Private Cage or Shared Rack? Colocation Security | SistemDC

Discussions of server security revolve almost entirely around software: firewalls, patch management, SSH hardening. Yet for someone with physical access most of these layers lose their meaning. A person with direct access to a disk can read the data if there is no encryption, boot from USB or pull the network cable. In this article we look at the physical security layers in colocation and the real difference between shared rack, locked rack and private cage setups.

Physical Security Layers in a Data Center

In a serious facility security is not a single door; it is built as nested rings. The layers applied at SistemDC's Istanbul facility, built to Tier 3 standards:

1. Perimeter and building entrance: Visitor logging and identity verification. Entry without an appointment is not accepted.
2. Hall access: Biometric access control. Unauthorised persons cannot enter the technical area.
3. Surveillance: 24/7 CCTV camera monitoring; aisles and rack rows are recorded.
4. Rack level: Locked rack spaces; access with card and key in rack plans.
5. Environmental protection: VESDA early smoke detection and fire suppression systems.
6. Reserved space: Complete isolation of your rack group with a private cage.

The VESDA layer is particularly important: by the time traditional smoke detectors raise an alarm, the fire has already started. Early smoke detection buys time for intervention by detecting particles in the air before visible smoke forms.

Comparison of the Three Models

For the full price breakdown and the power calculation, see the rack rental prices guide for details.

The Real Threat Model: Accidents, Not Malice

In a shared rack the most likely incident is not a targeted attack. A far more common scenario is this: a technician from another team working in the same rack pulls the wrong cable or resets the wrong device while looking for their own server. Three simple measures largely eliminate this risk:

• Labelling: Every device should carry the company name and asset number on its front and rear.
• Colour-coded cabling: Choose a distinguishable colour for your own cables.
• Cable locks: Locking power and network connectors physically prevent accidental removal.

On the side of deliberate risks, protection is strengthened at the software layer. Measures to take against the possibility of physical access:

• Disk encryption: Even if your server is stolen or a disk is removed, the data cannot be accessed. This is the single highest-return measure in colocation.
• BIOS/UEFI password and boot order lock: Prevents booting from USB or external media.
• Disabling unused ports: Idle USB and console ports are turned off.
• Chassis intrusion detection: The server feature that logs when the cover is opened is enabled.

KVKK and Audits: The Legal Side of Physical Security

The data security obligation under the KVKK covers not only cyber measures but also the physical security of the environment where personal data is held. In an audit or a data breach investigation you will face these questions:

• Who has physical access to the server and how are they authorised?
• Are access logs kept, and for how long are they retained?
• Is the hardware in a shared space, and how is the proximity of third parties managed?
• Has a data processing agreement (DPA) been signed with the service provider?

A locked private rack gives a direct and documentable answer to most of these questions: the space is allocated to you alone and access is logged by card and key. If you process special categories of personal data (health, biometric, financial), moving up to the private cage level is a defensible choice. We covered the regulatory side in the KVKK and Turkey-location server guide article.

Which Model Should You Choose?

Frequently Asked Questions

What is a private cage?
It is a separate caged area inside the data center hall that surrounds your racks and can be entered only by the people you authorise. In addition to the rack lock it provides isolation at aisle level.

Is my data safe in a shared rack?
The facility layers (biometric access, CCTV, visitor logging) apply to everyone. To minimise risk, disk encryption, a BIOS password and clear labelling should be applied.

Can I fit my own lock to my rack?
In private rack plans the rack is allocated to you and accessed with card & key. It is enough to state your need for an additional lock before ordering.

How long are camera recordings kept?
24/7 CCTV monitoring is in place. We recommend clarifying the retention period you need for your audit requirements at the contract stage.

Do I need an appointment to visit my server?
In rack plans you have the right to 24/7 physical access. In a shared rack access is escorted, so advance notice is required.

Related SistemDC Guides

• What Is Colocation? Server Colocation Guide
• KVKK and Turkey-Location Servers
• Linux Server Security and SSH Hardening
• Colocation Provider Selection Checklist
• Rack unit (U) calculation