European companies have mostly faced a binary choice: keep sensitive data locked away on premises, or accept whatever sovereignty promises a hyperscale cloud provider offers. A new proof of concept from edge data center operator nLighten and cryptography firm Arqit suggests there might be a third path.
The pitch is straightforward on paper, even if the engineering behind it isn’t. Enterprises get to keep using hyperscale cloud services for AI workloads and elastic infrastructure, while sensitive data, encryption keys, and compliance boundaries stay physically anchored in Europe, outside the cloud provider’s direct control.
This matters because European regulators keep pushing in a direction that clashes with how most companies actually use the cloud. Financial firms, healthcare providers, and government agencies want the flexibility of hyperscale infrastructure, but regulators want tighter answers about who owns the encryption keys and who can physically inspect the systems handling regulated data. Existing sovereign cloud offerings from the big providers usually lean on contracts and governance policies rather than genuine infrastructure separation, and not every customer finds that reassuring.
In the test, nLighten connected its Geneva data center to one of the major hyperscale cloud platforms. Workloads ran in the public cloud as usual, but customer data and cryptographic assets stayed inside nLighten’s facility the whole time. Arqit’s Symmetric Key Agreement Platform extended security controls into the cloud environment instead of handing that trust over entirely.
Under the hood, the setup combines Intel’s Trust Domain Extensions, which isolate virtual machines from other cloud tenants, with Arqit’s post-quantum cryptography, designed partly to defend against “harvest now, decrypt later” attacks, where someone steals encrypted data today hoping quantum computers can crack it years down the line. Neither piece solves sovereignty by itself. Together, they keep the sensitive controls outside the cloud provider’s administrative reach.
nLighten runs more than thirty edge data centers across seven European countries and plans to extend this model across that network, effectively creating regional anchor points tied to public cloud resources.
Whether enterprises actually adopt this remains an open question. Running workloads split across sovereign infrastructure and hyperscale platforms adds real complexity: latency, key management, disaster recovery, and cost all factor in. But as sovereignty shifts from a policy conversation into an actual procurement requirement, architectures like this one may become less of a novelty and more of a baseline expectation.
