Hosting and agent servers: company data and AI in the same building

Research note, October 27, 2026, by Alexander Grabowski (B4L). Sources were retrieved on October 27, 2026. Figures are cited, and our own estimates are marked.

This note covers how ordinary hosting (colocation, virtual servers, managed servers, and storage) and "agent servers" fit into the GPU plan. An agent server keeps a company's documents, databases, mail, and ERP in the same data center as the model inference, together with the AI agents that work on them. B4L prepared this note as consultant; the investor would build, own, and sell the services. Money is given in THB, with USD in parentheses at 33 THB per USD, the B4L planning rate. Prices exclude VAT unless stated.

In short

• Thai hosting is already priced and competitive. Colocation costs 2,000 to 3,000 THB per rack unit (U) a month and 38,800 to 40,000 THB for a full rack, which is sold with 3 kW and with 5 kW as the next step.[394][390][395] NIPA Cloud charges 2,060 THB a month for a virtual server with 2 vCPU and 8 GB.[396]
• Thai law does not force most companies to keep their data in Thailand. Transfers of personal data abroad under the PDPA need paperwork, and from September 10, 2026, the national cloud standard requires a main data center in Thailand only for the high-impact systems of government, regulators, and critical infrastructure.[397][398][399]
• AWS has run a Thai region since January 2025, so keeping data in Thailand is no moat by itself, but neither AWS nor Google lists GPU instances there.[154][10][11] The case rests on putting data, open Thai-capable models, GPUs, agents, and local staff under one roof, with no data leaving the building by default (our judgment).
• The only Thai price list for private AI that we found is Thai AI Cloud's. It starts at USD 34,000 (1.12 million THB) a month for four dedicated B300 GPUs; the vendor is new, and the prices are its own claims.[400]
• An open-source agent server is feasible except for NVIDIA's CUDA libraries and firmware (our reading). Our indicative packages run from about 13,000 THB a month (shared models, up to 25 users) to 467,000 THB for a dedicated 8x RTX PRO 6000 server (our estimates). ChatGPT Business, Claude Team, and Gemini Enterprise cost USD 20 to 21 per user a month.[401][402][403]
• One Hetzner data-center unit is about the size of the investor's whole option B (our estimate). We found no Thai provider that builds its own servers and data centers for mass-market hosting.
• BOI's data-center promotion requires colocation and managed services in any case, and its cloud-service promotion needs two ISO 27001 data centers in Thailand linked at 10 Gbps or more.[389][250]

What the investor could sell

The investor could sell eight product lines. The GPU and model services are priced in the hardware note and in model/results.md in the repository, and the agent server bundles the rest.

The note on VPS and dedicated servers turns the virtual-server line into packages with full specifications, prices and costs, and adds dedicated servers.

Power is most of what colocation sells. True IDC's 38,800 THB rack works out to about 12,900 THB per kW a month, and 3 kW costs about 12,500 THB a month in electricity at the study's 3.81 THB/kWh and a PUE of 1.5, the ratio of total facility power to IT power (our arithmetic). Traffic that leaves the building costs money elsewhere: NIPA charges 2.31 THB per GiB of international transfer and AWS Bangkok USD 0.108 per GB, while Thai colocation offers include unlimited transfer.[418][419][404] Agents that read data in the same building send almost nothing out.

Why data and AI belong in the same building

The rules

PDPA transfers (sections 28 and 29). The Personal Data Protection Committee (PDPC) set the rules for cross-border transfers in two notifications that took effect on March 24, 2024.[420] A transfer abroad needs an adequate destination, binding corporate rules, or safeguards such as standard contractual clauses, and breaches carry fines of up to 5 million THB.[420][421] As of September 2025, no list of adequate countries had been published.[397] Thailand therefore has no general rule on data localization, but it does have paperwork. A host that processes personal data for a customer is a processor and needs a contract with that customer.[422]

The national cloud standard. The cloud standard of the National Cyber Security Committee (NCSC) was published in the Royal Gazette on September 10, 2024, and is in force from September 10, 2026.[423][398] It covers government agencies, regulators, and critical information infrastructure (CII) organizations, together with their cloud providers, and any system that holds personal data counts as at least medium impact.[424] Clause 5.2.5.1 requires a main data center in Thailand and a backup in Thailand or Southeast Asia, Singapore and Hong Kong included. By the standard's own table, the clause binds only high-impact systems, so a bank's HR system or a shop's customer database is untouched.[425][399] CII includes banking, energy, telecoms, transport, and public health.[426] The required certifications rise with the impact level, as the section on certifications below shows.

Banks. A bank must notify the Bank of Thailand (BOT) 30 days before it uses private cloud from a provider outside its group, must seek approval before it uses public cloud for critical IT, and must give itself, its auditors, and BOT the right to examine the provider.[427] BOT's 2023 rules on IT risk require banks to know where a public-cloud provider processes and stores their data, and to keep backups in Thailand or a third country if the provider is abroad.[428]

Securities and insurance. The SEC must be able to inspect a securities firm's cloud provider on site.[422] Insurers need written SLAs with their IT providers and must report cyber incidents to the OIC within 72 hours.[429]

Government. A draft classification by the Digital Government Development Agency (DGA) sends "protected" data, such as tax, medical, and financial records, to domestic public clouds, and "highly protected" data to sovereign or state-controlled clouds in Thailand.[430] Since October 1, 2025, all state cloud purchases have gone through the central GDCC platform, so the investor would reach government mainly as a subcontractor (our reading).[431]

Latency

Measured from Bangkok on October 27, 2026, a round trip to Singapore took 22.7 to 23.1 ms, to Los Angeles 197 ms, and to Frankfurt 203 ms.[432][433] One round trip to Singapore takes about as long as a small model's whole time to first token on one H100 (35 ms in one benchmark).[434] Agents call models and tools one after another, so the delays add up. By our calculation, a task with 20 sequential calls loses about 0.5 s through Singapore (20 x 23 ms) and about 4 s through the US or Europe (20 x 200 ms), against under a millisecond per call inside the building. The round trip from Chiang Mai or Korat to Bangkok was not measured; option A estimates 8 to 15 ms for Chiang Mai.

Control

When a customer uses its own encryption keys, the cloud standard forbids the provider to store or manage them.[425] An agent server can keep the keys in the customer's own vault and handle sign-in through the customer's identity system. There is an honest limit to this: a model can read only what it can decrypt, so data in use is visible to the host unless the GPU runs in confidential-computing mode.

What this does not prove

AWS opened its Thai region in January 2025 and marketed it for data residency. Google opened in Bangkok in January 2026, and a Thai bank cites BOT compliance as its reason for using the new region.[154][156] Rouse even describes a reading under which data stored abroad is not transferred at all if only the controller holds the keys.[397] Residency, in other words, is something any serious provider already offers. What the hyperscalers do not offer in Thailand is GPUs next to the data, Thai models, and people who wire agents into a Thai company's mail, files, and ERP (our judgment).

The agent server: how it would work

Each customer gets a tenant zone: its own virtual machines on its own network segment, with no route to the internet unless the customer allows one. The customer's data sits in that zone. Document search runs on PostgreSQL with pgvector, or on Qdrant; files go into an S3-compatible bucket; and connectors keep mail, file shares, and the ERP in sync. Agents run in the same zone and reach all of this through MCP tools (the Model Context Protocol, the open standard for calls from agents to tools), and they talk to other agents over A2A.[435] Staff sign in with the customer's single sign-on. An agent calls models through a gateway with a key issued to that customer. The gateway enforces quotas, logs every call, and routes it either to the shared inference pool or to GPUs dedicated to that customer. Nothing in this path leaves the building.

A conflict on confidential computing. NVIDIA's MIG page says that MIG instances on Hopper and Blackwell can be isolated with confidential computing, but NVIDIA's reference for self-hosted Kubernetes says "MIG and vGPU are not supported in CC mode".[444][447] We give more weight to the reference, because it describes the tested configuration, and we plan confidential computing as whole GPUs on dedicated nodes. Confidential computing supports the H100, H200, B200, and RTX PRO 6000 Server Edition, uses open parts from Kata and Confidential Containers, and needs a licensed NVIDIA entitlement in production.[447]

B4L's own experience. The design is close to what B4L runs for itself: AI agents in containers on its NixOS server fleet, with MCP tools and Matrix chat. That is B4L's experience as consultant, not a description of the investor's facility. The operating system, network, and storage are covered in the open stack note.

Licenses

What stays closed. Only NVIDIA's kernel modules are open. The CUDA libraries and the GPU firmware ship as closed binaries (our reading), and we found no open replacement fit for production. NVIDIA AI Enterprise lists at USD 4,500 (148,500 THB) per GPU a year, and a five-year subscription comes with H100 and H200 NVL cards.[464] The open stack does not need it. It matters for MIG-backed virtual GPUs in VMs (our reading), and possibly for the confidential-computing entitlement, whose price is not published.

Packages and indicative prices

These prices are our estimates, not quotes. We costed each resource per month from the study's figures, summed the resources in each package at the high (worst) hardware case, and multiplied the total by 1.5 to cover unsold capacity, sales, certification, and profit. The arithmetic is in model/hosting_prices.py in the repository, and its output is in model/hosting_results.md.

These inputs give the unit costs (our estimates). The RTX PRO 6000 server costs 163,000 to 219,000 THB a month all in, so one GPU costs 20,400 to 27,300 THB and one quarter-GPU MIG slice 5,100 to 6,800 THB. A sold vCPU costs 585 THB, a usable TB of NVMe 258 THB, and an 8x B200 server 332,000 to 571,000 THB.

Set against the market, the packages compare as follows.

The Starter and Business packages sit below seat prices: 25 ChatGPT Business seats at USD 20 cost 16,500 THB a month, and 100 seats cost 66,000 THB.[401] In Thailand, BOTNOI sells at 200 to 1,000 THB per person a month and ZWIZ.AI sells chatbot sets at 28,500 to 35,000 THB a year, while Salesforce charges USD 2 per Agentforce conversation.[467][468][469] The comparison is loose, because seats give access to frontier models while the agent server offers residency, integration, and open models; the two are different products (our reading).

The dedicated node, at 467,000 THB, is well under Thai AI Cloud's managed tier at 1.12 million THB, which comes with four newer B300 GPUs.[400]

The B200 node does not compete at the high case. At 996,000 THB it costs about as much as Thai AI Cloud's 36-month price for a bare 8x B300 node (USD 30,900, 1.02 million THB).[400] Only the low hardware case (about 637,000 THB) would compete, which matches the hardware note: the B200 belongs to a second stage.

We also checked one full "pod" (our estimate). One RTX PRO 6000 server, with four GPUs shared, two split into eight MIG slices, and two sold whole, together with three CPU nodes and two engineers, carries 15 Starter, 8 Business, and 2 Dedicated GPU customers. That uses 252 of 256 vCPU, 188 staff hours against 160 billable, and 3.9 of about 9.3 billion monthly tokens at 50% load. Revenue is 833,000 THB a month against 588,000 THB of cost in the high case, so the pod breaks even at about 71% sold. One pod makes a thin business; several pods share staff and certification better.

What hosting changes in the data center

Thai hosting racks are sold at 3 to 5 kW, while the Uptime Institute's 2025 survey puts the average typical rack at almost 9 kW.[405][390][470] GPU racks in option B run from 30 kW on air to 135 kW with liquid cooling. One hall can hold both kinds if it is zoned, with a liquid-cooled GPU zone beside an air-cooled hosting zone that has cages and a meet-me room (our judgment). By our arithmetic, 200 kW of hosting in a 1 to 2 MW design means 67 racks at 3 kW, 40 at 5 kW, or 22 at 9 kW, which is 10 to 20% of the IT load. We assume a PUE of 1.5 for the air-cooled zone, which runs compressors most of the year in this climate, and 1.15 for the GPU zone. The blend is then 1.19 at 2 MW and 1.22 at 1 MW (our estimates), under BOI's limit of 1.3. Backup power and telemetry are covered in the facility systems note.

BOI. Under Sor. 9/2568, a promoted data center must provide colocation, managed services, customer backup, disaster recovery, and data hosting, with at least 2 MW of IT load, so hosting is part of the BOI case in any event.[389] The separate cloud-service promotion (8.2.2, group A2) needs at least two ISO/IEC 27001 data centers in Thailand, interconnected at 10 Gbps or more with backup links of the same speed, and certification to ISO/IEC 27001 and ISO/IEC 20000-1 before the tax exemption starts.[250] No minimum investment is stated, but PROEN's 2026 cloud certificate covered at least 282.86 million THB.[471] GPU server rental as an activity of its own (8.2.4.1) needs 5,000 million THB, which is out of reach.[472]

Promotion 8.2.2 therefore needs a second site. CMU ITSC's room has held ISO 27001 since 2019, but ITSC's rules ban private circuits, which a 10 Gbps link would need.[15][14] The alternatives are NT, with 25 racks each in Chiang Mai and Khon Kaen, both listed as under renovation, and INET, in Saraburi and at a planned 10 MW site in Khon Kaen. Their certificates remain to be confirmed.[473][474]

Location. Projects in the 20 lowest-income provinces get three extra tax-exempt years or, for A1 and A2 activities, a 50% tax cut for five years after the exemption. Chaiyaphum is on the list; Nakhon Ratchasima (Korat) and Chiang Mai are not.[250] The site selection note covers the locations, including the September 2026 pause on approvals.

Certifications, contracts, and operations

NIPA lists CSA STAR, ISO 27001, 27018, 27701, 20000-1, and 22301 (vendor claim), which sets the bar for the market.[478] ITSC's certificate covers ITSC's room; the investor's service would need a scope of its own (our reading).

Contracts and incidents. Each customer signs a data processing agreement under PDPA section 40, and bank, securities, and insurance customers will add audit rights for their regulators.[422] The controller must tell the PDPC of a breach within 72 hours, and the processor contract obliges the host to tell the customer within 72 hours. CII organizations report to the National Cyber Security Agency (NCSA) and to their regulator within 24 hours, so a host that serves them needs a faster clock.[479][480]

SLAs. NIPA guarantees 99.0% (shared-core), 99.5% (single instance), and 99.95% (two zones), with credits of 10% or 30%; True IDC sells 99.982% with dual power, and INET states 99.99% for its infrastructure.[481][404][406] Google credits 10, 25, or 100% of the bill as the sole remedy.[482] One server at ITSC can honestly offer 99.0 to 99.5%. An SLA of 99.9% or more needs the investor's own data center and a second site (our judgment).

Staff and backup. A seat staffed around the clock needs 4.7 to 5.2 people, about 500,000 THB a month at our staff rate (est.), so the pilot runs on business hours plus on-call.[483] Power is still the leading cause of serious outages, and 85% of the outages caused by human error come from procedures that were flawed or not followed.[484] Backups follow the 3-2-1 rule: three copies, on two media, with one off site.[485] The tape and object-storage design is in the open stack note.

A benchmark: Hetzner, and who in Thailand works at that scale

Hetzner, the German host that serves as this study's benchmark, runs more than 500,000 server units and over one million cloud instances with more than 450 staff.[486] It has 40 data-center units in three parks (Nuremberg 8, Falkenstein 22, Helsinki 10). Each unit has N+1 UPS, one 2.5 MVA diesel generator, and two power paths from the substation.[487] Each hall has busbars A and B, and only A is backed by UPS (our reading of the report), with 960 lead batteries and 15 minutes to act if the generator fails to start.[488] Hetzner is certified to ISO 27001 and claims no Tier rating, which makes it a cost-optimized design below Tier III (our reading).[489] One 2.5 MVA generator suggests, very roughly, 1.5 to 2 MW of IT per unit (our estimate; Hetzner publishes no MW figure), so the investor's whole option B would be one Hetzner-sized unit. Hetzner's model is to repeat cheap modular units "as needed"; each Falkenstein unit holds up to 22,000 servers.[490][491]

Some of Hetzner's design does not transfer to Thailand: outside-air cooling for up to 98% of the year, a PUE of 1.10 to 1.16, and hydro power since 2008.[490] Thailand's heat, haze, and grid rule these out (option B, site selection). Other parts do transfer: server designs of its own without unneeded parts, power supplies of 150 to 500 W matched to each configuration, and an average server life of eight years through repair and resale, against this study's five-year book life.[490][488] Its planned Gunzenhausen campus, 50 ha with 35 ha of solar, mirrors the 100 to 300 rai (16 to 48 ha) in our site plan.[492]

Hetzner's prices have risen. From June 15, 2026, it raised the price of its CCX43 cloud server (16 dedicated vCPU, 64 GB) in Europe from EUR 124.99 to 275.99 a month before VAT (EUR 148.74 and 328.43 with German VAT), citing hardware costs.[493][828] At the ECB rate of 37.821 THB per EUR, the new net price is about 10,440 THB, against NIPA's 16,480 THB for the same size.[494][396] The nearest Hetzner location is its Singapore cloud, open since August 2024 and about 23 ms from Bangkok.[495][432]

Thailand had 216 MW of data-center capacity live in the second quarter of 2026 and 944 MW under construction or planned, according to BMI.[496] Reuters reported on October 27, 2026, that as of February Thailand had 42 data centers representing 3,400 MW of IT load (approved projects rather than live capacity, by our reading). It also reported that new minimum rules (on location, land use, fuel storage, and water) and seven tiers by power demand will come with new applications opening in early 2027.[497] The large campuses sell wholesale to hyperscalers and AI tenants: STT Bangkok 1 has 20 MW and GSA01 25.6 MW.[273][498] True IDC's EEC site is planned at up to 250 MW, and Gorilla's Korat campus at 200 MW (a vendor claim).[162][364] Thai clouds and VPS hosts rent space in these buildings. We found no Thai provider that builds its own servers and data centers for mass-market hosting.

One design idea follows from this (our judgment). A single campus could hold two classes of hall that share the grid connection, the solar plant, and the staff: a Tier III-grade hall for enterprise, agent, and GPU customers, and a lean hall in Hetzner's style (one UPS path, one generator, lean servers of the investor's own design) for cheap mass hosting.

Market and competition

NECTEC's 2026 survey of 574 organizations found that 53.7% use AI (67.2% of large organizations and 43.8% of small ones) and that 26.0% of users have begun with agentic AI. Among non-users, 51.4% want a clear regulatory framework first, and staff, use cases, and cost remain the barriers.[500] An AWS-commissioned survey names skills (56%), money (48%), legal uncertainty (41%), and access to AI infrastructure (32%) as obstacles, and finds only 24% of large firms and 17% of SMEs ready for agentic AI.[501] An agent server that comes with the people who set it up answers several of these obstacles at once (our reading).

Estimates of the market's size disagree. Mordor Intelligence puts the Thai data-center market at USD 2.22 billion in 2026, growing 17.6% a year to 2032; Arizton puts colocation at USD 175 million in 2024, growing 44.8% a year to 2030; and Krungsri Research expects revenue to grow 7.5 to 8.5% a year from 2025 to 2027.[502][503][504] Analyst figures vary this much because their definitions differ, so we read them only as a direction.

The investor could stand out in several ways (our judgment): by building outside Bangkok, where almost all of this capacity sits; by serving mid-sized companies below Thai AI Cloud's entry tier of 1.12 million THB; by running an open stack with no per-seat license; by fine-tuning Thai models for each customer; by employing local engineers who build the connectors; and by working with CMU as a partner.

How to start

The phases follow the staged path in the summary.

1. Months 0 to 3 are for preparation. The first step is to ask CMU ITSC whether the colocation agreement allows serving third-party companies: the ITSC wiki accepts outside organizations that cooperate with CMU, but the public service page names internal units only.[14][238] The second is to find two or three design-partner companies, ideally in Chiang Mai, with real documents and an ERP.
2. Months 3 to 12 are the pilot. On the stage-1 RTX PRO 6000 server at ITSC, plus a small set of CPU and storage servers, the investor runs agent servers for the design partners at reduced prices. It measures tokens, storage, connector work, and staff hours per customer, which are the inputs that the prices above only estimate. Work toward ISO 27001 starts.
3. From month 12, the service grows. ISO 27001 certification is in place, a second GPU server follows when the triggers in the hardware note are met, and a second location (NT or INET) holds the backups.
4. With the investor's own data center, hosting gets its own space. A hosting zone (or a lean hall) goes beside the GPU halls. A BOI 8.2.2 application follows once two ISO 27001 sites with 10 Gbps links exist; otherwise hosting is folded into the data-center promotion.

What this means for the investor

What follows is our judgment.

Agent servers are the product line worth building, and plain hosting plays a supporting part. Colocation and virtual servers are a crowded market centered on Bangkok, but a BOI data center must offer them anyway, and they fill air-cooled space. Nobody in Thailand prices an agent server for mid-sized firms.

The offer should rest on the whole bundle rather than on data residency. Hyperscalers already store data in Thailand, but they do not offer GPUs, Thai models, agents, connectors, and people in one building.

The investor should start small and measure. Two or three design partners on the pilot server will show whether 13,000 and 54,000 THB a month are the right prices.

The lessons to take from Hetzner are its habits rather than its building. Its cooling and power arrangements do not travel to Thailand, but lean servers, long server life, and repeatable units do.

Certification and the second site should be planned early. ISO 27001 comes first, and BOI's cloud promotion, bank customers, and backups all point to two sites in Thailand.

Open questions