Physically they are located in the protected area of the data center, and remote access to management is limited to the firewall and is possible only with known IP-addresses by SSH-key.