recore
Sign inStart Free Trial
Compliance & Audit

Built for the audit you haven't scheduled yet.

Compliance in ITAD is not a feature -- it is the foundation. Every action in reCore produces a verifiable, timestamped record tied to an identified operator. When an auditor asks for documentation, you don't scramble to compile it. You export it.

NISTSP 800-88 Rev 2
SHA-256certificate hash
100%traceability
Immutableaudit log

NIST SP 800-88 Rev 2 compliant certificates

Every verified data wipe in reCore produces a PDF certificate of destruction that meets the documentation requirements of NIST SP 800-88 Rev 2. This is the standard referenced by R2, e-Stewards, and most enterprise data destruction policies.

Each certificate includes: device make, model, and serial number; drive serial number and specifications; sanitization method and compliance standard; start and completion timestamps in UTC; operator identification; verification method and result; SHA-256 file integrity hash; and authorizing organization details.

The certificate file itself is hashed (SHA-256), so any modification to the PDF after generation is detectable. This is tamper-proof documentation in the literal sense.

reCore
Media Sanitization
Certificate
NIST SP 800-88 Rev 2 Compliant Documentation
Certificate ID
fe05ab03-1605-40fe-9b21-...
Asset Tag
RC-2026-9942
Issue Date
2026-02-21
Device & Media Details
Manufacturer
LENOVO
Model
ThinkPad X1 Carbon Gen 9
Device Serial
L3-SN9942X01
Drive Serial
S4GNNF1N225484
Drive Model
SAMSUNG MZVLB256HBHQ
Capacity
238.47 GB
Interface
NVMe PCIe Gen 3
Firmware
HPS1
SMART Status
Healthy
Personnel & Authorization
Operator - Performed Wipe
T
T. Henderson
@tech1
Sanitization Operator
2026-02-21 11:32:32 UTC
Verifier - Approved Certificate
A
A. Miller
@admin
Compliance Officer
2026-02-21 16:46:01 UTC
Operator and verifier are distinct individuals - separation of duties enforced per NIST SP 800-88 Rev 2 sec.4.6
Sanitization Process
Purge
Method
Crypto Purge (NVMe) - Cryptographic Erase
Standard
NIST SP 800-88 Rev 2
NIST Ref
sec.3.2 Purge - Table A-8
Technique
Built-in NVMe Cryptographic Erase
Passes
1
Tool
ReCore DataWipe v1.2.8
Execution & Compliance
Started
2026-02-21 11:32:32 UTC
Completed
2026-02-21 11:32:36 UTC
Duration
4 seconds
Asset Owner
Recore Logistics
Reason
End of Lease / Asset Disposal
Disposition
Recycle / Resale
Verification Status
PASSED
Verified by A. Miller (@admin) · 2026-02-21 16:46:01 UTC
Post-Sanitization Verification (Full)
Sample Rate: 100%
Sample Size: Full Media Scan
Chain of Custody
2026-02-20 09:00 UTC
Asset Released by Owner
J. Smith · Asset Owner
2026-02-20 14:30 UTC
Asset Received at Lab
T. Henderson · Operator
2026-02-21 11:32 UTC
Data Sanitization Initiated
T. Henderson · Operator
2026-02-21 16:46 UTC
Verification & Certification
A. Miller · Verifier
Cryptographic Signatures
Operator · T. Henderson
dbca0c1bf73962accee86dbd8435a5cb
Verifier · A. Miller
cb25ad6ebd046c5611bddf836f5e84d2
Certificate Hash (SHA-256)
a3f9d2e14b87c621...
Signed at 2026-02-21 16:46:01 UTC
Sanitization Location
Data Sanitization Lab, Bay 4 - Toronto, ON
reCore Data Protection Systems
Compliant with NIST SPECIAL PUBLICATION 800-88 REVISION 2

Separation of duties

NIST SP 800-88 recommends that the person who performs data sanitization should not be the same person who verifies and approves the result. reCore enforces this at the system level, not as a policy recommendation.

When a technician completes a data wipe, an administrator or authorized verifier must review the results and approve certificate generation. The system checks the identity of both parties and blocks the action if they are the same person. No workarounds, no overrides.

This creates a clean, three-role chain: the operator who performs the wipe (identified by PIN), the verifier who reviews and approves (cannot be the operator), and the administrator who manages users, generates reports, and maintains organizational settings.

The audit trail

Every action in reCore is recorded with a UTC timestamp, the identity of the user who performed it, and the context in which it occurred. This includes:

Device connection and hardware spec collection
Diagnostic test initiation, progress, and results
Wipe method selection, execution, and verification
Verification approval or rejection with verifier identity
Grade assignment with component-level detail
Grade overrides with original calculated value preserved
Certificate generation and download events
User login, logout, and session events
Batch creation, assignment, and completion
Administrative actions (user creation, settings changes)

None of these records can be modified or deleted after creation. The audit trail is append-only by design. When an auditor asks "who wiped this device, when, and how was it verified?" the answer is a database query, not a filing cabinet search.

Reporting for audits and clients

reCore generates several types of reports designed for external consumption:

Batch reports -- Multi-sheet Excel workbooks containing a summary page, full device inventory, test results across all devices, grade distributions, and wipe records with certificate references. This is the document you hand to an R2 auditor or attach to a client invoice.

Device reports -- Per-device reports showing the complete processing history from intake to certificate. Useful for individual device lookup, customer inquiries, or post-sale support.

Certificate archives -- Bulk export of PDF certificates filtered by batch, client, date range, or wipe method. Downloaded as a ZIP file ready for auditor submission.

All reports are generated on-demand from live data. There is no stale report cache -- the export you download at 3pm reflects the state of the system at 3pm.

Standards alignment

reCore's compliance features are designed around the requirements of the most commonly encountered ITAD audit frameworks:

NIST SP 800-88 Rev 2 -- The primary reference for data sanitization methods, verification procedures, and documentation requirements. reCore implements all three sanitization categories (Clear, Purge, Destroy) and generates certificates that meet the publication's documentation guidance.

R2 (Responsible Recycling) -- Requires documented data destruction procedures, trained operators, and verifiable records. reCore's per-device audit trail, separation of duties, and certificate system address these requirements directly.

e-Stewards -- Requires trackable chain of custody and documented proof of data destruction. reCore's per-drive serial tracking and timestamp chain provide the traceability this certification demands.