Trust
Audit-proof erasure: certified to ISO/IEC 15408 and ADISA
This page is written for your audit, your DPO and your procurement team. You'll find which standards our data erasure is certified to, who tested it, what evidence is produced, and which documents you get for your supplier assessment.
Certificates
What our erasure is built on
The erasure engine of the software we use (Securaze) is certified under Common Criteria (ISO/IEC 15408) at evaluation level EAL2+ — the internationally recognised framework for IT security product testing.
Certified erasure engineADISA tests erasure products with forensic attack methods, not paperwork, against the claim that data becomes unrecoverable.
Certification body: ADISAOur procedures follow the Clear, Purge and Destroy categories of the US media sanitization guideline.
Applied erasure methodThe ATTINGO data recovery lab independently confirmed that the treated storage areas are unrecoverable.
Independent validationWe operate under a data processing agreement per Art. 28 GDPR with documented instructions, named sub-processors and described technical and organisational measures.
Contractual basis of every projectFor recycling and disposal we work exclusively with licensed facilities. Their permits and evidence are available on request.
Recovery via licensed partnersAudit-proof
What "audit-proof" means in practice for us
- Certified procedure: erasure runs on an engine certified to ISO/IEC 15408 (Common Criteria EAL2+) and checked by ADISA.
- Verification over trust: every erasure is checked; only the verification result generates the certificate.
- Evidence per serial number: device, medium, method, timestamp, result, operator — no batch certificates.
- One system chain: logging, erasure, diagnostics and recovery run through one software chain, not spreadsheets.
- Spot-check ready: pull any serial number, we produce the matching record.
Documents for your supplier assessment
- Data processing agreement including sub-processor list
- Description of technical and organisational measures
- Erasure concept mapped by storage type
- Sample certificate and sample documentation package
NIS2 & supply chain
Your provider needs to be verifiable
Organisations under NIS2 must assess and document supplier security. For IT retirement that means verifiable statements about processes, access, erasure methods and reporting lines — not just a quote.
Audit and supplier review
- Document review: DPA, TOMs, erasure concept, samples upfront
- Facility visit: receiving area, processing area, storage, erasure stations
- Witnessed erasure: see your own devices in the process
- Evidence spot-check: pull serial numbers, we show the matching record