Certificates of Destruction

The eleven required fields on a Maxicom certificate

(1) Serial number — the unique identifier for the drive. (2) Make / model / capacity — Dell PERC, HPE Smart Array, Samsung PM9A3, Seagate Exos 18TB, etc. (3) Data classification at retirement — typically referenced to your information-classification taxonomy (e.g. Public / Internal / Restricted / Top-Classified). (4) Sanitisation method — Clear / Purge / Destroy under NIST SP 800-88 Rev. 1, with the specific technique named (multi-pass overwrite, IEEE 2883 Sanitize, 6mm shred, etc.). (5) Particle size where shredded, field strength where degaussed, encryption algorithm where Crypto Erased. (6) Sanitisation tool name, version, and command/verification response. (7) UTC timestamp (ISO 8601 format) and facility location. (8) Operator name and ID, signed digitally and ink-on-paper. (9) Witness name and signature where applicable. (10) Chain-of-custody reference back to the original pickup manifest. (11) Destruction reason — where Reuse-First triage was overridden, the specific reason is documented (e.g. "drive failed Purge verification at pass 2"; "data classification top-secret per data-owner direction"; "drive non-functional, controller failed").

Why bulk-job certificates fail audit

A bulk-job certificate that names only "all drives in batch B-2026-04-15 destroyed to NIST 800-88" leaves the auditor unable to confirm that any specific drive containing any specific dataset was sanitised. The auditor reads this as "the vendor cannot prove this specific drive was sanitised". This is the single most common regulator finding we see against legacy ITAD documentation. Maxicom does not issue bulk-job certificates. Where a client contract requests bulk paperwork for cost reasons, we route to per-asset paperwork and absorb the per-line cost.

Certificate retention — how long is enough

Maxicom default: 7 years from issuance, retrievable on request. BFSI engagements: 8 years (RBI in India, CBUAE in UAE) or longer where the master service agreement specifies. Healthcare: 6 years minimum for HIPAA-equivalent data. Government: per the contracting agency's retention schedule, typically 7-10 years. Certificates are stored in our compliance vault under controlled access; access logs are themselves retained for the same period.

How certificates are delivered

Standard delivery: encrypted PDF via the channel agreed at SOW (typically encrypted email or a dedicated client portal). Ink-on-paper original delivered via courier where the engagement specifies. Per-engagement consolidated PDF includes all per-asset entries plus the engagement-level summary, the chain-of-custody chronology, and the operator and witness signatures. Sample certificates are available on NDA before engagement signing — request via service-request page.

Audit defensibility — what the auditor actually checks

Auditors typically check certificates against four criteria: (1) per-asset granularity — does the certificate name specific assets, not bulk jobs? (2) standard citation — is the sanitisation method named with reference to the applicable standard (NIST 800-88, IEEE 2883, DoD 5220)? (3) verification — is there evidence the sanitisation actually completed (not just that it was attempted)? (4) chain-of-custody continuity — does the certificate trace back to the pickup manifest without unsigned gaps? Maxicom certificates pass all four criteria; this is by design, not by accident.