How to Choose a Colocation Provider: The Complete Australian Checklist

19 Jun 2026, by James Braunegg, CEO and Founder, Micron21

Colocation looks simple from the outside: rack space, power, cooling, done. That illusion is exactly how businesses end up with their hardware in the wrong facility. Your servers might hold years of intellectual property, customer data and revenue-generating applications, and you are about to hand their physical survival to someone else. Choosing that someone deserves more rigour than comparing the price per rack unit.

I have spent more than a decade building and certifying a data centre to the highest standards available, so I know exactly where the weaknesses hide in this industry. This guide covers how to choose a colocation provider properly: the building, the power, the cooling, the network, the security, the certifications and the people, with specific questions to ask at every step.

1. Start with the building: demand certified tier status

The first question for any colocation provider: what is your data centre’s tier rating, and who certified it? The Uptime Institute’s tier classification system is the global benchmark. Tier III means the facility is concurrently maintainable: planned maintenance happens without downtime, but an unplanned fault is still expected to cause an outage. Tier IV means fault tolerant: the facility absorbs any single unplanned failure, anywhere in its infrastructure, with zero impact on your hardware, delivering around 99.995% availability against Tier III’s 99.982%.

Then comes the trap to avoid: “built to Tier IV standards” is a marketing phrase, not a certification. Unless the Uptime Institute has assessed the design and the constructed facility, the claim is unverified. Ask to see the certificate. Micron21 was the first data centre in Australia to achieve Uptime Institute Tier IV Fault Tolerant Design Certification, and we publish it because we believe every provider should have to prove what they sell.

2. Look inside the power and cooling numbers

Power and cooling are where colocation providers quietly differ the most. The questions that matter:

• Redundancy level: is the facility N+1, 2N or higher? Micron21 runs 3N across power and cooling, three complete independent systems, backed by permanent on-site diesel generation, so the facility can lose an entire system and still carry redundancy.
• Continuous cooling: when mains power fails, servers ride through on UPS instantly, but cooling normally takes minutes to return on generators, and a dense data hall heats up alarmingly fast. Ask whether the data hall temperature is guaranteed stable during a power event. Only Tier IV facilities are required to deliver continuous cooling.
• Density headroom: can the facility power and cool what you will deploy in three years, not just today? We supply rack space from a single 1RU server to high-density 30kW racks running the latest GPU hardware. If a provider caps you at 5kW per rack, your AI and compute roadmap dies in their loading dock.

3. The factor most people forget: the network

Here is the blind spot in most colocation evaluations. What is the use of a colocation provider where your server is powered on but your data is down? Uptime means nothing if nobody can reach you. A data centre is only as useful as the network it connects to, yet buyers will interrogate generator capacity for an hour and never ask who carries their packets.

This is exactly why Micron21 built AS38880 as a global network: to provide safe and secure data services that keep client services online, not just powered. AS38880 is one of the largest peered networks in Australia, with more than 2,000 BGP peers worldwide, interconnecting directly with every major network within Australia and around the world. Direct peering means lower latency, fewer third-party networks between you and your users, and Australian traffic staying on Australian paths.

Connectivity also has to survive being attacked. Our network includes a global DDoS protection platform with our own scrubbing centres positioned around the world, absorbing and cleaning attack traffic in real time before it ever reaches your rack. When you evaluate any provider, ask three network questions: who do you peer with and how broadly, what happens to my services during a DDoS attack, and is protection built into the platform or an expensive bolt-on from a third party?

4. Physical and electronic security

Your servers are physical objects, and physical objects get stolen, damaged and tampered with. Inspect the layers personally if you can:

• Physical security: perimeter control, mantraps, individually secured racks, CCTV coverage, and staffed access control around the clock. Ask who can physically reach your rack and how every entry is logged and audited.
• Accreditation: for government-grade assurance, look for SCEC zone ratings. Our facility is SCEC Zone 4 rated, the physical security standard that allows us to hold classified government workloads, alongside our Tier IV certification.
• Electronic security: facility-wide fault detection and monitoring across power, cooling, fire, smoke and communications, with 24/7 eyes on every alert. A fault that nobody notices becomes an outage; a facility that detects degraded states instantly gets repaired before a second fault can bite.
• People security: who are the staff, and what checks have they passed? A number of Micron21 staff hold Australian Government security clearances, allowing us to support departments with classified requirements.

5. Certifications: make them prove everything

Certifications are how you outsource your due diligence to independent experts, so collect them deliberately. The shortlist that matters in Australia:

• Uptime Institute tier certification for the facility itself, as covered above.
• ISO 27001 for information security management, ideally with the ISO 27017, 27018 and 27019 extensions covering cloud security and privacy.
• IRAP assessment, the gold standard for Australian government workloads, where an ASD-endorsed assessor independently verifies the provider against the Information Security Manual. Micron21 has been IRAP assessed since 2018, operates an IRAP assessed DDoS protected network, and our mCloud platform is currently undergoing IRAP assessment for PROTECTED.
• Essential Eight maturity: we operate at Maturity Level 2 across our entire organisation.
• SOCI Act standing: a serious provider should know exactly where it sits under the Security of Critical Infrastructure Act. Micron21 is a proud reporting entity, which means registered assets, a risk management program and mandatory rapid incident reporting.

A provider that has none of these is asking you to take its word. A provider with all of them has been examined, repeatedly, by people whose job is to find problems.

6. Sovereignty and ownership

Ask who actually owns the facility, because your data inherits the jurisdiction of every link in the chain. Is the operator a tenant in someone else’s building? Is there a foreign parent company that overseas legislation, such as the US CLOUD Act, could reach through? Micron21 is 100% Australian family owned; we own the land, the building and every piece of infrastructure inside it, and we are bound only by Australian law. For government, finance, health and any organisation with data sovereignty obligations, that single answer eliminates an entire category of risk.

7. Operations, people and support

The brochure shows the generators; the 2am hardware failure shows the operations. Find out:

• Who is on site, and when? Our facility is supported by 24/7 operations with around-the-clock monitoring of all critical infrastructure. When you call Micron21, you talk to an Australian who works inside the data centre that houses your hardware.
• Remote hands: what can on-site staff do for you (reboots, drive swaps, cable changes), how fast is it guaranteed, and what does it cost? Response times and pricing for remote hands vary enormously between providers.
• SLAs with teeth: how is downtime defined and measured, what are the service credits, and do they cover power, cooling and network individually?
• Cross-connect pricing: many facilities charge recurring monthly fees for every cross-connect, which quietly compounds. Ask up front.

8. Room to grow: the hybrid question

Finally, ask where your infrastructure goes next. Workloads change shape, and the best colocation providers can carry you into cloud without a migration project across town. Micron21 is one of the few providers in Australia that is both a data centre operator and a cloud provider: your hardware in our Tier IV racks, your elastic workloads on our mCloud platform, GPU as a service when you need accelerated compute, all under the same roof, on the same AS38880 network, connected by internal cross-connects with latency measured in microseconds. One provider, one facility, one accountable team for both halves of a hybrid environment.

The quick checklist

• Certified tier status from the Uptime Institute (certified, not “built to”)
• Power and cooling redundancy (N+1, 2N or 3N) with continuous cooling guaranteed
• Density headroom for GPU and high-performance workloads (up to 30kW per rack)
• Network depth: peering breadth, direct interconnection, and built-in DDoS protection
• Physical security layers plus SCEC zone rating for government workloads
• Certifications: ISO 27001 family, IRAP assessment, Essential Eight maturity, SOCI Act standing
• Sovereign ownership of the company, land, building and infrastructure
• 24/7 on-site staff, responsive remote hands and SLAs with real service credits
• A growth path into cloud and hybrid within the same facility

Frequently asked questions

What should I look for in a colocation provider?

Prioritise independently certified facility credentials (Uptime Institute tier rating), power and cooling redundancy, network quality including peering and DDoS protection, layered physical and electronic security, compliance certifications such as ISO 27001 and IRAP, sovereign ownership, and 24/7 on-site operations backed by enforceable SLAs.

What is the difference between a certified Tier IV data centre and one "built to" Tier IV?

A certified facility has been independently assessed by the Uptime Institute against its design and construction. "Built to" means the operator claims to follow the standard but has never been verified. Certification is the only proof, and it is publicly checkable on the Uptime Institute website.

Why does the network matter when choosing colocation?

Because powered-on hardware with unreachable data is still an outage. The facility keeps your servers alive; the network keeps your business online. Look for broad direct peering, diverse paths, and DDoS protection built into the platform, not sold as an optional extra.

The bottom line

Choosing a colocation provider is really nine decisions wearing one contract: building, power, cooling, network, security, certifications, sovereignty, people and growth. Weakness in any one of them eventually becomes your outage. Micron21 built for all nine, which is why we believe we are the best choice for colocation within Australia, particularly if you are in Melbourne: Australia’s first Uptime Institute Tier IV design certified data centre, SCEC Zone 4 rated, IRAP assessed, ISO certified, 100% Australian family owned, powered by the AS38880 global network and defended by our own DDoS scrubbing platform, with Australians on site 24/7.

The easiest way to evaluate us is to do what this guide recommends: come and inspect everything. Book a tour of our Melbourne facility.