Tier III: What a Cloud Provider Actually Owes You

Digital sovereignty isn't just about where data is stored. It also means looking at the infrastructure hosting it, its resilience, the conditions under which it's run, and the guarantees the operator actually provides.

That's where the Tier system, created by the Uptime Institute, gets interesting.

It ranks data centers by their ability to keep running through failures. Tier III rests on the principle of concurrent maintainability: the capacity components and distribution paths needed can be taken offline for maintenance or replacement without interrupting operations.

On paper, that sounds credible.

So the problem isn't the definition.

It's knowing what was actually certified.

The Uptime Institute distinguishes three certification phases, at different points in a data center's life.

Tier Certification of Design Documents checks that the data center's design meets the criteria for the Tier being claimed. It's a validation of the design, before construction.

Tier Certification of Constructed Facility comes next. It verifies that the built data center matches the certified design and can meet the defined performance requirements. The process includes demonstrations of the systems under real conditions.

Finally, Tier Certification of Operational Sustainability looks at operations: the practices, procedures, and behaviors that keep the expected performance level up over time. This third phase comes after the design and construction certifications.

In other words: a Tier III design certification alone doesn't mean the built facility has also been certified Tier III.

That's an important nuance.

Because between a blueprint and a building, there's construction. Changes, technical trade-offs, or gaps can happen along the way. That's exactly why the constructed-facility certification exists: it checks that the delivered data center matches the certified design and meets the expected requirements.

And there's another nuance worth knowing: phrases like "Tier III equivalent," "built to Tier III standards," or "Tier III design" don't necessarily mean the Uptime Institute has certified the facility.

So the word that matters isn't just Tier III. It's: certified by whom, for what, and at what stage?

Three questions are enough to start verifying before you sign.

At exactly what stage? Design, constructed facility, or operations?

Which site does it cover? The certification applies to one facility, and can specify a phase, a room, a pod, a module, or some other part of the site. So it's worth checking it actually matches the data center hosting your infrastructure.

Is the certification verifiable? The Uptime Institute publishes a list of certified sites. An external check always beats a certification simply mentioned on a brochure.

→ Verify a certification

Checking a Tier III certification only covers one angle of digital trust, anyway : the resilience of the physical infrastructure.

How data is protected and managed day to day is another. That's part of what ISO 27001 covers.

Two different standards, two different subjects, one shared principle:

it gets verified. It doesn't get declared on a brochure, even when we're the ones who wrote it first.

Tier III certification is just one example.

The same gap between the label and what it actually covers shows up elsewhere: sovereignty, compliance, security.

Every time, the question to ask stays the same:

how far, exactly?