North Ayrshire Council has committed more than £1.17 million of public money to a six-year data-centre contract awarded directly to one supplier. DataVita operates its own Scottish facility but can also act as an intermediary for global cloud platforms under the national procurement framework. The published award does not identify the infrastructure involved, disclose whether third-party cloud services form part of the package or explain why the other approved suppliers were not invited to compete.
North Ayrshire Council has awarded a six-year contract worth £1,175,145.80, excluding VAT, for colocation services supporting council ICT infrastructure.
The agreement was concluded with DataVita on 10 June 2026, began on 22 June and is scheduled to continue until 21 June 2032. The award was published through Public Contracts Scotland on 7 July.
The notice describes the purchase as secure hosting within a Tier III-equivalent data-centre environment, together with connectivity and support. It does not identify the council systems, equipment or categories of information covered by the contract.
Colocation normally involves placing an organisation’s servers, storage or network equipment inside a specialist commercial facility. The operator supplies the building, power, cooling, physical security and connectivity, while the customer may continue to own and control the equipment.
That differs from transferring a complete service or database to a public-cloud platform such as Microsoft Azure, Amazon Web Services or Google Cloud.
The available notice does not establish whether DataVita will have access to information held on North Ayrshire’s equipment. It also does not say whether the contract consists entirely of physical colocation or includes cloud capacity and services ultimately supplied by other companies.
Data-Centre Operator And Cloud Intermediary
DataVita operates a physical data-centre business in Scotland. The North Ayrshire notice identifies the contractor as an SME based at York Road in Chapelhall, North Lanarkshire, and describes the purchase specifically as colocation for council ICT infrastructure.
On that evidence, this is principally a contract for DataVita’s own hosting environment, connectivity and support rather than a straightforward resale of somebody else’s cloud platform.
However, DataVita is also one of the suppliers approved under the Scottish Government’s Cloud and Hosting Services Framework. That framework covers public, private, hybrid and community cloud, colocation and cloud-transition services. Scottish Government cloud-procurement guidance says the framework can also be used to buy hyperscale services from AWS, Microsoft Azure and Google through reseller arrangements provided by framework suppliers.
DataVita can therefore occupy two positions in the public-sector supply chain. It may provide its own physical infrastructure while also acting as an intermediary through which a public body gains access to services operated by a global cloud company.
There is no evidence in North Ayrshire’s published award that AWS, Azure, Google or another hyperscale platform is included in this particular £1.17 million contract.
There is equally no contractual breakdown in the public notice allowing residents to see whether every element is supplied directly by DataVita or whether any connectivity, cloud capacity, software or specialist support is ultimately provided by another company.
The issue is not that resale is necessarily improper. Resellers can simplify billing, support and procurement. The concern is that each additional supplier can create another contractual and technical dependency, while making responsibility for outages, security failures, data location and eventual migration harder for the public to follow.
No Mini-Competition For The Contract
North Ayrshire did not conduct a separate open tender or mini-competition for the six-year agreement.
Officials instead made a direct call-off from the Scottish Government framework, known as SP-22-023. The award notice records one tender and lists price as the award criterion. It states that the procurement complied with the framework agreement and applicable call-off procedures.
The framework contains five suppliers: Brightsolid, DataVita, iomart Hosting, Softcat and Storm ID. It began in November 2023 and remains available to Scottish public bodies until October 2027. The framework permits both direct awards and mini-competitions.
There is no documentary basis for describing North Ayrshire’s procurement as unlawful or claiming that competitors were improperly excluded.
The narrower question is why the council selected the direct-award route rather than asking the other approved suppliers to compete for its particular requirement.
The published notice does not explain that decision.
Because no mini-competition was conducted, the public record contains no comparison showing what Brightsolid, iomart, Softcat or Storm ID might have charged. Nor does it identify whether another supplier could have offered different arrangements concerning data location, cloud reselling, energy consumption, technical support or the council’s eventual exit from the contract.
The Scottish Government says the framework is intended to produce cash savings and value for money. That may be true across the framework as a whole. It does not provide a visible comparison demonstrating that DataVita offered the lowest price or strongest overall arrangement for this individual six-year award.
What Will Depend On The Contract?
North Ayrshire Council administers sensitive information across services including social work, child protection, education, housing, benefits and council tax.
The award notice does not say whether systems supporting any of those functions will be housed under the agreement.
It does not identify whether the contract covers primary operational servers, backup systems, disaster-recovery equipment, network infrastructure or a combination of those functions. The notice also contains no accompanying procurement or contractual documents.
The public record therefore does not disclose the agreed uptime, recovery times, backup arrangements, supplier access, subcontracting, service-failure penalties or process for removing council equipment when the agreement ends.
Those protections may be contained in documents that have not been published. Their absence from the award notice does not prove that the council or supplier has neglected security.
It prevents residents from assessing how much of the council’s ability to operate will depend on the facility and which organisation would be responsible if a service involving several suppliers became unavailable.
The Scottish Government says all suppliers on the framework hold ISO 27001 certification and third-party cyber-security accreditation. It also says cloud services must be delivered within the European Economic Area and meet a power usage effectiveness standard below 1.6.
Those are useful baseline requirements. They do not disclose the precise safeguards, service locations or chains of responsibility included in North Ayrshire’s individual contract.
The Cost To The Public
The agreement represents an average commitment of approximately £195,858 a year before VAT, although payments may not be distributed evenly across the six years.
A specialist data centre could save money if it allows North Ayrshire to close unsuitable server rooms, reduce energy and maintenance costs or avoid major upgrades to council buildings.
The award notice quantifies none of those potential savings.
It does not identify an existing facility that will close, a previous contract being replaced or any staffing, property, electricity or equipment costs expected to fall.
Without that baseline, residents cannot determine whether the contract will reduce North Ayrshire’s total technology expenditure or add another recurring cost alongside cloud platforms, software subscriptions, network services and other digital contracts.
The absence is more consequential where the selected provider may supply both its own infrastructure and access to third-party cloud services. Without a published breakdown, it is difficult to establish which costs belong to the physical facility, which relate to connectivity and support, and whether North Ayrshire is paying for services passed through from another supplier.
Six Years Of Operational Dependence
Once servers and network equipment are installed, connected and incorporated into disaster-recovery arrangements, moving them to another facility can require new connections, testing, physical transport and carefully controlled service migration.
Where third-party cloud services are also involved, departure may require changes to accounts, licences, applications, identity systems, stored data and commercial agreements.
None of this makes colocation or cloud reselling inherently undesirable. It makes a clear exit plan part of the value-for-money assessment.
North Ayrshire’s notice does not reveal the council’s arrangements for leaving the facility in 2032, the assistance DataVita would be required to provide, the ownership of installed connections or the costs of transferring services to a replacement operator.
A service can appear economical at the start and become expensive later if changing supplier requires extensive technical work or if the customer becomes dependent on the intermediary through which other services are purchased.
The public record does not contain enough information to assess that exposure.
Scottish-Controlled, But Part Of A Wider Supply Chain
Companies House identifies the legal business as HFD DataVita Limited, company number SC467509. It was incorporated in Scotland in January 2014, remains active and is registered as carrying out computer-facilities management activities.
HFD Technology Group Limited is its active person with significant control, holding at least 75 per cent of the shares and voting rights and possessing the right to appoint or remove directors.
The records therefore do not support a claim that North Ayrshire has transferred its infrastructure directly to a foreign technology conglomerate.
But Scottish ownership of the immediate contractor does not necessarily mean every service supplied through that contractor is Scottish-owned or operated. The national framework expressly allows suppliers to provide AWS, Azure and Google cloud through reseller arrangements.
That makes the identity of the prime contractor only one part of the question.
Residents also need to know whether subcontractors or hyperscale platforms sit behind the service, where each part of the infrastructure is located, which company has technical access and who carries responsibility when systems cross corporate boundaries.
Commercial Optimism Is Not Risk Planning
DataVita publicly presents the growth of AI and demand for high-performance computing as a long-term commercial opportunity.
In the company blog supplied to Modern Scot, it argued that reporting about AI failure had travelled faster than reality, described adverse coverage as sensational and said the principal barriers to successful adoption were human capability, management and culture.
A company building and selling AI-capable infrastructure has a legitimate interest in arguing that demand will persist. That commercial position does not establish that its data-centre services are insecure or that it will fail to fulfil North Ayrshire’s contract.
It does make the distinction between commercial confidence and operational preparation especially relevant.
Positive returns from AI do not remove the possibility of cyberattack, power failure, connectivity loss, equipment damage, cloud-provider disruption, inaccurate automated outputs, supplier failure or expensive dependence on an intermediary.
The correct measure of an infrastructure provider is not whether it expects the technology market to grow. It is whether it and its customers have planned for each layer of the service to fail.
North Ayrshire’s published award does not provide that evidence. It does not identify the systems involved, any underlying cloud suppliers, the chain of operational responsibility or the exit arrangements applying in 2032.
The blog does not prove that DataVita takes risk lightly in its technical operations. It does reinforce the need for the council’s contractual risk controls to be visible and independently assessable rather than inferred from the supplier’s confidence in the market it serves.
Sources
Public Contracts Scotland — Award of NAC/DA/5138: Provision of Colocation Services for Council ICT Infrastructure
https://www.publiccontractsscotland.gov.uk/search/show/search_view.aspx?ID=JUL559589
Scottish Government — Cloud and Hosting Services Framework SP-22-023
https://www.gov.scot/publications/procurement-cloud-and-hosting-services-framework-sp-22-023/
Scottish Government — Cloud Framework: Procurement Routes
https://www.gov.scot/publications/cloud-framework/pages/cloud-procurement-routes/
Companies House — HFD DataVita Limited
https://find-and-update.company-information.service.gov.uk/company/SC467509
Companies House — HFD DataVita Limited: Persons With Significant Control
https://find-and-update.company-information.service.gov.uk/company/SC467509/persons-with-significant-control
DataVita — Why Bad News About AI Travels Faster Than Reality
https://blog.datavita.co.uk/blog/why-bad-news-about-ai-travels-faster-than-reality
