Data Security & Destruction

The exposure is wider than laptops

Everyone remembers the laptops and the servers. The devices that actually cause incidents are the ones nobody has on the asset register. Networked copiers and multifunction printers cache every document they have scanned or printed on an internal disk. Routers and firewalls hold configuration files and credentials. Point-of-sale terminals, access control systems, lab instruments, CCTV recorders, IP phones and ATMs all retain records. When we survey a site we look for these, and we tell you if we find something you had not counted.

• Copiers and multifunction printers — internal disks holding scanned documents
• Routers, switches and firewalls — configuration and stored credentials
• CCTV recorders and access control systems — footage and entry logs
• Point-of-sale and lab equipment — transaction and test records

Deleting is not destroying

Formatting a drive or emptying a recycle bin removes the pointer to the data, not the data. Both are reversible with tools that anyone can download, and neither produces any evidence that the work was done. If your disposal process ends at 'the IT team wiped it', you have no defensible answer to an auditor asking what happened to a specific drive.

Chain of custody starts at your site

Data-bearing devices are logged by serial number at your premises, before anything is loaded, and not on arrival at a yard. The gap between those two moments is where chain of custody normally breaks and where an unaccounted device is easiest to lose. Material moves under manifest in our own vehicles with our own staff, and the count that arrives is reconciled against the count that was recorded on your floor.

• Devices logged by serial at your premises, in front of your staff
• Sealed transport under manifest in our own vehicles
• Arrival count reconciled against the collection log
• Discrepancies raised with you rather than absorbed quietly

How destruction is carried out

The method is agreed with you before collection and recorded per device. Physical destruction renders the platters or memory unusable and is the appropriate choice for any drive holding regulated or confidential data. Software erasure to a recognised overwriting standard is available where the device is intended for reuse and retains value. Where the material is sensitive enough that it must not leave your premises intact, destruction can be carried out on site with your staff present.

• Physical destruction of platters and solid-state memory
• Multi-pass software erasure where a device is to be reused
• On-site destruction with your team witnessing, on request
• Method recorded against each serial, not the consignment as a whole

The evidence you receive

A certificate of data destruction listing each device by serial number, the method used and the date. A recycling certificate for the consignment. A disposition report reconciled to your asset tags where that is in scope, so each line in your register closes against a documented outcome. Weighbridge and manifest records are included where the scope requires them. These are produced as a matter of course for bulk consignments, not on request.

The people who enter your building

Collections are carried out by our own uniformed staff, not a subcontracted crew hired for the day. For a bank, a school or a government office the people walking through the building are part of the risk, not separate from it. Staff details can be provided in advance for security clearance, and collections can be scheduled out of hours or supervised by your own security team.

What we do not claim

We would rather state the limits than have you discover them. We are not a certified forensic data recovery or destruction laboratory, and we do not hold ISO or R2 certification. Our destruction process is evidenced by per-serial certification and a documented chain of custody, which is what the E-Waste Management Rules and most internal audits require — but if your policy specifically mandates a certified destruction facility, say so at evaluation stage and we will tell you plainly whether we meet it rather than let you find out at audit.

Before we arrive — what you should do

Decommission devices from your network and revoke their credentials, since a device removed from a building is still a device that was trusted on your network yesterday. Back up anything you still need, because destruction is not reversible. Give us the asset list in advance if you want the disposition report reconciled against it. And tell us about anything unusual on the floor — a locked server cabinet, a machine under a maintenance contract, equipment that is leased rather than owned.

• Revoke network credentials and decommission before collection day
• Back up anything still needed — destruction cannot be undone
• Send the asset list in advance for a reconciled disposition report
• Flag leased equipment: it may not be yours to destroy

If something goes wrong

If a device cannot be reconciled against the collection log, we tell you — the same day, with the serial, and with what we know about where the count diverged. A disposal vendor who reports a discrepancy is worth considerably more to you than one who never seems to have any.