Encrypting Data in Motion for AI, Multicloud and Sovereign Infrastructure
Equinix and Thales bring private interconnection and customer-controlled, quantum-ready encryption together at the digital edge.
TL;DR
- What’s changing: AI, multicloud and distributed infrastructure are moving sensitive, high-volume data across more environments, providers and network paths.
- What it means: Organizations need to encrypt data in motion without creating performance bottlenecks, fragmented policies or dependence on site-by-site hardware deployments.
- How Equinix and Thales help: Equinix Network Edge and Equinix Fabric combine with the Thales CV1000 Virtual High Speed Encryptor to provide private connectivity and consistent, customer-controlled encryption across distributed environments.
Data is moving faster and across more boundaries
Enterprise infrastructure is no longer concentrated in one data center or even one cloud. Applications, AI models, training data, analytics pipelines and business-critical services increasingly span colocation facilities, cloud platforms, software-as-a-service environments, branch locations and specialized infrastructure such as GPU clusters.
This distributed model creates new opportunities, but it also expands the number of paths over which sensitive data must travel. A single workload may move between an enterprise site, a cloud service, an AI environment and a recovery location. Each connection introduces questions about performance, security policy, cryptographic control and regulatory responsibility.
For organizations in regulated or data-intensive industries, simply adding legacy encryption is not enough. Protection must keep pace with high-volume data flows. Security teams need consistent policy and key control. Network teams need flexibility across different transports and topologies. Business leaders need the ability to expand into new regions and services without turning every connection into a lengthy hardware project.
The requirement is clear: connectivity and data-in-motion protection need to be designed together.
Why traditional approaches can become difficult to scale
Encryption is often implemented through a mix of network devices, cloud-native controls and dedicated appliances. These approaches can be effective within a specific environment, but complexity grows as infrastructure becomes more distributed.
Different locations may use different encryption methods, key-management processes and certification baselines. Routing and security functions can become tightly coupled, which makes changes harder to coordinate.
Deploying a physical encryptor at every endpoint can add procurement, shipping, installation and operational dependencies. Traditional IPsec implementations may also introduce processing overhead, tunnel-management complexity and packet expansion that must be considered for resource-intensive networking.
These issues are especially relevant for AI and analytics. Training, retrieval-augmented generation and inference depend on the movement of valuable datasets, model assets and results between processing locations. Security controls must protect those flows while preserving the throughput, latency and operational agility the workload requires.
At the same time, organizations are preparing for a changing cryptographic landscape. Data with a long confidentiality life may be exposed to “harvest now, decrypt later” risk. A durable strategy therefore needs crypto agility, the ability to evolve algorithms and security policy without redesigning the entire network.
The goal is not to choose between security and performance. It is to establish an architecture in which private connectivity, encryption and customer control can scale together.
Bring connectivity and encryption together at the digital edge
Equinix Fabric provides private, software-defined interconnection between distributed enterprise infrastructure, cloud environments, networks and service providers. Organizations can provision and adjust virtual connections as requirements change, creating a flexible foundation for hybrid and multicloud architectures.
Equinix Network Edge provides a virtual deployment environment for network functions at Equinix locations. Instead of procuring and installing dedicated hardware at each site, organizations can deploy supported virtual functions close to cloud on-ramps, applications and users.
Thales CV1000 Virtual High Speed Encryptor adds an independent encryption layer for data in motion. The virtual network function supports authenticated, policy-based protection at Layers 2, 3 and 4, centralized management, automated key handling and customer control of cryptographic keys and policy.
It is based on the same High Speed Encryption family that can connect to Thales physical encryptors for distributed deployment models.
Together, the components create a software-defined operating model: use Equinix Fabric to establish private connectivity, deploy CV1000 from on-premises to Network Edge, to cloud/SaaS (where protection is needed), and apply consistent encryption across the entire data path. Connectivity models can evolve while the organization preserves a common approach to encryption policy and key ownership.
Example Use Case Thales vHSE on Network Edge across metros for Multicloud workloads
A joint model designed for control, agility and resilience
The value of the joint approach is not simply that connectivity and encryption coexist. It is that each platform contributes a distinct capability to a unified architecture.
The CV1000 supports NIST-standard algorithms for post-quantum readiness. Its crypto-agile architecture supports modifications to evolution of encryption standards.
This complementary model helps organizations separate encryption from the underlying transport. Teams can protect traffic across different network technologies without forcing a wholesale redesign of routing or application architecture. They can also pair virtual CV1000 instances with supported Thales hardware encryptors where required.
The result is a consistent security layer that can follow the organization’s data paths. Customers' security teams retain control of keys and policy independently of the cloud provider or network underlay, while operations teams gain a virtual deployment model that can respond more quickly to new locations, partners and workloads.
Where the approach can create value
Protect multicloud and SaaS connectivity
Enterprises can apply a consistent encryption model to data moving among cloud platforms, SaaS services, colocation environments and enterprise sites. Private Fabric connections provide the connectivity layer, while CV1000 protects the data path with customer-controlled keys and policy.
Secure AI and analytics pipelines
AI workloads move sensitive training data, models and analytical outputs among data stores, GPU infrastructure and inference environments. High-speed encryption helps protect these flows without making security an afterthought or requiring a separate appliance project for every new processing location.
Add an encryption overlay to SD-WAN
Organizations can apply transport-independent encryption across internet, broadband, MPLS while retaining the existing SD-WAN architecture. Separating encryption from routing helps security and network teams evolve their respective controls without unnecessarily coupling the two.
Protect data center interconnect and recovery traffic
Replication, backup, disaster recovery and application mobility generate large and often sensitive data flows between facilities. The joint approach supports encrypted connectivity among data centers, Equinix colocation sites, cloud access points and recovery locations.
Support sovereignty and cryptographic resilience
Customer ownership of cryptographic keys and security policy can support architectures that require stronger operational control over sensitive data. Crypto agility also provides a foundation for adapting protections as post-quantum standards and organizational requirements evolve.
Start with one high-value data paths
A practical way to begin is to identify traffic flows where security, performance and deployment agility matter most. This might be a cloud-to-data-center connection, an AI training pipeline, a disaster-recovery path or an SD-WAN route serving a regulated workload.
From there, Equinix and Thales teams can map the endpoints, define the private Fabric connection, determine where CV1000 should run, document key-control and policy requirements, and agree on measurable success criteria.
This creates a focused path to validating the architecture before extending it to additional locations or use cases. Connect with confidence. Retain control of your data. AI adoption, multicloud expansion and sovereignty requirements are making data movement a strategic infrastructure concern. Protecting data at rest is essential, but it does not address the growing volume of sensitive information moving among environments.
By combining Equinix Fabric, Equinix Network Edge and Thales CV1000 HSE, organizations can take a unified approach to private connectivity and customer-controlled encryption. The result is a flexible foundation for protecting distributed data paths while supporting performance, operational agility and long-term cryptographic resilience.
The quantum era is approaching, regulatory requirements are becoming more demanding, and AI data pipelines are growing in scale and complexity. In today’s connected and distributed world, sensitive datasets, models and business-critical information move continuously across clouds, data centers and borders—making data sovereignty paramount.
Organizations need to control not only where data resides, but also how it travels and who controls the cryptographic keys that protect it. Preparing now means designing scalable data-in-motion protection, customer-controlled key management and crypto agility into the infrastructure, helping safeguard long-lived information against future quantum threats while supporting performance, regulatory obligations and operational flexibility.
Next step: Engage your Equinix or Thales account team to identify a priority data flow and scope a joint architecture workshop or proof of concept.
Resources