Data Center Colocation and Cloud Infrastructure Agreements: Power, Space, Capacity, and the Service You Actually Bought

Document type: Article Practice area: Technology — Technology Transactions Jurisdiction: United States Last reviewed: 5 September 2026

What is being sold

A colocation agreement is usually described as a licence to place equipment in a facility. That description is accurate and almost entirely uninformative about what determines the deal's value.

What a colocation customer buys, in order of economic importance:

Power, measured in kilowatts of committed capacity, delivered at a specified redundancy level, at a specified price per kilowatt per month.
Cooling sufficient to remove the heat that power produces, which is a function of the same number.
Space, which is very nearly a residual — the cabinets, cages, or suites needed to house equipment drawing the committed power.
Interconnection, meaning cross connects to carriers, to cloud on-ramps, and to other tenants in the facility.
Access, meaning the right of the customer's personnel and contractors to enter and work on the equipment.
Availability, meaning a commitment about power and environmental conditions, backed by a credit.

Customers who negotiate square footage and neglect kilowatts have negotiated the wrong variable. A cabinet that can draw 5 kW is a different product from an identical cabinet that can draw 15 kW, and modern equipment densities have made power, not floor area, the binding constraint in nearly every facility.

A cloud infrastructure agreement sells something different in form and similar in substance: compute, storage, and network capacity, on demand, priced by consumption, with availability commitments backed by credits. What the customer actually needs to negotiate — capacity assurance, price predictability, data portability, and exit — maps closely onto the colocation list, even though the documents look nothing alike.

Licence, lease, or service — and why it matters

Colocation agreements almost always recite that they grant a licence, not a lease, and that the customer has no interest in real property. Providers write this deliberately. Customers should understand what turns on it.

In the provider's bankruptcy. Under 11 U.S.C. § 365, a debtor may assume or reject executory contracts and unexpired leases. If the agreement is a lease of nonresidential real property and the debtor rejects it, the tenant has statutory rights to remain in possession for the balance of the term. If it is a services contract or licence and the debtor rejects it, the customer is left with a prepetition damages claim and no right to stay. The difference between those two outcomes, for a company whose production systems are in the building, is existential.

The characterization does not turn on the label. It turns on whether the customer has been granted exclusive possession of an identifiable space. A customer occupying a locked, demised private suite with defined boundaries has a stronger argument than one renting three cabinets on an open floor the provider can rearrange.

The related protection is § 362, the automatic stay, which prevents the provider from cutting power or denying access on account of prepetition debts once a petition is filed — a protection that can matter more in practice than the ultimate characterization.

In the customer's insolvency. Providers frequently take a lien on the customer's equipment for unpaid fees, either by contract or under a state statutory landlord's lien. A customer whose servers secure a colocation debt has given a security interest in operating assets, and its lenders will care. Read the lien provision, negotiate a cap, and check whether the customer's credit facility prohibits it.

For tax and accounting. Characterization affects sales and use tax treatment in several states and can affect lease accounting. This is not a footnote in a large deal.

For the landlord's landlord. Most providers lease their buildings. A customer should ask what happens if the provider's own lease terminates, and should seek a non-disturbance arrangement in a large deal — the same protection a subtenant would seek.

Power: the provision that carries the deal

The power terms deserve more attention than any other part of a colocation agreement.

Committed capacity. How many kilowatts is the provider obligated to make available, and is that number measured as connected load, breaker capacity, or actual draw? The distinction matters. A "10 kW cabinet" may mean two 5 kW circuits at breaker rating, which under standard electrical practice can be continuously loaded only to 80% — yielding 8 kW of usable power. Customers regularly buy 20% less than they think.

Redundancy. Facility redundancy is described in tiers and in configurations — N, N+1, 2N, 2N+1 — and the terminology is used loosely in marketing. What matters is the contractual commitment: how many independent power paths, whether the customer's equipment is connected to more than one, and what happens during maintenance. A facility with redundant infrastructure that requires a maintenance window during which the customer runs on a single path is not delivering continuous redundancy, and the agreement should say which it is.

Metering and billing. Is power billed at a flat rate per committed kilowatt, at metered actual consumption, or at a committed minimum with metered overage? Each is defensible; what is not defensible is a provision that bills committed capacity while also passing through metered consumption. Check for double counting, and check the PUE or overhead multiplier applied to metered draw — a provider that bills actual IT load times a facility efficiency factor should disclose the factor and cap it.

Power price escalation. Utility costs are volatile. Providers pass them through, which is reasonable, but a pass-through should be limited to actual documented increases in the utility rate, should be auditable, and should not become a general escalator. Watch for provisions permitting an increase in the base rate on notice — those are price adjustment rights dressed as pass-throughs.

Growth. Can the customer buy more power in the same facility, at what price, and with what notice? A right of first refusal on adjacent capacity is worth negotiating and is often granted, because the provider would rather expand an existing customer than find a new one. Without it, a customer that outgrows its footprint may face a migration it cannot afford.

Service levels and the credit remedy

Every infrastructure agreement contains a service level commitment, and in nearly every one the sole remedy is a credit against future fees. Understanding the arithmetic is essential, because the headline number is not the commitment.

What is measured. For colocation, the commitment is usually about power availability at the customer's cabinet and about environmental conditions — temperature and humidity within a stated band. It is not about the customer's equipment, its network, or its applications. For cloud, the commitment is about the availability of a defined service, often measured per region or per instance, and the definition of unavailability is doing enormous work.

How it is measured. Monthly, usually, as a percentage of minutes in the month. Note that 99.99% availability permits about 4.4 minutes of downtime per month; 99.9% permits about 43 minutes; 99.5% permits about 3.6 hours. The step from three nines to four is the difference between an inconvenience and an incident.

What is excluded. This is where the commitment is made or unmade. Standard exclusions: scheduled maintenance; emergency maintenance; force majeure; the customer's own equipment, configuration, or acts; third-party network failures; and anything the provider characterizes as outside its demarcation point. A commitment of 99.999% that excludes scheduled and emergency maintenance without limit is not a commitment.

Negotiate the exclusions: cap scheduled maintenance minutes per month or per year; require advance notice and a maintenance window outside business hours; require that emergency maintenance be genuinely emergent and be reported with a root cause; and define the demarcation point precisely.

The credit. Typically a percentage of the monthly fee for the affected service, scaled by the severity of the miss, capped at some percentage of the monthly fee, and available only if the customer requests it within a short window. Three points follow:

The cap makes the credit a rounding error relative to the business loss from an outage. A customer that loses a day of trading does not care about a 10% credit.
The claim requirement is real. Credits that must be requested within thirty days, with specified supporting information, are frequently forfeited by customers who never built the process. Build the process.
"Sole and exclusive remedy" language should be resisted at the margin. The negotiable version is a chronic-failure termination right: if availability falls below the commitment in, say, three months out of any twelve, or below a floor in any single month, the customer may terminate without penalty. That is the remedy that matters, and providers grant it more often than customers ask.

Interconnection and the cost nobody modelled

Cross connects — the physical cables linking a customer's equipment to a carrier, a cloud on-ramp, or another tenant — are a significant and frequently overlooked cost centre.

Points to negotiate:

Price per cross connect, and whether it is fixed for the term. Cross connect pricing has been a source of margin and of regulatory attention, and a customer with many connections should fix the price.
The right to use a third party. Some agreements require the customer to purchase cross connects from the provider. Whether alternatives exist depends on the facility, but the question should be asked.
Carrier neutrality. Which carriers are present in the facility, and is the provider obligated to permit any carrier the customer chooses to enter? A facility that is neutral in marketing but requires provider consent in the contract is not neutral.
Cloud on-ramps. Direct private connections to major cloud providers are a primary reason customers select facilities. Confirm which are available and at what cost.
Meet-me room access and the terms on which the customer's chosen carrier may install.

Access

An access provision that looks administrative can prevent a customer from fixing a production incident at 3 a.m.

Who may enter? Named individuals, a list the customer maintains, or anyone the customer authorizes? How quickly can the list be updated?
Contractors and vendors. A customer that uses a smart-hands vendor or a hardware maintainer needs those people admitted.
Hours. 24×7 for a production facility, without exception.
Escort requirements, and whether escorts are available at all hours and at what cost.
Notice. Advance notice for scheduled work is reasonable; advance notice for emergency access is not.
Suspension. Providers reserve the right to suspend access for non-payment or breach. Negotiate a cure period, a requirement of written notice to a named executive, and an absolute carve-out permitting the customer to remove its own equipment.
Remote hands. Response times, hourly rates, what tasks are included, and the standard of care. A provider that will not accept liability for its own technician's negligence in handling customer equipment is worth pushing on.

Cloud infrastructure: the same questions in a different form

Cloud agreements are usually presented as non-negotiable online terms, incorporated by reference, subject to unilateral change. For a small consumer that is the market. For an enterprise committing meaningful spend, a negotiated agreement is available and the following provisions are where the value is.

Committed spend and discounts. Enterprise agreements typically trade a multi-year spend commitment for a discount. Negotiate: whether the commitment is a floor with a true-up or a take-or-pay; whether shortfalls roll forward; whether the commitment can be met across services and regions and by affiliates; what happens on a divestiture that reduces consumption; and whether the discount survives a change of control.

Price protection. Cloud list prices generally decline, but specific services have increased. A customer committing for three years should seek protection against increases in the services it actually uses — either a price hold or a most-favoured-pricing mechanism relative to public list price.

Egress. Data transfer out of a cloud is charged, and at scale the charge is substantial. It is also the primary economic friction against leaving. Negotiate an egress allowance, a discounted rate, or — most valuable — a waiver of egress charges for a defined exit window on termination. Regulatory pressure in several jurisdictions has moved providers toward free exit egress, and a customer should ask for it in writing rather than assume it.

Capacity. On-demand does not mean unlimited. Capacity constraints for specific instance types, particularly accelerated computing, are real. A customer with a workload that depends on a particular instance family should negotiate a capacity reservation, understand what it costs, and understand what happens if the provider cannot deliver.

Regions and data location. Where data is stored and processed, whether it may be moved, and what notice is given. For regulated customers this is a compliance requirement, not a preference.

Change of terms. Cloud providers reserve broad rights to modify services and terms. Negotiate: no material adverse change to a service the customer uses without notice and a transition period; deprecation notice of twelve months or more for a service the customer depends on; and the right to terminate the affected service without penalty if a change is materially adverse.

Support. Response times by severity, escalation paths, and named technical contacts. Support is sold in tiers and the tier matters more than customers expect during an incident.

Data, access, and legal process

A provider holding a customer's data will receive legal demands for it, and the agreement should say what happens.

Under the Stored Communications Act, 18 U.S.C. § 2702 restricts a provider's voluntary disclosure of customer content, and § 2703 governs compelled disclosure, with the required legal process depending on the type of information sought and its age. The statutory scheme is complex and its application to enterprise cloud arrangements has produced litigation.

What a customer should negotiate:

Notice. The provider will notify the customer of any legal demand for customer data, unless legally prohibited, and will use reasonable efforts to obtain permission to notify.
Redirection. The provider will, where lawful, direct the requesting party to the customer.
Minimum necessary. The provider will produce only what is legally required.
Cooperation. The provider will reasonably cooperate with the customer's efforts to quash or narrow.
No voluntary disclosure absent legal compulsion or the customer's consent.

The related question is the customer's own access. A customer must be able to get its data out, in a usable form, at any time and particularly at the end. The provision that delivers this — a right to export in a documented format, at a defined cost, within a defined period — belongs in every infrastructure agreement.

Security, audit, and shared responsibility

Infrastructure providers publish security certifications and operate on a shared-responsibility model: the provider secures the facility or the platform; the customer secures what it puts on it. The agreement should describe the division precisely enough that neither side assumes the other has covered something.

Provisions to negotiate:

Certifications maintained, with the right to receive current reports and to be notified of any lapse or qualified opinion.
Audit rights. Full customer audit is rarely granted at scale and is genuinely impractical in a multi-tenant facility. The workable substitutes are third-party audit reports, a right to submit a security questionnaire annually, and, for regulated customers, a regulator access clause.
Incident notification. Within a defined period, with defined content, and covering incidents affecting the provider's environment even where customer data is not confirmed to be affected.
Physical security commitments for colocation: access control, monitoring, logging, and the customer's right to review logs of access to its space.
Personnel. Background screening, and restrictions on subcontractor access.
Return or destruction of media, and certification.

Migration and exit

Exit provisions must be negotiated at signature, because the customer's leverage is zero afterward. A customer whose production systems sit in a provider's facility, or whose data sits in a provider's storage, cannot credibly threaten to leave until it has somewhere to go and a means of getting there.

Term and renewal. Watch for automatic renewal with long notice periods — a three-year term renewing automatically unless notice is given twelve months in advance means the real decision point is eighteen months into the term. Negotiate the notice period down, and calendar it the day the agreement is signed.

Termination for convenience. Rarely granted without penalty in a capital-intensive colocation deal, and reasonably so: the provider built capacity for the customer. What is negotiable is the size and shape of the early termination charge — declining over the term, calculated on unrecovered capital rather than lost profit, and waived where termination follows a chronic service failure or a provider change of control.

The exit window. On expiration or termination, the customer needs time to move: typically thirty to ninety days for colocation, during which it pays the ordinary fee and retains full access and services. Providers sometimes propose a holdover rate at 150% or 200%. Negotiate a defined transition period at the contract rate, with holdover pricing applying only after it.

Transition assistance. For cloud, the right to export data in a documented, non-proprietary format; provider assistance at defined rates; and — the provision worth the most money — waiver or reduction of egress charges during the exit window.

Equipment removal. The right to remove equipment, the process, and what happens if the provider claims a lien. Negotiate an express carve-out: no lien may be asserted to prevent removal of equipment where the customer has paid undisputed amounts.

Data destruction. Certified destruction of media and deletion of data on a defined timetable, with a certificate.

Survival. Confidentiality, indemnities, accrued payment obligations, and the transition assistance obligations themselves.

Liability, and the gap between the credit and the loss

Infrastructure agreements limit liability aggressively, and the customer should understand precisely how far.

The typical stack: service credits are the sole remedy for availability failures; consequential, indirect, special, and punitive damages are excluded, with lost profits and lost data usually named; and direct damages are capped at fees paid in some trailing period, often three, six, or twelve months.

Against a business impact that can run to millions per hour for some customers, that stack allocates essentially all outage risk to the customer. That is not necessarily unfair — the provider cannot price a service to underwrite the customer's business — but it should be understood rather than discovered.

What is negotiable:

Carve-outs from the exclusion of consequential damages. Breach of confidentiality, indemnity obligations, gross negligence and wilful misconduct, and breach of the data security obligations are the standard candidates. A provider that will not carve out its own gross negligence is worth a hard conversation.

A higher cap for specific failures. A supercap — a multiple of the general cap — for security incidents caused by the provider's failure to meet its stated security obligations. Increasingly common in enterprise cloud agreements and worth asking for.

Data loss. Providers exclude liability for lost data on the theory that backup is the customer's responsibility, which is generally correct under a shared-responsibility model. The negotiable point is liability for data loss caused by the provider's failure to perform a backup or replication service the customer actually purchased.

Insurance. Confirm what the provider carries: general liability, property, cyber, and errors and omissions, with limits. Ask to be named as an additional insured for the general liability policy. Insurance is not a substitute for a contractual remedy, but it tells you something about the provider's own risk posture, and a provider that cannot produce a certificate is telling you something else.

The customer's own insurance should be reviewed against the residual risk. Business interruption coverage that responds to a supplier's outage — contingent business interruption, or a system failure extension on a cyber policy — is the instrument designed for exactly this gap, and many customers discover after an outage that they did not buy it.

Force majeure, and what it should and should not cover

Force majeure clauses in infrastructure agreements have been rewritten across the industry in recent years, and the current drafts are worth reading rather than skimming.

What belongs. Natural disasters, war, civil unrest, government action, and genuine utility failures beyond the provider's control.

What does not. The provider's own equipment failure, its inability to obtain parts or personnel through ordinary planning, labour disputes among its own workforce, and — the one to watch — "utility failure" stated without qualification. A data centre's entire value proposition is continuity of power notwithstanding utility failure. A force majeure clause that excuses the provider whenever the grid fails has excused the provider from the service it sold.

The negotiated formulation: utility failure is a force majeure event only to the extent it exceeds the capacity of the facility's backup power systems as designed, and only if the provider has maintained and tested those systems in accordance with its stated practices. That formulation preserves the clause for a genuine catastrophe and removes it for a generator that did not start because it had not been tested.

Duration and termination. A force majeure event that continues beyond thirty or sixty days should give the customer a termination right without penalty. Otherwise the customer is bound to an agreement under which it receives nothing.

Notice and mitigation. The provider should be required to give prompt notice, to describe the event and its expected duration, and to use commercially reasonable efforts to mitigate and to resume.

Multi-tenancy, neighbours, and the risks you did not create

A colocation customer shares a building, and a cloud customer shares hardware. Both carry risks that arise from other people's conduct.

Physical. Another tenant's equipment failure, fire, or contractor error can affect shared infrastructure. The customer's protections are the provider's obligations regarding facility standards, fire suppression, and separation, plus the provider's own insurance. A customer in a private suite with dedicated infrastructure has less exposure than one in an open cage, and this is part of what the price difference buys.

Logical. In a multi-tenant cloud, isolation between tenants is the platform's core security property. The customer cannot audit it directly and relies on certifications, the provider's representations, and the incident notification obligation. A customer with genuinely sensitive workloads can buy dedicated hardware, at a price, and should evaluate whether the risk profile justifies it.

Reputational and legal. A facility or platform that hosts unlawful activity may attract law enforcement attention that reaches other tenants' equipment. Ask what the provider's acceptable use enforcement looks like, and what protections exist if a seizure targets shared infrastructure.

Noisy neighbours. Performance degradation from another tenant's consumption is a real operational issue in shared environments and is almost never addressed contractually. A customer with latency-sensitive workloads should evaluate dedicated capacity rather than negotiate a clause that providers will not give.

Worked example one: the colocation renewal

Yusuf Karimov is head of infrastructure at Halloway Retail, whose primary systems occupy two private cages in a provider's facility. The five-year term expires in fourteen months and the provider has sent a renewal proposal with a modest rate increase.

Yusuf's counsel, Dominique Feuillet, treats the renewal as a new negotiation rather than a signature, and starts by establishing what Halloway actually has.

Power reality check. The contract commits 180 kW across the two cages. Actual draw is 141 kW. But the cages are populated with older equipment; the refresh planned for next year will increase density and, on the infrastructure team's model, push draw to 205 kW by year three of a new term. The renewal as proposed does not include additional capacity. Dominique makes capacity expansion the first item.

The escalator. The proposed renewal contains a 4% annual increase on the base rate plus a utility pass-through. Dominique separates them: the base rate escalator is negotiated to CPI capped at 3%, and the utility pass-through is limited to documented increases in the actual utility tariff, auditable, with the facility overhead multiplier disclosed and capped at its current level.

The SLA. The existing agreement commits 99.999% power availability but excludes scheduled maintenance without limit, and Halloway experienced four maintenance windows last year, two of which required running on a single power path. Dominique negotiates: scheduled maintenance capped at four windows and eight hours per year; forty-five days' notice; windows outside Halloway's peak trading periods, which are listed in a schedule; and, critically, a commitment that redundancy is maintained during maintenance — if the provider must drop to a single path, that time counts against availability.

Chronic failure. New: if availability falls below the commitment in any three months of a rolling twelve, or below 99.9% in any single month, Halloway may terminate without early termination charge and with a ninety-day transition period at the contract rate.

Cross connects. Halloway has thirty-one cross connects. The price has risen 40% over the term. Dominique fixes the per-connect price for the renewal term with the same CPI cap, and adds the right to use a third-party provider where technically feasible.

Bankruptcy. Dominique asks whether the cages are demised space with defined boundaries and exclusive possession — they are, which improves Halloway's position materially if the provider files. She also asks for and obtains a non-disturbance undertaking from the provider's building landlord, and confirms the provider's own lease runs beyond the renewal term.

The lien. The existing agreement grants the provider a lien on Halloway's equipment. Halloway's credit facility contains a negative pledge that this arguably violates. Dominique negotiates the lien down to a right that may be exercised only after ninety days' non-payment of undisputed amounts, with an express carve-out permitting removal of equipment where undisputed amounts are current, and obtains a waiver from Halloway's lender.

The renewal takes eleven weeks. The rate is roughly what the provider first proposed. Everything else is different.

Worked example two: the cloud commitment

Sanaa Boukhari is CFO of Piedmont Analytics, which has grown from a $400,000 annual cloud bill to $6.2 million in three years. The provider offers a three-year enterprise agreement with a discount in exchange for a committed spend of $24 million.

Sanaa's evaluation covers four questions.

Is the commitment achievable? The discount is attractive only if Piedmont actually spends the money. She models three scenarios and finds that the base case clears the commitment comfortably, but a downside case — losing the two largest customers — falls short by roughly $5 million. She negotiates: shortfalls in any year roll forward rather than being forfeited, the commitment may be satisfied by any affiliate's spend on any service in any region, and a divestiture reducing consumption by more than 20% triggers a good-faith renegotiation.

What is the discount actually worth? The headline discount applies to list price. Piedmont's current effective rate already reflects volume tiers and reserved instances. The incremental benefit is smaller than the headline, and Sanaa models it service by service. This is ordinary diligence and it is skipped remarkably often.

Price protection. The agreement holds prices for the services Piedmont currently uses, against list price increases, for the term. Sanaa adds a mechanism for new services adopted during the term to be added to the protected list.

Exit. This is the provision she cares most about, because a three-year commitment concentrates risk. She negotiates: a documented data export capability; waiver of egress charges for data exported during a 120-day period following expiration or termination; provider transition assistance at a defined rate; and twelve months' notice before deprecation of any service Piedmont uses in production.

She also negotiates a capacity reservation for the accelerated compute instances that run Piedmont's model training, having discovered during diligence that availability of that instance family in her primary region is constrained and that on-demand access is not assured.

The general counsel adds a change-of-terms provision: no material adverse change to a service in production without ninety days' notice and a right to terminate the affected service without penalty.

Worked example three: the outage

At 4:12 on a Tuesday morning, the facility housing Marchetti Logistics' primary systems loses power to one of two paths. The transfer to the second path fails. Marchetti is down for two hours and eleven minutes.

Elena Marchetti, the general counsel, runs a sequence that every infrastructure customer should have written down before it is needed.

Hour one: preserve. Instruct the infrastructure team to preserve monitoring data, alerting logs, and any communications with the provider. Note the exact times of failure and restoration from Marchetti's own systems, not the provider's.

Hour two: notify. Send written notice of the outage to the provider under the notice provision, invoking the SLA and reserving all rights. This matters because the credit claim has a deadline and because a written record created contemporaneously is worth more than a reconstruction.

Day one: demand the root cause. The agreement requires a root cause analysis within ten business days. Ask for it in writing and calendar the deadline.

Week one: quantify. What did the outage cost? Lost orders, expedited freight to recover missed windows, customer credits, and staff time. The number will exceed the SLA credit by two orders of magnitude, which is the point of computing it.

Week two: assess the claim. The credit is capped at 25% of one month's fee — about $31,000 against an estimated $2.1 million in business impact. The agreement makes the credit the sole remedy. Elena reads the limitation carefully and identifies two questions: whether the failure of the transfer switch was the sort of event the exclusive-remedy provision was meant to cover, and whether the provider's conduct in deferring a known maintenance item on that switch — which the root cause analysis discloses — takes it outside the limitation under the governing law's treatment of gross negligence.

Month one: use the leverage. The strongest available outcome is not litigation over a limitation of liability clause; it is a renegotiation. Elena claims the credit, documents the loss, and opens a conversation about remediation: the provider commits to replacing the transfer equipment, provides a written remediation plan with dates, agrees to a reduced rate for twelve months, and — the item Elena wanted most — agrees to add a chronic-failure termination right and an uncapped credit for any future outage arising from the same root cause.

Month two: fix the contract and the architecture. Marchetti adds a secondary facility for its most critical workloads. The lesson Elena writes into her post-incident memorandum is the one that generalizes: a service level agreement is a pricing mechanism, not a guarantee of continuity. Continuity comes from architecture. The contract's job is to make the provider's failure expensive enough to change behaviour and to give the customer a way out.

Sustainability commitments and what they bind

Power consumption has made data centres a focus of environmental reporting, and infrastructure agreements increasingly contain sustainability provisions. Some of them are enforceable commitments; most are not.

What is usually marketing: a provider's corporate net-zero target, a statement that the facility is "powered by renewable energy" without specifying the instrument, and a reference to a sustainability report.

What can be made contractual: disclosure of the facility's power usage effectiveness on a defined measurement basis and frequency; disclosure of the energy mix serving the facility; assignment or allocation to the customer of renewable energy certificates attributable to its consumption; reporting sufficient for the customer's own emissions disclosure, in a format the customer's reporting framework can use; and notice of any material change.

The last item matters most for customers subject to their own disclosure obligations. A customer that reports scope 3 emissions and cannot obtain consumption and energy-mix data from its infrastructure provider has a reporting gap it cannot close, and the time to fix that is at contracting.

Where a provider makes a specific sustainability claim that influenced the customer's decision, it belongs in a representation rather than in a slide, and a customer for whom this genuinely matters should say so and ask.

Regulated customers and the provisions their regulators require

Financial institutions, healthcare organizations, government contractors, and businesses handling regulated personal data face contractual requirements imposed from outside the negotiation.

Common obligations that must appear in the agreement, whatever the provider's standard form says:

Regulator access. The right of the customer's regulator to examine the provider's operations and records relating to the customer's services, and the provider's obligation to cooperate.
Audit and information rights sufficient to satisfy the customer's supervisory obligations.
Subcontractor controls. Notice of material subcontractors, flow-down of obligations, and the customer's right to object.
Data location. Restrictions on where data is stored and processed, with notice of change.
Business continuity and resilience. Documented plans, testing at stated frequency, and results provided.
Exit and stressed exit. A documented plan for transitioning the service, including in a stressed scenario, which several supervisory regimes require to be maintained and periodically reviewed.
Records retention for periods the customer's regulator specifies, which frequently exceed the provider's standard.
Incident notification on timelines the customer's own reporting obligations require, which are often shorter than the provider's standard.

Two practical points. First, these requirements are not negotiable by the customer — they are imposed on the customer — and a provider that refuses them is not a viable counterparty for that customer, however attractive the price. Second, providers serving regulated industries usually have a supplementary addendum containing exactly these terms, and it is often not offered unless asked for. Ask.

Where the money actually goes

A closing observation on economics, because legal review that is disconnected from cost tends to optimize the wrong provisions.

In a colocation deal, the recurring cost is dominated by power — both the committed capacity charge and the metered consumption. Cross connects are the second line, and at scale they can rival space. Remote hands and change fees are small but escalate quietly. Early termination charges and holdover rates are the tail risks.

In a cloud deal, compute is the largest line for most workloads, storage grows relentlessly and is rarely cleaned up, and data transfer is the line that surprises people — both egress to the internet and, often overlooked, transfer between regions and availability zones. Support tiers are a fixed percentage of spend and are worth re-evaluating annually. And the largest single economic risk is not a line item at all: it is the cost of leaving, which is why the exit provisions repay the attention they take to negotiate.

A legal review that reads the power schedule, the cross-connect pricing, the egress terms, and the exit provisions with the same care it gives the indemnity has covered most of the money. One that spends its time on the governing law clause and skips the maintenance exclusions has not.