Small, local, and documented

Why this exists

Most organisations have a stack of it somewhere, behind reception or under a desk or on a pallet in the comms room, and every machine in it still holds data. Nobody is quite sure whose responsibility that is, so it sits there, accruing risk and losing value at the same time.

The national disposal firms will handle it, eventually, once you are in the routing schedule, and the local recycler will take it away but cannot tell you what happened to the drives. Neither leaves you with the thing an auditor asks for: a document, per drive, that says what was destroyed and how.

That gap is the whole business, and we are close enough to come out this week and disciplined enough to hand you the paperwork afterwards.

How we work

• Every item is logged by serial number as it is loaded, the completed manifest is signed by both parties before the van leaves, and your copy stays with you.
• Drives are sanitised before anything else is done to the machine, and we do not open, index or inventory the contents of anyone's files.
• A Certificate of Data Erasure is issued per drive, referenced to the drive serial and to the parent asset on your manifest.
• Anything with resale value is refurbished and resold, and that value comes back to you. Anything without is recycled under the WEEE Regulations 2013.

What we can and can't claim

This section exists because a lot of this industry is vague about it, and vagueness is expensive when you're the one being audited.

What we hold:

• ICO registered: Registered with the Information Commissioner's Office as a data controller. Reference ZC215161.

What we work to:

• NIST SP 800-88 Rev. 2: Media sanitisation performed to the Purge method defined in NIST Special Publication 800-88, using the drive's own firmware sanitize command.

This is the standard we work to. It is not a certification we hold. If a supplier tells you they are "NIST certified", ask them who issued it. Nobody does.

The other half

We also build Obex, a consumer privacy scanner that finds where personal data is exposed online and removes it. Same discipline, different surface: one destroys data on hardware, the other removes it from the internet.