Custom data destruction software for ITAD firms
THE SHORT ANSWER
Data destruction software for an ITAD firm has to tie each certificate to the exact drive, its asset record, and the policy the wipe was held to. New Era Systems built that for TechR2. Tear-A-Wipe is a policy-driven wiping suite, NIST 800-88 compliant, in production, with no manual export step.
The certificate is the product
An ITAD client hands over end-of-life hardware and gets proof back: the data is gone, the process met a defined standard, and every step from intake to disposition can be traced. If that proof depends on an export from someone else’s tool, the most important step in your chain of custody has a seam in it.
That was TechR2’s position. The company has been in asset recycling and data destruction for over 25 years and carries NAID AAA and R2/RIOS credentials. Its wiping software did the job, but it wasn’t built around TechR2’s workflows, inventory system, asset tagging, or reporting.
What the software has to do
- Enforce a policy. The policy says what each media type must get, and the software applies it. If a client needs to go beyond NIST, the policy says so. If a client’s risk profile allows a lower standard on some device types, the policy documents that too.
- Track the drive and the device. Both get linked to the asset record, so a certificate points at physical hardware.
- Work in a processing bay. Tear-A-Wipe boots devices from a closed network, with a USB fallback for machines that can’t network boot.
- Show problems right away. Operators see every device in the queue, and missing wipes are visible immediately.
- Join the wipe to the destruction record. TechR2 pairs the Tear-A-Wipe certificate with its Tear-A-Byte physical destruction certificate, so an auditor can verify each link.
Signs you’ve outgrown your wiping tool
- Someone exports wipe data by hand to get it into your own systems.
- Your certificate says a drive was wiped but not which policy it was held to.
- You can trace a device but not the drives inside it.
- A vendor outside your company controls the link your clients are paying you to prove.
Who this fits
TechR2 serves healthcare systems, financial institutions, government agencies, and data centers. In those accounts, a gap in the record has real consequences. If your clients ask for that level of proof, owning the tool is worth pricing out. The build vs rent guide shows how, and the Tear-A-Wipe case study has the full story.
COMMON QUESTIONS
What should a data destruction certificate include?
Tear-A-Wipe's certificate records the manufacturer serial number, board and motherboard identifiers, controller type, the operator, the timestamp, the result, and the policy the wipe was held to.
Why does the policy belong on the certificate?
NIST 800-88 has no single answer. Different media, sensitivity levels, and regulatory environments call for different methods, so the standard a wipe was held to should be part of the record, not assumed from context.
How do you sanitize different drive types?
Tear-A-Wipe detects the media and applies the method its policy calls for: cryptographic purge for NVMe, purge or secure erase for SSD, and raw overwrites for magnetic media.
What about devices that can't network boot?
Tear-A-Wipe can stand itself up as a PXE boot server from a USB drive. Devices that can't PXE boot get a secondary USB that carries the wipe environment to the machine and carries the attestation data back to the central server.
Can wipe records link to our inventory system?
Tear-A-Wipe connects the wipe record to TechR2's asset record at the PID level, including the specific drives inside a device. A laptop has a PID, and the NVMe drive inside it has its own serial number, EUI, and controller data.
KEEP READING
Definitions What is anti-discovery?
Anti-discovery is how New Era Systems replaces the paid discovery phase. It is a free targeting exercise that takes days, not weeks, and looks for enough signal to build something real. If we can't find that signal, we tell you and both sides walk away with no invoice.
Read the guide →
Deciding Should your firm build its own compliance software or keep renting it?
Build when the vendor charges you again for every client and the tool sits inside the product you sell. Keep renting when the bill is small and stays small, or when the software has nothing to do with what clients pay you for. To check, add up what you pay per year, then compare it with the cost of owning.
Read the guide →
Deciding Is AI-built software safe for compliance or audited work?
It can be, if people own the requirements and the review, and the output gets verified against written rules. Compliance work suits AI-assisted development because the rules are explicit and the results can be checked. It is unsafe when nobody can say what the software is supposed to do, or nobody checked that it does.
Read the guide →BRING US THE PROBLEM.
A targeting exercise that costs you nothing, a working prototype before you sign anything, and a date that holds.