Physically destroying a drive is the easy part. Proving you did it, to a regulator or an auditor who was not in the room, is where most organisations discover their process has a hole in it. Good ssd destruction services are judged less by the shredder and more by the documentation that comes out the other end, because a destroyed drive with no record is functionally indistinguishable from a drive that walked out the door.
What Auditors Are Actually Testing
An auditor reviewing end-of-life hardware is not really assessing your shredder specification. They are testing whether you can account for specific assets.
The question is rarely “do you destroy drives?” It is closer to “here is a serial number from your asset register that you marked as disposed eighteen months ago — show me what happened to it.” Answering that requires a record tied to individual units, not a general statement of policy.
This is why chain of custody carries so much weight. Every gap between the moment a drive leaves a desk and the moment it is destroyed is a window an auditor has to take on trust, and taking things on trust is precisely what they are paid not to do.
The Documents Worth Requesting
The Electronic Recycling Association issues several distinct records depending on the service performed, and knowing which to request keeps your file complete.
- Collection Certificate — confirms that equipment was collected and entered the process.
- Collection Inventory Spreadsheet — lists make, model and serial number for the items received. This is the document that lets you reconcile against your own asset register.
- Data Wipe Certificate — evidence for equipment sanitised by software rather than destroyed.
- Certificate of Destruction — records the individual serial numbers of units physically destroyed.
- Donation in Kind Certificate — relevant where equipment is donated onward, and often useful for finance as well as compliance.
The inventory spreadsheet is the one organisations most often forget to ask for and most often need later. Without it, the certificate proves that destruction happened but not that it happened to your specific missing asset.
Witnessing and Verification
Documentation is stronger when someone independent saw the event.
Representatives of the company that owns the equipment are welcome to observe destruction in person at any ERA facility. Where sending someone is impractical, live or recorded video of the destruction can be provided on request. Compliance and legal teams get their verification without booking flights.
On-site mobile shredding takes this further. Because the shredder arrives at your building, your own compliance officer can watch drives destroyed before any data-bearing item leaves your premises intact. Transit risk disappears rather than being managed.
See also: How tech keeps airports, borders, and events safe and secure
Building the Internal Half of the Trail
A provider can only document what it receives. The weakest link in most programmes sits upstream, inside the organisation.
Log serial numbers at the point of decommissioning, not at the loading dock. A drive pulled from a machine on Tuesday and boxed on Friday has three undocumented days.
Store drives awaiting collection somewhere with controlled access. A cardboard box under a desk labelled “for shredding” is an invitation, and it is exactly the detail an auditor will notice.
Reconcile the returned inventory against your own list rather than filing it unread. Discrepancies are recoverable when found in the same month and awkward when found two years later.
Keep the certificates for as long as your retention schedule requires for the underlying data, not for as long as feels reasonable.
The Liability Being Managed
The reason this documentation exists is that failure is expensive. Regulatory penalties, litigation and reputational damage all follow from confidential client records, employee files or proprietary work leaving an organisation on hardware nobody tracked.
Privacy legislation in most jurisdictions now expects documented chain-of-custody handling for retiring data hardware. Working with an audited provider is not belt-and-braces caution; it is how a defensible position gets built before anyone asks for one.
What to Insist On
Choose ssd destruction services on the strength of the evidence they produce, not the machinery they own. Insist on serial-level records, request the collection inventory alongside the certificate, use witnessing or video where the data warranted the concern, and close the gap between the desk and the truck with your own internal logging. The shredding takes seconds; the paperwork is what still exists when someone asks the question years later. Talk to a certified provider about which certificates your industry will expect.
