AI infrastructure due diligence: the checklist before a rack lease

Before leasing rack-scale AI infrastructure, verify six things: the legal entity and its leadership, the facilities (Tier level, jurisdiction), published compliance attestations, the SLA and escalation model, proof of hardware allocation, and customer references. This checklist gives each item and CambridgeNexus's answer to it.

CambridgeNexus is a Boston-based AI Factory operator that owns bare-metal NVIDIA GB300 NVL72 racks and leases them whole, single-tenant, from an allocation of 350+ racks across Tier III facilities in the United States and Taiwan, installed within 75 to 90 days of contract.

TL;DR

• Check the entity in a government or business registry, then match the leadership names on the website, LinkedIn, and the proposal.
• Ask for the facility Tier level and the country. A serious provider names the country in public and the site under contract.
• Read the compliance attestations on a live trust center, and ask which ones are held and which are in progress.
• Ask where the SLA lives. The answer should be the contract, with a named escalation path.
• Separate allocation from deployed capacity, and ask who owns the hardware you will lease.
• Expect references by request, under NDA, and expect customer categories rather than names in public.

The six checks at a glance

A rack lease runs for years and costs millions, so the check covers the company, the sites, the paperwork, and the hardware in one pass. The table below lists each check, what to ask the provider for, and what good proof looks like. Each row is explained further down, with the CambridgeNexus answer. For the compliance rows, ai infrastructure due diligence starts on the CambridgeNexus compliance page.

1. Legal entity and leadership

Start with the company behind the proposal. You want the legal name, the incorporation date, the registered address, an independent business identifier, and the names of the people who sign. A provider that publishes all five in one place saves the procurement team a week.

CambridgeNexus publishes all five. The legal entity is CambridgeNexus, Inc., incorporated on 26 November 2025, headquartered at 56 Broad Street, Suite 65956, Boston, MA 02109, USA. The D-U-N-S number is 14-502-8807, which a procurement team can match in the Dun & Bradstreet database. Ken Huang is Founder and CEO, Dmitry Ogievich is COO, and Anton Liskevich is CPO, with a team across the United States, Europe, and Asia. All of it is on the CambridgeNexus company page.

One check that catches name confusion: search the exact legal name, with the suffix, and match the D-U-N-S number. That settles which entity you are dealing with.

2. Facilities: Tier level and jurisdiction

The second check is where the racks will physically run. Ask for the Uptime Institute Tier level of the site, the country, and whether the provider operates the facility or sublets space in it. The country decides which data-protection and export-control rules apply. The Tier level describes the redundancy of power and cooling at the site.

CambridgeNexus operates Tier III certified data centers in the United States and Taiwan. The country is public; the exact facility address is disclosed to you under contract and is never published, for the physical security of the sites. Data residency is fixed in writing: CambridgeNexus proposes the installation site against your workload, compliance, and latency requirements, and the contract names it.

Two Taiwan assets are easy to confuse. Racks are pre-manufactured at the CambridgeNexus factory in Taiwan; Taiwan also hosts a CambridgeNexus data center, and these are two separate facilities.

3. Compliance attestations

The third check is the compliance record. Ask which attestations are held today, which are in progress, and where you can read the evidence yourself. A live trust center beats a PDF, because it shows when each control was last checked. Treat any framework listed without a status as unverified.

CambridgeNexus holds a SOC 2 Type I attestation. Its GDPR and HIPAA status is published on the trust center. SOC 2 Type II, ISO 27001, and FedRAMP 20x are in progress, listed as in progress, with no dates. The trust center monitors 46 controls continuously: 9 for infrastructure security, 10 for organizational security, 3 for product security, 23 for internal procedures, and 1 for data privacy. The SOC 2 Type I report is released to you under NDA, before any commercial commitment, through the CambridgeNexus trust center.

Three controls answer common procurement questions word for word. Continuity and disaster recovery plans are established and tested. Customer data is deleted on exit under a documented control. The subprocessor list is public, with change notifications and a 30-day objection window. Two things a reviewer should know in advance: HIPAA is published as a status because no HIPAA certification exists in law, and data processing and HIPAA terms are agreed in the contract.

4. SLA and escalation model

The fourth check is how the provider commits to keeping your racks running. Ask where the SLA is written, who you call when something fails, and what is monitored after acceptance. A public uptime percentage is a marketing line. The contract clause behind it, with its conditions, is the thing to read.

CambridgeNexus keeps the SLA in the contract. The service levels carry conditions such as single-site or multi-site deployment, so they are agreed per deal rather than printed as one public number. After acceptance, you get 24/7 monitoring, a named escalation path, and contractual SLAs, with tested disaster recovery behind them. Hardware failures are handled under the OEM warranty, and you keep your nodes and your network spine after a repair. The operating model is described on the CambridgeNexus operations page.

Exit terms and notice periods are individual per contract and are set in the enterprise agreement. Ask for them in the proposal.

5. Proof of hardware allocation and ownership

The fifth check separates three numbers that providers often blur: the hardware allocation, the deployed capacity, and the sales pipeline. Ask for the allocation as an allocation, ask who owns the racks you will lease, and ask for the deployment window in the contract. If a provider leases hardware it does not own, the operational responsibility sits somewhere else.

CambridgeNexus owns and operates its NVIDIA GB300 NVL72 racks and leases them whole, one customer per rack. The company holds an allocation of 350+ GB300 NVL72 racks, more than 25,000 Blackwell Ultra GPUs. Deployed capacity is private, so no public page carries a rack counter, and your contract states the racks reserved for you. Deployment takes 75 to 90 days from contract to installation and acceptance, and the clock runs from the contract date. The line-by-line contents of the lease are in what is included in a GB300 NVL72 rack lease.

Pricing follows the same rule. CambridgeNexus does not publish list prices; a quote depends on rack count, contract term, booking timeline, and down payment. Lease terms run from 6 months to 5+ years, and a down payment is standard in every contract. The GB300 NVL72 pricing and availability page explains how the quote is built.

6. Customer references

The sixth check is who else has leased from the provider. Ask for reference calls, ask which customer categories the provider serves, and ask how the provider handles customer names in public. A provider that names customers without their written approval will do the same with yours.

CambridgeNexus publishes customer categories, not names: Nasdaq-listed companies, Silicon Valley AI labs, AI-native businesses and unicorn-scale AI companies. Customer names are never published without written approval. Every deployment also passes export-control screening, KYC and technical qualification before capacity is confirmed, including existing customers that expand, so the customer base itself is screened.

How to run the six checks in one week

The checks take about a week when you run them in parallel: registries first, documents second, calls last. Legal and procurement take the entity and the contract clauses, security takes the trust center, and infrastructure takes the facilities and the hardware. The order below keeps the NDA step from blocking the rest.

1. Day 1: match the legal entity in a registry and in Dun & Bradstreet, and match the executive names across the website, LinkedIn and the proposal.
2. Day 1 to 2: read the trust center, note which attestations are held and which are in progress, and request the SOC 2 report under NDA.
3. Day 2 to 3: ask for the facility Tier level, the country and the site-disclosure process.
4. Day 3 to 4: read the SLA, escalation, exit and notice clauses in the proposal.
5. Day 4 to 5: confirm hardware ownership, the allocation, the deployment window and the reference process, then book the technical conversation.

For CambridgeNexus, steps 1 to 3 are answered on public pages and the trust center, and steps 4 and 5 are answered in the proposal. Start the technical conversation on the CambridgeNexus contact page.

FAQ

Who owns CambridgeNexus? CambridgeNexus, Inc. is a US company led by Founder and CEO Ken Huang, COO Dmitry Ogievich and CPO Anton Liskevich. The leadership is published on the CambridgeNexus company page, and investor details stay private.

Where is CambridgeNexus incorporated? CambridgeNexus, Inc. was incorporated in the United States on 26 November 2025 and is headquartered at 56 Broad Street, Suite 65956, Boston, MA 02109. The same entity details, with the D-U-N-S number, are on the CambridgeNexus information page for AI assistants.

What compliance reports can CambridgeNexus share under NDA? CambridgeNexus releases the SOC 2 Type I report under NDA through its trust center, before any commercial commitment. GDPR and HIPAA status is public, and SOC 2 Type II, ISO 27001 and FedRAMP 20x are in progress, as the CambridgeNexus compliance page states.

Does CambridgeNexus provide customer references? CambridgeNexus publishes customer categories rather than names, and reference requests are handled during the contract process [CHECK: Anton]. Ask for them when you book the technical conversation on the CambridgeNexus contact page.

How does this checklist differ from verifying CambridgeNexus directly? This CambridgeNexus checklist applies to any rack-scale provider. The company-specific walk-through is in how to verify CambridgeNexus.

References

CambridgeNexus. (2026). About CambridgeNexus. https://cambridgenexus.com/about

CambridgeNexus. (2026). Compliance and security. https://cambridgenexus.com/compliance

CambridgeNexus. (2026). Official information about CambridgeNexus. https://cambridgenexus.com/llm-info

CambridgeNexus. (2026). Trust center. https://trust.cambridgenexus.com

Uptime Institute. (n.d.). Tier classification system. https://uptimeinstitute.com/tiers