🔒 Secure Data Destruction

The standard we destroy to

All data-bearing media we process is sanitised to NIST 800-88 Rev 2 Purge standard. That is the specification most UK regulators, insurers and internal audit functions recognise, and it is meaningfully stronger than a quick format or a single-pass overwrite.

We use PartedMagic on our standard service and Blancco on our Premium service. Blancco is the tool that produces the tamper-evident, independently verifiable certificate that regulated clients generally need.

When wiping is not possible

Not every drive can be sanitised in software. Drives fail, controllers die, and some older media simply cannot be addressed reliably. When a device cannot be verifiably wiped, it does not get quietly passed through — it is physically destroyed:

• Mechanical hard drives are degaussed, collapsing the magnetic domains that hold the data and rendering the platters permanently unreadable.
• Solid state drives are shredded. Degaussing does nothing to flash memory, and any supplier telling you otherwise does not understand the media.

Either way, the outcome is documented and appears in your destruction report with the device serial number against it.

On-site destruction

Some organisations cannot let data-bearing media leave the building under any circumstances — certain public sector contracts, some financial services arrangements, and occasionally an internal policy that simply does not permit it. On-site degaussing can be arranged so that drives are rendered unreadable before your equipment is loaded onto our vehicle. Mention it when you enquire, as it needs scheduling.

What you receive

Every collection produces chain-of-custody documentation tracking your equipment from your premises to our facility. Our Premium service adds, per device:

• A tamper-evident Blancco Certificate of Destruction bearing the device serial number
• A full serialised asset report covering everything collected
• ESG and environmental data for your sustainability reporting

Why the paperwork is the actual product

Under UK GDPR you remain the data controller for personal data on a device until it is verifiably destroyed. Handing equipment to a third party does not transfer that responsibility. If a breach is later traced to a disposed asset, the question the ICO asks is not whether you intended it to be destroyed — it is whether you can evidence that it was.

That is the whole reason for serialised certificates. A weighbridge ticket saying "1.2 tonnes of IT equipment" proves nothing about any individual drive.