On-site destruction of drives and media: when it is required

On-site destruction means the devices are destroyed at your premises, before they leave your custody, in front of whoever you appoint to watch. It is the highest-assurance configuration this industry offers, it is the most expensive per device, and the people searching for it are usually not choosing it. Their policy already chose. What remains is doing it competently.

What on site actually buys

The elimination of transport risk, entirely. The devices never travel with data on them, so there is no seal to trust, no handover to reconcile, no interval during which the answer to “where are the drives” is a tracking number. For data whose exposure would be unrecoverable, that interval is precisely what a policy exists to remove.

The policies that require it

Regulated categories where the organisation has decided data may not leave the premises on readable media, contractual commitments made to customers, and classifications where the organisation must be able to state, from its own direct observation rather than from a supplier report, that destruction occurred. If none of those applies, transport under seal to a facility is usually the defensible and cheaper answer, as set out in the services article.

On site destruction of drives is not on-site shredding of paper

Most of what is sold as on site destruction is a paper shredding truck parked outside an office. Storage media is a different job. A hard drive needs a machine built to break platters and casings, a solid state drive needs a cut fine enough to reach the memory chips, which are small and can pass through a shredder set for spinning disks, and a tape needs degaussing or a process designed for it. A certificate stating a weight of material shredded is acceptable for paper and tells you nothing about which drive went into the machine.

Which media can be destroyed on site

Hard drives, solid state drives, tapes, flash cards and the storage inside network and management devices can all be handled at your premises, but not always by the same equipment. The manifest should state the media type of each device so the vendor brings the right machines, and so that a degausser is never the only tool on the cart when the estate contains flash, which a magnetic field does not erase.

What the equipment needs from your building

A destruction cart is heavy, loud and hungry. It needs floor space near the devices, power that a normal office circuit may not supply, an agreed route in through docks and lifts, and somewhere for noise and dust that does not stop the rest of the floor working. In an active data hall, it also needs a position agreed with whoever runs the room. None of this is difficult. All of it fails when discovered on the morning.

The site visit that settles these four questions is short, and it is the difference between a crew that starts working and a crew that starts negotiating with your building manager while the clock runs.

Witnessing is a role, not a formality

The witness confirms that every device on the manifest went into the machine, and signs for it. That means a person with time, a list, and the standing to stop the process when a serial number does not match. A witness who glances in twice between meetings converts the highest-assurance configuration back into trust, at on-site prices.

Decide before the day who witnesses, what they check, and what authority they carry. It is the cheapest line in the whole plan and the one that gives the certificate its weight.

The record is produced at the machine

Each device is scanned as it is destroyed, and the report says so: serial number, media type, method, timestamp, operator, witness. The report from an on-site job should be indistinguishable in structure from a facility report. What changes is who can vouch for it, which is now you. If a vendor proposes to tidy the records up afterwards, back at the office, the assurance you are paying a premium for is quietly leaving with them.

The fragments still leave the building

Destruction produces material, and the material needs a documented downstream destination like any other recycling stream. The data risk is gone; the environmental accountability is not. A vendor who can describe the fragment trail as clearly as the shredding has thought about the whole job, which is one of the questions to put to any vendor before price.

Mixed estates, mixed answer

Most real projects split the estate: on-site destruction for the classifications that demand it, verified erasure or sealed transport for the rest, preserving resale value where policy allows. That split is a data classification exercise, described in destruction or erasure, and the on-site option itself is detailed on the destruction page.