SAP just went after a part of cloud security most customers never think about: the actual fiber running between data centers.
The company is now encrypting the optical links connecting its Walldorf and St. Leon-Rot facilities in Germany, using Layer 1 technology from Adva Network Security that Germany’s Federal Office for Information Security has approved for material classified up to VS-NfD, roughly the German equivalent of For Official Use Only. The target audience is sovereign cloud customers: government agencies, critical infrastructure operators, and regulated industries that need strict national control over where sensitive data actually travels.
Here’s the problem SAP is solving. Keeping data inside national borders only handles part of sovereignty. Data still has to move between facilities constantly, for replication, backups, failover, and routine operations, and those internal links form part of the trust boundary whether customers realize it or not.
SAP’s approach tackles that gap directly by encrypting at the optical transmission layer itself, below the network and application layers entirely. That means the protection covers everything crossing the link automatically: replication streams, backup traffic, management data, internal system communications, without requiring each application to handle its own encryption.
There’s an operational upside too. Because the encryption sits below IPsec, TLS, and most application-level protections, SAP and Adva say it adds minimal latency and doesn’t disrupt how applications already run. One encrypted connection now protects everything moving across that infrastructure at once.
The quantum angle is where things get more speculative. SAP describes the deployment as including quantum-secure mechanisms, aimed at protecting data that attackers could capture today and decrypt later once quantum computing matures enough to break current encryption. That’s a real concern for government and infrastructure data that stays sensitive for years, but the technical details on exactly how those mechanisms work, or how they align with emerging post-quantum standards, remain thin.
None of this makes SAP’s cloud fully sovereign on its own. Identity management, access controls, hardware supply chains, and legal jurisdiction all remain separate problems a single encrypted fiber link can’t solve.
Still, for buyers weighing where their most sensitive workloads should run, the fact that SAP is treating the physical path between data centers as part of the security perimeter, not just the data centers themselves, is worth noticing.
