Data centre and hosting
Know where your data lives, and who answers for it.
Server rooms, colocation and hybrid cloud, planned by people who will still be around to run them. With plain-English help on Australian data sovereignty and hosting obligations.
What we do
Plan it, build it, move it, run it.
One team across server rooms and comms rooms, colocation in third-party facilities, hybrid and public cloud on Microsoft Azure, storage and backup, and the power and cooling underneath it all. You get the same people from the first diagram to the monthly review.
Plan
What you run, where it sits, what depends on what, and what your obligations are. We write it down before anyone orders a rack.
Build
Server rooms, comms rooms and racks in your premises or a colocation facility, with storage, backup, power and cooling sized to the load.
Move
Relocations and migrations into colocation, Microsoft Azure or a new site, staged so the business keeps trading.
Run
Monitoring, patching, backup checks and a regular review, so the platform stays boring in the best way.
Sovereignty and compliance
The five terms people keep asking about.
Hosting decisions in Australia tend to run into the same handful of frameworks. Here is what each one is, without the acronym fog.
- Data sovereignty
- Where your data is stored, and which country's laws can reach it. For organisations covered by the Privacy Act 1988, Australian Privacy Principle 8 sets rules for disclosing personal information overseas, which includes some cloud and hosting arrangements.
- Hosting Certification Framework
- A Digital Transformation Agency framework for hosting Australian Government data. Providers can be certified at two levels, Certified Strategic and Certified Assured. It matters if you hold or want to hold government data.
- IRAP
- The Infosec Registered Assessors Program, run by the Australian Signals Directorate (ASD). Registered assessors check a system against the Information Security Manual (ISM) and report on how well it meets the controls.
- SOCI Act
- The Security of Critical Infrastructure Act 2018. Data storage or processing is one of the critical infrastructure asset classes, and responsible entities have obligations that include maintaining a risk management program.
- CPS 234
- APRA's prudential standard on information security. It applies to APRA-regulated entities such as banks, insurers and super funds, and it reaches information assets managed by third parties, which includes hosting providers.
Where SCCS fits
We help you work out which of these obligations apply to you, then choose, build and run hosting that meets them, whether that sits on your premises, in a colocation facility or in the cloud. Where your data needs an IRAP-assessed or government-certified provider, we help you pick one that holds it. Our own information security is certified to ISO/IEC 27001:2022 (Intertek, certificate 0223646, valid to 31 August 2028).
This is general information, not legal advice.
Choosing a home for your workloads
Colocation, managed infrastructure or cloud.
None of the three is the right answer in general. The right one depends on what you run, what you must keep control of, and who you want holding the pager.
Colocation
- What you own
- Your hardware, in a third-party facility
- Who runs it
- You or a partner run the equipment; the facility provides power, cooling, connectivity and physical security
- When it tends to fit
- You want control of the platform without building and powering your own room
Managed infrastructure
- What you own
- Often your hardware or a dedicated platform, operated by a provider
- Who runs it
- A provider handles day-to-day operation, patching and monitoring to an agreed service level
- When it tends to fit
- You want predictable operations and do not want to staff the platform yourself
Public or hybrid cloud
- What you own
- Capacity rented by use, such as Microsoft Azure; some workloads may stay on site
- Who runs it
- The cloud provider runs the underlying platform; you configure and secure what sits on it
- When it tends to fit
- Demand varies, you want to avoid hardware cycles, or some workloads suit a mix
Relocations and migrations
Moving a server room without holding your breath.
A planned move is mostly preparation. The cutover itself should be the quietest part of the project. It draws on the same relocation and build work we do for clients on our infrastructure projects page.
See infrastructure projects- 01
Inventory
Every server, storage array, switch and licence, with an owner for each.
- 02
Dependencies
What talks to what, in which order it must start, and which systems the business cannot do without.
- 03
Staging
New environment built and tested before anything moves, with a rehearsal where the risk justifies one.
- 04
Cutover windows
Moves scheduled around the business calendar, in an order the dependency map supports.
- 05
Rollback point
A defined moment after which going back is no longer simple, agreed in advance with the people who sign off.
- 06
The morning after
Someone on hand when staff log in, a checklist of what to verify, and a short review a few weeks later.
On-premises AI hardware
Data-centre GPUs are not gaming cards.
Inference GPUs such as the NVIDIA L4, L40, A16 and T4 are built for servers. Most are passively cooled and rely on the chassis airflow, they come in data-centre form factors, and you size them by memory and power draw rather than by frame rate. Match the card to the server and the model you plan to run, and check that the rack can feed and cool it.
- NVIDIA L4 24GB accelerator
- NVIDIA L40 48GB accelerator
- NVIDIA A16 64GB accelerator
- NVIDIA T4 16GB accelerator
Trade pricing is on application. Tell us the server you plan to fit it to and we will help you check the match.
Guides
Start here, then go as deep as you need.
The pages and guides most people read first when they are weighing up hosting, sovereignty and a server room move.
Questions we hear
Data centre and hosting, answered.
Where would our systems actually live?
Wherever suits the workload and your obligations: on your premises, in a third-party colocation facility, in Microsoft Azure, or a mix. SCCS designs, builds, moves and supports the infrastructure in each, and helps you choose the facility.
Our work needs IRAP-assessed or government-certified hosting. Can you help?
Yes. We help you work out which level applies to your data and choose a hosting provider that holds it, then plan the move and run what sits on top. SCCS itself is certified to ISO/IEC 27001:2022.
How do I know whether the SOCI Act or CPS 234 applies to us?
It depends on what your organisation does and how it is regulated. CPS 234 applies to APRA-regulated entities. The SOCI Act applies to responsible entities for defined critical infrastructure assets. We can help you map your systems against your obligations, and your legal adviser confirms the answer.
Should we keep servers on site, use colocation, or move to the cloud?
It depends on the workload. Latency-sensitive or specialised systems often stay close, steady workloads can suit colocation, and variable demand often suits cloud. Many organisations end up with a mix, and we will say so if one option is clearly wrong for you.
Can you move our server room without a long outage?
Usually the outage can be kept short and planned. We inventory what you have, map dependencies, build and test the destination first, then move in staged cutover windows with a rollback point agreed beforehand.
Can you supply GPUs for running AI on our own hardware?
Yes. The catalogue carries data-centre GPUs such as the NVIDIA L4, L40, A16 and T4. Tell us the server and the workload and we will help you match the card, power and cooling. Trade pricing is on application.
Is any of this legal advice?
No. We explain the frameworks in plain English and help you choose and run suitable hosting. For a ruling on what your organisation must do, speak to a lawyer.
Ready when you are
Talk through where your workloads should live.
Forty-five minutes with someone senior. We map what you run, where it sits today, what your obligations are and what a sensible next step looks like. No obligation.