systems.

The service is also designed to provide a crypto-agile foundation, enabling organisations to adapt their cryptographic infrastructure as security requirements and algorithms evolve.

This includes preparations for the future transition to post-quantum cryptography, which is becoming an increasingly important consideration as organisations assess the potential long-term impact of quantum computing on current encryption technologies.

By combining UK-based cryptographic key management, high availability, disaster recovery and cloud delivery, Thales is positioning the service as an option for organisations seeking to balance cloud flexibility with sovereignty, regulatory and security requirements.

About Thales

Thales (Euronext Paris: HO) is a global leader in advanced technologies for the Defence, Aerospace, and Cyber & Digital sectors. Its portfolio of innovative products and services helps address several major challenges: sovereignty, security, sustainability and inclusion.

The Group allocates €4.5 billion per year in Research & Development in key areas, particularly for critical environments, such as Artificial Intelligence, Cybersecurity, Quantum and Cloud technologies.

Thales has more than 85,000 employees in 65 countries. In 2025, the Group generated sales of €22.1 billion.

Recent images of Thales and its Defense, Aerospace and Cyber & Digital activities can be found on the Thales Media Library. For any specific requests, please contact the Media Relations team.

Media Relations
For further enquiries, please contact a member of the Thales media relations team (journalists only).
https://lp.thalesgroup.com/contact_us_journalists

SOURCE: Thales