Your servers live in a building you don't own. The racks, the power, the cooling, the security — all handled by your colocation or managed hosting provider. It's a clean arrangement, right up until something goes wrong and you find out whose insurance actually pays for the hardware sitting in that rack.

Here's the assumption that trips up a lot of companies: "It's their building, so it's their problem." It usually isn't. The equipment is yours, it's your property, and in most colocation setups the host's insurance generally isn't meant to cover it.

That's a real gap. And it's one inland marine insurance was built to close.

Quick answer: Your colocation or hosting provider's property insurance typically covers their building and infrastructure — not the servers, storage, and networking gear you own and install there. Most colocation agreements also disclaim liability for damage to customer equipment and cap the provider's exposure. To protect hardware at a third-party facility, you generally need your own coverage — most often inland marine insurance (or a commercial property policy specifically extended to off-site locations). Exact protection depends on your contract and your policy wording.

‍

Let's walk through why the gap exists, and how to close it.

Why your host's policy stops at their own equipment

A data center operator carries insurance to protect what they own: the building, the power systems, the cooling, the fire suppression, the generators. That coverage exists to keep the facility running and to protect the operator's balance sheet. It generally isn't designed to replace a tenant's servers.

Your hardware is a different story. The servers, GPUs, storage arrays, and switches you rack are your property, sitting temporarily in someone else's building. From an insurance standpoint, that's the key fact: ownership, not location, decides whose policy responds. The gear is yours, so the coverage needs to be yours too.

Think of it like a storage unit. The facility insures the building and maybe the locks. It does not insure the contents of your unit. If a pipe bursts and soaks everything inside, that's on your policy — not theirs.

What your colocation agreement actually says

If you want to know where you really stand, read the contract. Colocation and managed hosting agreements tend to be fairly consistent on this point, and often not in the tenant's favor.

Most include some combination of the following:

• ‍A disclaimer of liability for loss or damage to customer-owned equipment, often regardless of cause
• A limitation-of-liability clause that caps the provider's total exposure — commonly at something like one month's fees, or the value of service credits
• An insurance requirement obligating you, the customer, to carry your own property coverage (frequently written on a "Special Form," full-replacement-cost basis) and commercial general liability

Read together, those clauses point in one direction. The provider has contractually stepped back from insuring your hardware — and, in many agreements, has required you to insure it yourself. So even when the facility is at fault, what you can actually recover from them may be capped well below what a serious loss would cost you.

This isn't a knock on hosting providers; it's standard risk allocation. But it means the responsibility for your equipment lands on you, whether or not you've planned for it.

Who covers equipment damage in a third-party data center?

Short version: you do — through your own policy. Here's how the pieces typically line up.

‍

‍

The middle row is where companies get caught. The equipment is unmistakably yours, the host's policy doesn't reach it, and the provider's liability cap may not come close to your replacement cost. Without your own coverage, that shortfall is simply yours to absorb.

The third-party data center equipment coverage gap

The gap tends to hide because most businesses assume one of their existing policies already handles it. Often, it doesn't — or not fully.

A standard commercial property policy is built around your scheduled premises — the address on the declarations page. Coverage for property that lives somewhere else, like a third-party data center, is often limited or sublimited unless the policy is specifically extended off-site — and in some forms it may be excluded altogether. It varies by policy, which is precisely the problem: plenty of companies discover exactly where they stand only after a loss, which is the worst possible time.

That's the gap in a sentence: your property policy is anchored to your address, your equipment isn't there, and the host's policy was never covering it in the first place.

Inland marine insurance for servers stored off-site

This is where inland marine comes in, and despite the nautical name, it has nothing to do with boats.

Inland marine insurance is property coverage for movable or off-premises business property — equipment that travels, gets installed at other locations, or lives somewhere other than your main office. Servers, networking gear, and other hardware stored at a third-party data center fit squarely into what it was designed to protect.

A typical inland marine policy can respond to sudden, accidental physical loss to your covered equipment, including causes like:

• ‍Fire and smoke
• Water damage — from leaks, floods, or suppression systems‍
• Theft
• Wind, hail, and certain weather events
• Damage in transit — while hardware is being shipped or moved between facilities‍
• Accidental damage or mishandling during installation

Because it follows the property rather than a fixed address, inland marine is often the cleanest way to cover hardware in colocation and managed hosting facilities — whether the gear sits in one data center, several, or is regularly moved between them. In some cases, the same protection can instead be arranged by extending a commercial property policy to named off-site locations. Which route fits depends on how much equipment you have, how many sites it lives in, and how often it moves.

Worth checking as you compare policies: the cost to restore lost data after a covered physical loss is treated separately in some forms — included in one, sublimited or absent in another — so it's worth confirming rather than assuming.

One nuance worth knowing: this is coverage for the hardware — the physical loss. The data on that hardware, and the fallout from a breach, are different exposures. Physical damage to equipment and the data on it often falls to property or electronic data processing (EDP) coverage, while a breach or cyberattack is a job for cyber liability. A complete setup usually accounts for all three.

Inland marine vs. standard commercial property

The two overlap, but they solve different problems. Here's the distinction at a glance.

‍

Neither is automatically "right." A company with a single office and a couple of racks down the hall has a different answer than one running hardware across three colocation sites. The point is to match the policy to where your equipment actually lives — which, for a growing number of companies, is not their own address.

How to check whether your hardware is actually covered

You don't need to be a risk manager to find the gap. Pull two documents — your colocation agreement and your property policy — and check for these:

• ‍In the colocation agreement: find the limitation-of-liability clause and the insurance-requirements section. Note the provider's liability cap, and whether you're contractually required to insure your own equipment. (You often are.)‍
• On your property policy declarations: look for any off-premises, off-site, or "property in transit" coverage, and check the sublimit. If your data center address isn't listed and there's no off-site extension, assume your hardware there isn't covered until confirmed.‍
• Compare the numbers: line up your total hardware replacement cost against both the provider's liability cap and your own policy's off-site limit. A gap between them is your uninsured exposure.‍
• Confirm the perils: make sure the coverage responds to the events most likely at a data center — fire, water, and theft — not just a narrow named list.

If any of those checks makes you pause, that's the signal to get a second set of eyes on it before a loss forces the question.

The bottom line

The convenience of colocation can make it easy to forget a basic fact: the hardware in that rack is still yours, and so is the risk to it. Your host insures their building; you insure your equipment. Most colocation agreements say as much, disclaiming liability for your gear and capping what you could recover even when the facility is at fault.

Inland marine insurance is usually the most direct way to cover servers and hardware stored off-site, though extending a commercial property policy can work too. Either way, the goal is the same — make sure the equipment you depend on is protected by a policy that actually follows it to where it lives. Check your contract and your coverage before an incident does it for you.

‍

Get in touch with a Fullsteam Advisor today and learn more about costs, coverage, and more.

Frequently asked questions

Who covers equipment damage in a third-party data center?

In most cases, you do — through your own policy. The data center operator's insurance typically covers their building and infrastructure, not tenant-owned servers and hardware. Colocation agreements usually disclaim liability for customer equipment and cap the provider's exposure, so protecting your hardware generally requires your own inland marine or extended commercial property coverage. Your specific contract controls the details.

Does my colocation or hosting provider's insurance cover my servers?

Usually not. A provider's property policy is built to protect what they own — the facility, power, cooling, and security — not the equipment you install in your rack. Many colocation agreements also require you to carry your own property coverage. Always confirm what your specific agreement says.

What is inland marine insurance, and why does it apply to servers?

Inland marine insurance is property coverage for movable or off-premises business property — equipment that travels, is installed elsewhere, or is stored away from your main location. Because servers in a third-party data center sit off-site, inland marine is often the most natural fit, covering physical losses like fire, water, theft, and damage in transit. Despite the name, it has nothing to do with boats.

Doesn't my commercial property policy already cover off-site equipment?

Not always, and not always fully. Standard commercial property coverage is anchored to the address on your declarations page. Property kept elsewhere, like a colocation facility, is often limited, sublimited, or excluded unless the policy is specifically extended to that location — which is exactly the gap inland marine is designed to fill.

Is my data covered too, or just the hardware?

Inland marine and property coverage generally address the physical hardware and, in some forms, the cost to restore lost data after a covered physical loss. A data breach or cyberattack is a separate exposure handled by cyber liability insurance. Companies that depend on off-site hardware often carry a combination so both the equipment and the data are accounted for.

‍