The standard#
Storage media are erased to NIST SP 800-88 Rev. 1, Purge, and the erasure is verified after it runs. Where the erasure completed and verified, a certificate is issued against the machine’s serial and recorded with the inspection report.
- Standard
- NIST SP 800-88 Rev. 1 — Purge
- Passes
- 1 pass
- Verification
- Recorded as a result on the certificate, not assumed from completion
- Integrity
- Each certificate carries a SHA-256 digest, so a certificate that was altered after issue can be told from one that was not
Purge, not Clear: the method is chosen to defeat a laboratory recovery attempt rather than only a software one. The media stay in the machine — we do not destroy or remove drives, so there is no certificate of destruction and this is not that document.
Not every machine has a certificate#
Some machines in the catalogue have no wipe certificate. Where one is absent, the machine’s inspection record says so in plain words and shows no tick. Do not read a blank as a pass.
If a certificate matters for a particular purchase — and for most corporate buyers it does — check the record for the serial before you order, or ask us. We would rather tell you a machine has not been certified than issue you a certificate for a run that did not happen.
What we do not certify#
- What was on the machine before it reached the supply point. Suppliers give us an undertaking that every machine is wiped to a recognised standard before it leaves them and that they can produce their own erasure report for any serial we ask about. That is their undertaking; the certificate we issue covers the erasure we performed and verified.
- Anything about a machine after it leaves us. Once you have it, what is written to it is yours.
- Data on media we did not touch — an external drive, a memory card left in a reader. The certificate names the machine’s serial and covers its internal storage.
Every certificate is tied to one serial. It is not a statement about a batch, a model or a supplier, and it cannot be read as one.