Standards and Documentation

What we can currently evidence

We hold no certifications. Not R2, not e-Stewards, not NAID. There is no certificate number to give you and no directory entry to look us up in, and if you are comparing providers you should weigh that. Our facility operates to the requirements of the R2v3 standard and our certification audit is pending. That is a statement about our process, not about our status, and the two are not the same thing.

What we can evidence is the record set. The custody chain: a collection manifest listing what was picked up, counted against the list you supplied, discrepancies noted at the moment they were found, seal numbers recorded, signed at the point of collection, then the intake reconciliation showing what we physically received against what left. The sanitization record: a certificate per media item carrying the fields Section 4.6 of NIST SP 800-88 asks for, including method, technique, tool and version, verification method and the named individuals who verified and validated it. Then the closeout file reconciling your original retirement list against final disposition, exceptions included.

Those are real documents about real work, produced by the facility that did it. What they are not is a certificate from a third party, and you should not let us blur the difference.

Which makes the rest of this page the useful part. Certification is checkable in about two minutes, on us or on anyone else, and most buyers never check. Below is how.

How to verify a certification claim on any provider

This section is useful whether or not you work with us, which is why it's here.

R2 is an electronics recycling standard, owned by SERI. R2v3 is the current and only active version. It has ten Core Requirements that apply to every certified facility, plus seven process appendices that apply only if the facility performs that process. Appendix B, data sanitization, is split in the directory into logical erasure and physical destruction, and a facility might hold one, the other or both.

"R2 certified" does tell you something about data. Core Requirement 7 applies to every R2v3 certified facility regardless of which appendices it holds. It requires a documented Data Sanitization Plan naming the device types handled, the data to be sanitized and the method for each, plus physical and administrative controls to secure data devices. SERI puts it plainly: data security requirements apply to all R2 facilities regardless of their scope of operations.

What the mark alone doesn't tell you is which of the three sanitization pathways your assets will take. There are three of them.

Physical destruction under Core 7(c)(2)(B), to a NIST method with verification. No appendix needed for that.

Logical sanitization, meaning wiping a drive so the device can be reused. Any facility doing that must be certified to Appendix B.

Or the work goes to a qualified downstream vendor under Appendix A, which is a legitimate answer and one you should ask about rather than assume.

Appendix B also raises the bar on physical destruction: it specifies permitted methods, requires the facility to honor customer requests for additional conditions, and mandates video recording. A facility certified to Appendix B must apply it to every data-bearing device in its control, not selectively.

So the question isn't whether a vendor is R2 certified. It's which pathway your assets take. If you need drives wiped and hardware resold, you need Appendix B, held by the facility or by a downstream vendor qualified under Appendix A. Ask which appendices, ask whether sanitization happens on their site or downstream, and ask to see the certificate format before you sign.

SERI publishes a directory of certified facilities showing the certified processes, the scope statement, status, certification body, certificate number and dates. There are seven status values, not the two people assume: Active and Expired, but also Suspended, Revoked, Voluntarily Withdrawn, Facility Closed and Facility Moved. Facility Moved is the one worth pausing on, because a certificate attaches to a site. That spread is the reason to look rather than take a logo at face value.

e-Stewards is stricter on two specific axes: it requires NAID AAA certification as a prerequisite, and it applies the Basel export prohibition as though the country had ratified it. Both standards address prison labor, so that isn't a point of difference, whatever a comparison chart tells you.

NAID AAA certifies data destruction service providers. It's one certification, but it carries endorsements per service and per media type, and that's the part worth reading. Physical destruction of hard drives is a separate endorsement from solid-state devices, which is separate from overwriting, which is separate from degaussing. A certificate can be genuine and still not cover the service you're buying.

Check that a certificate covers the facility handling your equipment and the service you're buying. Both are common gaps and both are checkable in a couple of minutes.

Things that don't exist, whatever a website says

• EPA certified or EPA approved. The EPA doesn't certify electronics recyclers. Its own regional guidance says such claims "are not accurate," and adds that a permit isn't a certification and an EPA identification number isn't either.
• HIPAA certified. The regulation creates no certification. Private firms do sell HIPAA "certifications," and HHS says of them that it does not endorse or recognize them and that they don't absolve anyone of their own obligations. So the phrase can be literally true and still mean nothing to your auditor.
• ITAR certified. Registration with the licensing directorate "does not confer any export rights or privileges" (22 CFR 122.1(c)). Registration and certification are different things, and a vendor using them interchangeably is telling you which one they don't have.
• NSA approved applied to a company. The NSA evaluates destruction equipment and states plainly that inclusion on its lists isn't an endorsement.
• NIST 800-88 certified. NIST publishes guidance and certifies nobody.
• DoD 5220.22-M certified. DoD removed the overwriting specifications from the NISPOM in 2006, which NIST records in SP 800-88 Rev. 2. A standard whose specification was withdrawn twenty years ago is not something anyone is currently certified against.
• State certified based on a Colorado recycler registration. That's a reporting obligation, not a quality judgment.

Our certification position

We are not certified. Our facility operates to R2v3 requirements and the certification audit is pending.

You will not find an R2 mark, an e-Stewards mark or a NAID mark anywhere on this site. You will not find us described as an "R2 certified facility", "R2 compliant", or "R2 ready", and you will not find a scope statement or a certificate number, because those things exist only once a certification body has issued them.

Here is the distinction we hold ourselves to, and the one worth applying to every vendor you assess. Practice is what a facility does: the sanitization plan, the method decision per device, the verification and validation steps, the records. We will describe ours in as much detail as you want, and you can audit it. Status is what a third party has certified about that practice. We have the first and not yet the second, and no amount of confident wording converts one into the other.

Certification follows an operation, and an R2 audit examines processing history rather than intentions, which is the reason this sequence takes the time it does. When the certificate is issued, this page changes by naming a certificate number you can look up yourself in SERI's own directory. That is what we would tell you to demand of anyone else, so it is what we will give you.