When you buy data-centre or hosting capacity, you are buying promises: that the power will not blink, that the cooling will hold through an August afternoon in Riyadh, that a human will answer at 3 a.m., and that you can leave cleanly if you ever need to. Brochures assert these promises; contracts and site visits verify them. Our parent company designs and builds server rooms and data-centre infrastructure across the Kingdom, and this checklist is the distilled version of what its engineers check on other people's facilities — twenty points, grouped into six areas, each phrased as a question you can put in an RFP.
Score each answer: written and evidenced (2), verbal only (1), evasive (0). Anything scoring under 30 of 40 deserves a harder look.
Power (items 1–4)
1. How many independent utility feeds enter the facility? One feed means the generators are your real utility. Ask for the single-line diagram, not the marketing cutaway.
2. What is the UPS topology and what happens during maintenance? The failure you should fear is not the storm — it is the planned UPS service during which the facility quietly runs unprotected. Ask specifically about maintenance bypass and concurrent maintainability.
3. Generators: runtime at full load, and who refuels them? Tanks are finite. A serious answer names on-site fuel hours and a contracted refuelling arrangement with a response time — critical in a prolonged grid event.
4. Is my power metered and capped per rack? You want metered billing (you pay for what you draw) and a clear answer on what happens if you approach your cap — alarm, throttle, or negotiated upgrade.
Cooling (items 5–7)
5. What outdoor design temperature was the cooling plant engineered for? This is the most Saudi-specific question on the list. Summer ambients in Riyadh and the Eastern Province routinely exceed 45°C; a plant designed to Gulf conditions states its design point plainly. A facility that quotes only generic capacity figures has not answered.
6. What is the cooling redundancy — and does it survive the design summer? N+1 that holds in January can be N+0 in August. Ask how redundancy is calculated at the summer design point, not at the annual average.
7. How is dust handled? Sand and dust are facts of Gulf operations: filtration classes, positive pressurisation, and filter maintenance schedules are the difference between a clean hall and clogged server intakes after the first shamal season.
Connectivity (items 8–10)
8. Which carriers are on-net, and is the facility carrier-neutral? Multiple independent carriers protect both your uptime and your negotiating position at circuit renewal.
9. Do fibre paths enter through diverse routes? Two carriers through one duct is one backhoe away from being zero carriers. Ask to see the entry points.
10. What latency should I expect to my users and platforms? For Saudi audiences, in-Kingdom hosting is already the big win; between Saudi cities, single-digit-to-low-tens of milliseconds is the working range. If your architecture spans providers, check the facility's peering and routes to the cloud regions listed in our Saudi regions guide.
Compliance and security (items 11–14)
11. Is the operator appropriately registered with CST? Cloud and hosting providers serving the Kingdom fall under CST's regulatory framework; asking for registration details is a normal question and takes the provider one email to answer. Our CCRF explainer covers what the categories mean.
12. Which certifications exist as certificates, not adjectives? "Tier III standards," "ISO-aligned," "designed to" — these phrases carry no obligations. Ask for the actual certificates with dates, scopes and issuing bodies, and verify the scope covers the specific facility you are buying, not the company's headquarters.
13. What are the physical security layers? Perimeter, mantrap, biometrics, escort policy, CCTV retention, and — often forgotten — the process for authorising your staff and revoking a departed employee's access.
14. How does the facility support your data obligations? Media destruction with certificates, PDPL-aware handling of any personal data in scope, and clarity about NCA cloud-control responsibilities where they apply — see our NCA CCC guide for the provider/tenant split.
SLA and operations (items 15–17)
15. What exactly does the SLA measure, and what are the remedies? An SLA without defined measurement windows, exclusion lists, and meaningful service credits is a poster. Read the exclusions first — that is where availability numbers go to hide.
16. Remote hands: scope, hours, response time, price. When you are 400 km away, the facility's technician is your hands. Get the response commitment and the hourly rate in the contract, and ask what tasks are out of scope.
17. How are maintenance and incidents communicated? Advance-notice periods for planned work, a real-time status channel for incidents, and named escalation contacts. Ask to see the last quarter's maintenance notices — mature operators can show them.
Commercial and exit (items 18–20)
18. What is the pricing structure — and what escalates? Per-rack or per-kW, what is bundled (cross-connects are a classic extra), and which lines carry annual escalation clauses. Model year three, not year one; our cost guide shows the worksheet method.
19. Can you grow — contractually? Expansion space, power headroom, and whether growth is at pre-agreed rates or at "market price at the time" (translation: whatever they like once you are locked in).
20. Can you leave — practically? Notice periods, decommissioning assistance, equipment removal windows, data-bearing media handling, and no punitive gotchas. As with cloud contracts, an exit clause you could not actually execute is decoration.
The one-page version
| Area | Items | The question behind the questions |
|---|---|---|
| Power | 1–4 | Does electricity survive both the grid and the maintenance schedule? |
| Cooling | 5–7 | Was this plant designed for a Saudi August or a brochure? |
| Connectivity | 8–10 | Are there genuinely independent paths in and out? |
| Compliance & security | 11–14 | Are the claims certificates or adjectives? |
| SLA & operations | 15–17 | What happens — contractually — when things break? |
| Commercial & exit | 18–20 | What does year three cost, and can you leave? |
When the right answer is "no data centre at all"
Run the checklist honestly and a fair number of readers will reach an uncomfortable conclusion: the workload they were about to rack — a company site, business email, a line-of-business app, file storage — never needed a rack. It needed a provider that has already answered all twenty questions upstream. That is precisely the case for managed cloud: Skyline Cloud's Saudi data-centre-hosted services put your workload on Saudi-resident infrastructure with daily backups, free auto-renewing SSL, a 99.9% uptime SLA on hosting plans from SAR 49/month (excl. VAT), and Arabic/English support — with a free 14-day trial, no credit card, which is a shorter procurement cycle than most facility site visits.
And if your workloads genuinely belong in a facility — the five qualifying cases are in our colocation vs cloud framework — the same engineering team that wrote this checklist's field version can help: server room and infrastructure build-outs, data-centre physical and cyber security, and backup and disaster-recovery design.
Frequently asked questions
Do I need a Tier-certified facility?
Not necessarily — you need availability that matches your workload's real tolerance, evidenced by design documents and track record. Certification is one form of evidence; verified redundancy and honest SLAs are the substance. Beware facilities that claim tiers without certificates.
What is a reasonable SLA for hosting in Saudi Arabia?
Published managed-hosting plans in the Kingdom commonly carry 99.9% uptime SLAs; facility-level agreements vary with architecture. More important than the headline number: measurement definitions, exclusions, and whether the remedies are meaningful.
How many providers should I evaluate?
Three scored evaluations beat ten brochures. The checklist exists to make comparisons commensurable — same twenty questions, same scoring, decision by evidence.
Can I mix a data-centre presence with cloud?
That is the most common end-state for Saudi mid-market companies: a small colocated or on-premises core for qualifying workloads, and managed cloud for everything else, connected privately. Design the split deliberately rather than inheriting it.
Take the checklist to the site visit
Print the twenty questions, book the tour, and score in real time — evasive answers reveal more on-site than any document review. And for every workload that does not need a rack of its own, take the short route: start a free 14-day Skyline Cloud trial (no credit card) and let a Saudi-resident managed platform answer all twenty questions for you.
Comments
0 total · 0 threads