Colo. Look for the following four features in an ASP site, co-located or not. The server hosts valuable information. You can't have a situation where anyone can walk in and access unprotected parts of the network or hardware. If the location hosts multiple services, make sure it has an overall access security system, as well as access security for each server. The system location must be protected against civil strife, fire, or floods.
Most people think encryption, passwords, and redundancy with backup are enough to keep data safe.
But data security must go further. Because multiple companies are accessing the ASP server, the ASP must keep each company's data strictly separate, and not permit one company to access another company's data. The employees maintaining the server must be as reliable as employees of the company, or they must be restricted. Reliability Multiple electrical systems with backup generators help ensure that systems stay running. Ask how the ASP's location is prepared for earthquakes and other natural disasters.