Data destruction services: what the engagement includes, and where offers differ

A data destruction service is three things bundled together: custody of your devices from your floor to the process, a method appropriate to each media type, and a record per serial number at the end. Offers differ enormously in how seriously they take the first and third parts, which are invisible in a quote and decisive in an audit.

Custody is half the service

The destruction itself takes seconds per device. The service is everything around it: a manifest listing every serial number at collection, numbered seals on the containers, a documented handover at each transfer, and a reconciliation on arrival. If the count on arrival does not match the manifest, that is an incident with a procedure, and a vendor should be able to describe the procedure before you ask.

This is also the part of the service you can inspect in advance. The method happens behind a panel; the custody discipline is visible in the paperwork the vendor already uses, and a vendor who improvises it for your job has been improvising it for everyone.

On your site or at a facility

The work happens in one of three configurations: on your site in front of you, at a facility with your representative witnessing, or at a facility under seal, unattended. Assurance decreases down that list and so does cost and disruption. Which configuration a given classification of data requires is your policy decision, and the case for the first option is made in the on-site article.

What happens at the bench

Each device is scanned, its media type identified, and the matching method applied: verified erasure where policy allows it and the device is writable, degaussing for magnetic media, shredding for flash, for failed devices, and for anything policy wants visibly gone. The sorting step is the substance. A service that applies one method to everything is choosing convenience over correctness somewhere in the pile.

The record that comes back

One line per serial number: media type, method, date, operator, outcome, plus the exceptions, listed rather than smoothed over. Ask for a blank example of this report before discussing price, read against what a destruction certificate can prove. It is the fastest way to tell a per-device operation from a per-pallet one, and the difference is the entire value of the engagement, as argued in the data destruction article.

What the scope should state in writing

• Which media types are covered, and what happens to the ones discovered mid-job.
• Whether devices are processed at the certified facility named in the sales conversation.
• Who transports, and under what seal and manifest discipline.
• What the report contains, per device, and when it is delivered.
• What happens to the destroyed material downstream, with the trail documented.

The variants that look alike and are not

A shredding truck that weighs what it consumes, a recycler that wipes drives as a courtesy, and a destruction service that records per serial number all describe themselves with the same words. The difference is visible only in the paperwork, which is why the blank report is the comparison instrument, not the brochure.

None of the three is dishonest. Each is the right purchase for somebody. The failure is buying the first while needing the third, and not finding out until an auditor asks for a serial number the weighbridge ticket does not contain.

Inside a larger project

In a full site exit, the destruction service is one stage of a sequence, fed by the inventory and the data classification that preceded it and feeding the certificate pack that follows. Buying it standalone is simpler: a collection, a bench, a report. Both versions, and what we perform in each, are on the destruction page.