Why Data Center Roofs Need Non-Penetrating Guardrail
Updated October 2026
Data center roofs need non-penetrating guardrail because every bolt you put through the membrane is one more place water can get in, and the room under that roof is full of live servers. A leak over an office means a stained ceiling tile and a call to the roofer. A leak over a server hall means somebody's writing an incident report.
Mention drilling to a data center facilities manager and watch their face. They're right to be twitchy about it. A non-penetrating guardrail sits on the roof surface and stays put with weighted bases, so the crews get a real guardrail and the membrane stays exactly the way the roofer left it.
A data center roof isn't like other roofs
Most commercial roofs are mostly empty space with a few units on them. Data center roofs are working equipment yards. Cooling equipment, UPS systems, generators, and cabling often sit on and around the perimeter, and all of it needs regular service. That means techs on the roof a lot more often than a typical building, and a lot of them working close to the edge.
The roof also keeps changing. Capacity gets added, cooling gets upgraded, new equipment goes in. A guardrail layout that was right three years ago may not be right today. Any fall protection you put up there should be able to move and grow with the building instead of being bolted in place forever.
That membrane is also doing a bigger job than it does on most buildings. It's the only thing between the weather and the equipment the whole business runs on.
What a leak puts at risk
Downtime isn't cheap. In the Uptime Institute's 2025 annual survey, 57% of operators said their most recent major outage cost more than $100,000, and that share has been creeping up year over year.
Now, roof leaks aren't what usually takes a data center down. Most outages trace back to power and IT systems. But think about what operators spend on backup power and redundant cooling to keep everything running, then picture drilling a few dozen holes in the roof right above all of it. Every one of those holes gets flashed and sealed, the sealant ages, and eventually one of them lets go. We'd rather not give water a way in at all.
Penetrating vs. non-penetrating guardrail on a data center
| What matters | Penetrating (bolted) guardrail | Non-penetrating guardrail |
|---|---|---|
| Holes in the membrane | One at every post, each needing flashing | None. Weighted bases sit on the roof surface |
| Roof warranty | Often requires the roofer's involvement and can put the warranty at risk | Preserved, because the waterproofing is never touched |
| Install work on site | Drilling, sealing, sometimes welding | No welding, no drilling, assembled with hand tools |
| When the roof layout changes | Old holes have to be patched, new ones drilled | Modular, so it can be reconfigured or extended |
| Long-term maintenance | Every penetration is a future leak point to inspect | No penetrations to maintain |
What OSHA requires on a data center roof
Once the building is running, anyone servicing equipment up there falls under OSHA's general industry rules, and fall protection kicks in at a 4-foot drop. During construction, the construction standard applies instead, with a 6-foot trigger. Most of the long-term exposure is on the operations side, because the service visits never stop.
On a low-slope roof, OSHA 1910.28(b)(13) works by distance from the edge. Work less than 6 feet from the edge always needs a guardrail, safety net, travel restraint, or personal fall arrest. Between 6 and 15 feet, a marked designated area is only allowed if the work is both infrequent and temporary. Data center service work is usually neither. Techs are up there on a schedule, all year, so a guardrail is the cleanest way to stay compliant without managing exceptions.
The guardrail itself has to meet OSHA 1910.29(b): a top rail 42 inches high, plus or minus 3 inches, able to take 200 pounds of force, with a midrail that keeps a 19-inch sphere from passing through.
Where a data center roof needs protection
Walk most data center roofs and the same handful of spots come up every time.
The roof edge near equipment
Cooling units and generators parked near the perimeter put techs right next to the drop. KeeGuard non-penetrating guardrail runs along the edge and around the equipment without touching the membrane.
The roof hatch
Every tech comes up through it, and an open hatch is a hole in the roof. A roof hatch guardrail with a self-closing gate protects the opening the moment it's open.
Pipe, duct, and cable runs
Data center roofs are crisscrossed with them, and stepping over a cable tray with tools in hand is how people fall. Crossover platforms get crews over them safely, and a rooftop walkway keeps them on a defined path instead of walking the membrane.
Elevated equipment and platforms
Units that sit up on stands or need service from above call for proper access. Our data center access platforms give techs a stable, guarded place to work instead of a ladder balanced against the equipment.
What to look for in a data center guardrail system
If you're comparing systems, a few things are worth pinning down before you sign anything.
Start with testing. A spec sheet that says "meets OSHA" isn't the same as an independent test report, so ask for the report. KeeGuard is one of the few rooftop guardrail systems that's been third-party tested.
Then check the wind rating against your actual site. A lot of data centers sit on big, open lots where nothing slows the wind down. KeeGuard handles 150 MPH in its standard setup and can be engineered higher, but somebody should still look at your location and where on the roof the rail runs.
Look at what's touching the membrane, too. KeeGuard's counterweights run about 30 pounds each, they're made from 100% recycled PVC, and they sit on rubber pads. Spread across the layout, the whole system puts less weight per square foot on the roof than one person walking across it.
And get the paperwork. Data center owners want layout drawings and compliance documentation for commissioning and audits, so make sure that comes with the order instead of just a pallet of parts.
For what it's worth, Kee Safety, the manufacturer behind KeeGuard, lists Microsoft, Amazon, and Google among the data center operators it's an approved vendor for.
Installing it without disrupting operations
Facilities teams usually perk up at this part. KeeGuard needs no welding, no drilling, and no special tools. That means no hot work permits on a roof full of critical equipment, no drill dust, and no roofer on standby to seal penetrations. A crew of two or three can put up as much as 600 linear feet in a day, so the roof isn't tied up for weeks.
It also handles the next round of changes. When the next chiller goes in, the rail gets moved or extended around it, and nobody's up there patching old holes.
If you're planning work on a data center roof, or you already know there's an unprotected edge next to the chillers, send us a few photos or the building address. We'll walk through what the roof needs and send you a layout.
Frequently asked questions
Sources
- OSHA 29 CFR 1910.28, Duty to Have Fall Protection (including b(13), Work on Low-Slope Roofs)
- OSHA 29 CFR 1910.29, Fall Protection Systems Criteria and Practices
- Uptime Institute, Annual Outage Analysis 2026 announcement
- KeeGuard Non-Penetrating Rooftop Guardrail, Simplified Safety
Related reading: Fall Protection Every Data Center Needs and What to Know About Guardrail for Rooftop Mechanical Units.
Protecting a data center roof?
Send us a few photos or your building address. We'll show you how to protect every edge, hatch, and crossing on the roof without putting a single hole in the membrane.
