Compliance tiers (SOC2 / HIPAA / PCI)
A whole class of customers — banks, hospitals, payment processors — will only sign with a provider that has passed the right audits. No amount of great hardware substitutes for the certificate. A garage operation simply doesn't qualify for these accounts; a hyperscaler does. Climbing the certification ladder is how you unlock the highest-paying, stickiest customers in the game.
You don't buy a certification off a shelf — you grow into it. Bigger, more serious facilities carry more of these credentials, and the customers who demand them are exactly the prestige accounts worth chasing. Until you carry the cert they require, those prospects will keep saying no, no matter how good your pitch is.
Detailed explanation
Modeled as ComplianceTier { None, Soc2, Hipaa, Pci }. Garage and SmallColo carry none; Datacenter carries SOC2; Hyperscale carries the full set. Certification is a property of the facility tier, not a purchasable item — you earn it by operating at the scale that warrants it.
Customers carry a compliance_required field, and accept_prospect hard-rejects any prospect whose requirement your current facility can't satisfy — there's no partial credit. Real-world audits cost staff time and run on 6-12 month cycles; that recurring audit-cost loop is deferred for now, so today the gate is purely the facility-tier check.