Small, local, and documented

Why this exists

Most organisations have a stack of it somewhere: behind reception, under a desk, on a pallet in the comms room. The kit still holds data. Nobody is quite sure whose responsibility it is, so it sits there, accruing risk and losing value at the same time.

The national disposal firms will handle it, eventually, once you are in the routing schedule. The local recycler will take it away but cannot tell you what happened to the drives. Neither leaves you with the thing an auditor asks for: a document, per drive, that says what was destroyed and how.

That gap is the whole business. We are close enough to come out this week, and disciplined enough to hand you the paperwork afterwards.

Who you'll deal with

Oliver Croxall, the director. There is no account manager, no ticket queue and no call centre. The person who answers your email is the person who turns up with the van and signs the manifest. That is a hard limit on how much we can take on at once, and it is also the point.

How we work

• Every item is logged by serial number as it is loaded, and the completed manifest is signed by both parties before the van leaves. Your copy stays with you.
• Drives are sanitised before anything else is done to the machine. We do not open, index or inventory the contents of anyone's files.
• A Certificate of Data Erasure is issued per drive, referenced to the drive serial and to the parent asset on your manifest.
• Anything with resale value is refurbished and resold, and that value comes back to you. Anything without is recycled under the WEEE Regulations 2013.

What we can and can't claim

This section exists because a lot of this industry is vague about it, and vagueness is expensive when you're the one being audited.

What we hold:

• ICO registered: Registered with the Information Commissioner's Office as a data controller. Reference ZC215161.

What we work to:

• NIST SP 800-88 Rev. 1: Media sanitisation performed to the Clear and Purge methods defined in NIST Special Publication 800-88.
• HMG Infosec Standard 5: Overwrite patterns meeting the HMG IS5 Enhanced baseline where a client requires it.

These are the standards we work to, not certifications we hold. If a supplier tells you they are "NIST certified", ask them who issued it. Nobody does.

The other half

We also build Obex, a consumer privacy scanner that finds where personal data is exposed online and removes it. Same discipline, different surface: one destroys data on hardware, the other removes it from the internet.