Safeguard
Industry Analysis•

Colocation, self build or hyperscale lease: how AI capacity is sourced

An AI company can rent space, lease a purpose built campus or build its own. How each route works, what each costs in time and risk, with real examples.

Safeguard Security Team
15 min read

A company that needs AI computing capacity has three main routes: rent space in someone else's data center (colocation), sign a long lease on a campus built for it by a developer (build to suit), or build and own the whole thing (self build). Each trades speed, control, cost and risk differently, and real projects often mix them.

This explainer covers the terms, shows how the three routes appear in public examples such as the Stargate campus in Abilene, Texas and Meta's Hyperion campus in Louisiana, and flags what the sources do not tell us. It is not investment advice.

Key numbers at a glance

  • CBRE, North America Data Center Trends H1 2026 (8 September 2026): primary market vacancy 1.4 percent, unchanged from year end 2025.
  • CBRE, same report: 7,481 megawatts under construction across eight primary markets, up 24.8 percent year on year, a level above the 2024 high.
  • CBRE, same report: over 80 percent of that is already preleased, up from 74.3 percent a year earlier; under 1,500 megawatts remains for preleasing, about six months of supply at current demand.
  • CBRE, same report: Northern Virginia vacancy 0.2 percent, down from 0.7 percent a year earlier, with 2,420.2 megawatts under construction.
  • CBRE, same report: asking rents rose for every major deployment size in the first half of 2026, led by an 8.3 percent increase for tenants taking 3 to 10 megawatts.
  • Hyperion, Louisiana (Meta Form 10-Q, quarter to 30 September 2025): leases from the joint venture to Meta start in 2029, with an initial commitment of about 12.3 billion dollars over four years, renewal options up to 20 years in total, and a residual value guarantee covering the first 16 years of operations.
  • Abilene, Texas (Commercial Observer, 22 January 2025): a 206 megawatt, 998,000 square foot phase reported as 100 percent leased to Oracle, financed with a 2.3 billion dollar JPMorgan construction loan.
  • Abilene (Bisnow, May 2025): the campus sits on a 900 acre ground lease from Lancium, with Oracle as tenant and OpenAI as end user.
  • IBM explainer (undated): IDC's definition of a hyperscale data center is at least 5,000 servers and 10,000 square feet, with most using roughly 100 to 300 megawatts.
  • Global Data Center Hub explainer: self build capital of often 500 million dollars to more than a billion dollars in established markets, a figure the article gives without a source.
  • CoreWeave annual report on Form 10-K (fiscal 2025): 43 data centers with over 850 megawatts of active power at 31 December 2025, and about 3.1 gigawatts of contracted power to be deployed over future periods.
  • CoreWeave, same filing: 38.5 billion dollars of future lease payments on leases signed but not yet started, beginning 2026 to 2029 with estimated terms of five to seventeen years.
  • Meta quarterly report on Form 10-Q (quarter to 30 September 2025): about 58.14 billion dollars of leases not yet commenced, mostly for data centers, colocations and network infrastructure, starting between late 2025 and 2030.
  • Equinix joint venture with GIC and CPP Investments (announced 1 October 2024, via Lightwave): more than 15 billion dollars to build over 1.5 gigawatts of xScale capacity for hyperscale customers.
  • Turner & Townsend survey (5 November 2025): 48 percent of respondents said power availability is the biggest obstacle to on time project delivery.
  • Meta CFO, second quarter 2025 earnings call (as reported by Bisnow): Meta will keep funding most data center development from its balance sheet but expects more off balance sheet financing.

The words, defined

Data center. A building, or group of buildings, with reliable power, cooling and network connections for computers. The computers can belong to the building's owner or to a customer.

Colocation. The owner of the building rents out space, power and cooling, and sometimes more. IBM describes it as a provider that owns a facility and rents out space, servers, bandwidth or a mix, and notes that "retail colocation" lets smaller firms start gradually.

Retail versus wholesale colocation. Retail means small slices, such as a few racks or a cage. Wholesale means large blocks, often whole rooms or buildings, in the megawatt range. These are industry terms without a single official definition, so treat the boundary as informal.

Hyperscale. A very large facility run by a very large operator. IBM cites an IDC definition of at least 5,000 servers and 10,000 square feet, and says most use roughly 100 to 300 megawatts. AI campuses now go well beyond that, at 1 gigawatt or more.

Build to suit. A developer builds a facility to a tenant's specifications after the tenant commits to a long lease. The clearest descriptions come from how real deals are reported, which the sections below walk through.

Self build. The company that will use the capacity builds and owns it, usually while financing it on its own balance sheet or through a related structure.

Powered shell. A building delivered with power and structure but without the tenant's internal fit out. It is an informal industry term rather than a defined standard.

Route one: colocation

Colocation is the fast route for modest needs. You do not buy land, wait for a utility study or hire a construction crew. You sign a contract, and the provider supplies power and cooling. IBM's explainer lists the trade: no construction costs, but rental fees and possibly start up fees, and less custom fit because you use what the provider offers. It adds that colocation lets a company start small and test configurations before committing.

The catch in the current market is availability. CBRE's H1 2026 report puts primary market vacancy at 1.4 percent, and says that with over 80 percent of capacity under construction already preleased, under 1,500 megawatts is left to preleasing, about six months of supply at the current pace of demand. Northern Virginia, the biggest market, had vacancy of 0.2 percent. CBRE's Stu Dyer is quoted saying that occupiers and capital sources that secure power early are the ones closing deals.

For smaller deals prices are rising. CBRE reports asking rents up for every major deployment size, with an 8.3 percent increase for 3 to 10 megawatt users in the first half of 2026. For a team that needs only a few megawatts, the question is less "build or rent" than "is there anything left to rent".

Colocation also has a different risk shape. The provider carries the building's construction risk. You carry the risk of being priced out at renewal, and of limited control over cooling design and power density. The Global Data Center Hub explainer makes the control point, though much of its commentary is opinion.

Route two: lease a campus built for you

Build to suit sits between renting and owning. The tenant commits to a long lease, and a developer, backed by investors and lenders, builds the campus. The lease is what lets the developer borrow. Lenders look at the tenant's promise to pay and lend against it.

Abilene is the clearest public example. According to Commercial Observer, a joint venture of Blue Owl Capital, Crusoe and Primary Digital Infrastructure borrowed 2.3 billion dollars from JPMorgan in January 2025 for a 206 megawatt phase reported as fully leased to Oracle. Bisnow adds that the campus sits on a 900 acre ground lease from Lancium, that Oracle is the tenant and that OpenAI is the end user, and that a second phase raised 11.6 billion dollars in debt and equity. The Epoch AI tracker notes that under the 2025 announcements Oracle owns the computing hardware at most of the Stargate sites, while SoftBank owns the hardware at two of them. So the building, the chips and the end user can each belong to a different party.

The advantage for the tenant is speed and balance sheet room. The developer manages land, permits and construction. The tenant starts paying rent when the buildings are ready. The cost is that the tenant is bound to a long commitment, and that the rent is set to repay the developer's investors. A building that sits empty or underused is still a bill.

The published reports on Abilene do not give the lease term, so how long Oracle's commitment runs is not public.

Renting at scale: what the filings show

Company filings give the clearest numbers on renting, because accounting rules make companies disclose leases they have signed but not yet started.

CoreWeave, which sells GPU computing to AI labs and other customers, is mostly a renter of buildings. Its annual report for 2025 says it leases space in, or licenses use of, third party data centers in the United States, Europe and the United Kingdom, and that it does not control the operation of those facilities. At 31 December 2025 it ran 43 data centers with over 850 megawatts of active power, up from 32 data centers and about 360 megawatts a year earlier, and it had about 3.1 gigawatts of contracted power still to deploy.

The same filing shows how long those commitments run. Leases signed but not yet started carried 38.5 billion dollars of estimated future payments, beginning between 2026 and 2029, with estimated terms of five to seventeen years. One single site lease gives access to 393 megawatts, delivered in phases in 2026 and 2027, with rent tied to the landlord's construction costs up to a cap; total rent ranges from 13.5 billion to 14.4 billion dollars over a sixteen year term. Rent that tracks construction cost is a build to suit arrangement in all but name: the landlord builds, and the tenant's payments are set to cover what the landlord spends.

The filing also gives the other side of the bargain. CoreWeave says its committed customer contracts had a weighted average duration of about five years at the end of 2025. Read together, the two disclosures show a gap that every renter of this kind manages: building leases that can run sixteen years, funded by customer contracts that average about five.

Large owners rent too. Meta's quarterly report for the period to 30 September 2025 lists about 58.14 billion dollars of operating and finance leases not yet commenced, mostly for data centers, colocations and network infrastructure, starting between late 2025 and 2030. The same report says Meta signed multi year third party cloud capacity arrangements worth about 40 billion dollars in October 2025. A company that builds some of the largest campuses in the world is also one of the largest tenants and cloud buyers.

Colocation companies, for their part, have moved toward the hyperscale end. In October 2024 Equinix, GIC and CPP Investments announced a joint venture to raise more than 15 billion dollars for over 1.5 gigawatts of xScale capacity on campuses above 100 megawatts, aimed at hyperscale customers, according to Lightwave. GIC and CPP Investments each hold 37.5 percent and Equinix 25 percent. The line between a colocation landlord and a build to suit developer is blurring as the deals get bigger.

Route three: build and own

Self build gives the most control. The company chooses the site, the design, the cooling and the power plan. It also carries the most capital and the most construction and permitting risk. The Global Data Center Hub explainer says self build often needs 500 million dollars to more than a billion dollars in established markets, though it gives no source for the figure. IBM's explainer makes a point that applies at any size: a hyperscale facility should not be considered a one time purchase, because operating costs continue.

The public example is Hyperion, which is a hybrid. Meta retains the development and property management roles and is the anchor tenant, according to Data Center Frontier, but a joint venture owns the buildings. Funds managed by Blue Owl hold 80 percent, and Meta holds 20 percent. Meta's own quarterly report for the period to 30 September 2025 confirms the shape: operating leases with the venture that start in 2029, an initial commitment of about 12.3 billion dollars over a four year term, options to renew for up to 20 years in total, and a residual value guarantee for the first 16 years of operations. So Meta effectively builds and uses the campus but does not carry all of it as owned property. We cover the financing in a companion post, how AI data centers are financed.

Self build also requires the power plan. Meta's Louisiana campus relies on new gas plants that the local utility, Entergy Louisiana, is building. KALB reports the Louisiana regulators approved them on 20 August 2025 by a 4 to 1 vote. A buyer who owns the site owns that dependency. A tenant who rents capacity transfers part of it to the landlord, although the landlord's delay becomes the tenant's delay.

Comparing the routes

  • Speed to first capacity. Colocation is the quickest if space exists, though CBRE's figures show little is available. Build to suit and self build are tied to construction and power schedules, which the sources describe in years. See how long it takes to build an AI data center.
  • Control. Highest in self build, lowest in colocation. Build to suit lets the tenant specify the design, within what the developer will finance.
  • Upfront cash. Lowest in colocation, which is mostly rent. Highest in self build. Build to suit shifts most of it to the developer's lenders.
  • Long term commitment. Build to suit usually carries the longest binding lease. Colocation terms vary. Self build is a commitment of a different kind, to an owned asset.
  • Risk of obsolescence. The building may last decades, but the computers do not. A building designed for today's cooling and power density may not suit the next generation of chips. Self build puts that risk on the owner. A short lease puts it on the landlord, which is why landlords ask for long ones or, in Hyperion's case, for a residual value guarantee.
  • Exposure to power delays. Everyone has it. Only the contract determines who pays for it.

A note on mixing the routes

Large buyers rarely use one route. Meta's own Q2 2025 earnings call, as reported by Bisnow, said it will keep funding most data center development from its balance sheet while increasing off balance sheet financing for flexibility. OpenAI's Stargate sites, per Epoch AI, involve developers such as Crusoe, Vantage, STACK Infrastructure, SB Energy and Related Digital, with Oracle or SoftBank owning hardware. A single lab's capacity therefore comes from several arrangements at once. If you read an announcement of "gigawatts", the contract type matters as much as the number, which is why our explainers on OpenAI and Anthropic compute commitments focus on terms.

What is firm and what is uncertain

Firm: CBRE's market statistics for H1 2026, the lease and commitment figures in CoreWeave's and Meta's filings, the reported Hyperion lease and guarantee terms, the reported Abilene loan and tenant roles, and IDC's hyperscale definition as cited by IBM.

Uncertain: the Abilene lease length, what share of a campus is "powered shell" versus fitted out, typical wholesale lease terms across the market (company filings give ranges for their own leases, not a market norm), and the unsourced cost and timeline claims in some explainers. Which route is "best" depends on a company's cash, urgency and appetite for risk, so this explainer makes no ranking.

What to watch next

  • CBRE's next report, for whether vacancy and preleasing change.
  • Whether more large tenants adopt shorter initial lease terms backed by guarantees, as at Hyperion, or longer fixed terms.
  • Disclosure of lease terms in company filings.
  • How landlords price power, which sources consistently cite as the scarce input.

Quick check

Which route is fastest?

Colocation, when space exists. In the current market CBRE reports record low vacancy and over 80 percent of capacity under construction already preleased, so availability is the limit.

Does Meta own Hyperion?

Not wholly. Funds managed by Blue Owl hold 80 percent of the joint venture that owns the campus and Meta holds 20 percent, and Meta leases the facilities, per Bisnow and Data Center Frontier.

What is a residual value guarantee?

A promise by the tenant to cover a shortfall if the lease ends and the building is worth less than agreed. At Hyperion, Bisnow says Meta makes a cash payment to the venture if a lease is not renewed or is terminated, for the first 16 years of operations.

For teams managing the software behind their own workloads, Safeguard offers SBOM and dependency scanning, plus a free scan at https://gold.safeguard.sh/scan.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.