What we are certified for, and exactly what that covers.
Certification claims in this market are routinely stretched past their scope. Ours are stated at their scope, with the certified products named.
Certified to ADISA assurance level 4.
Pro-Diagnostics and MacRestore are certified to ADISA assurance level 4, independently tested by the ADISA Research Centre under its Product Claims Test.
What this covers
Certification applies to the products named above. Pro-Diagnostic PC is not certified, so we make no certified-erasure claim for computers. Talk to us if you need the certification detail for your audit file.
NIST 800-88 Rev. 2
Clear and Purge are not interchangeable. Each drive gets the stronger method it is actually capable of, and the method used is named on the erase report alongside that drive's serial number.
IEEE 2883
Sanitisation terminology and verification expectations are aligned to the current standard, so an auditor reading our report is reading vocabulary they already know.
The controller saying “done” is not trusted.
A drive that reports successful sanitisation has made a claim about itself. We check it. An unverified drive is recorded as a failed erase — never as a pass.
| Method | Applies to | How it works | NIST level |
|---|---|---|---|
| NVMe secure erase + verify | NVMe SSD | The drive's own sanitize command — block erase or cryptographic erase — issued to the controller, then verified by read-back. | Purge |
| ATA sanitize + verify | SATA SSD · SAS | The drive's native sanitize, cryptographic scramble or block erase. SAS devices use SAS sanitize. | Purge |
| PRNG overwrite, 1 pass + verify | HDD · eMMC · fallback | A single pseudorandom overwrite of the full addressable space, used where sanitize is unsupported or where the drive's own sanitize failed. | Clear |
How the read-back works
After erasure, the engine reads the drive back at sampled points spread across the whole disk — 1% of the drive by default, up to 4,096 points of 4 MiB each. Any point that still holds recoverable data fails the drive.
And its limits
Verification is sampled, not exhaustive. An under-wipe in the gaps between sample points is caught with probability, not certainty. We state this plainly because a vendor who claims perfect verification of a multi-terabyte drive in minutes is telling you something that is not true.
Anyone can check a device, without an account.
A record nobody outside your building can read is an assertion. Every device you process can be looked up by IMEI or serial on a public page — by your buyer, your client's auditor, or the person who ends up owning the phone.
You decide what is public
Publication is set per customer account in Control Center, and the certificate page and the PDF are separate switches.
- Publish results to public search
- Anyone can look up a device you processed by IMEI or serial and see its data-wipe and diagnostic results.
- Allow public certificate links
- Anyone holding a certificate link can open the certificate page without signing in. Also controls the Public Certificate button in Device History and the certificate links in exported reports.
- Allow public PDF download
- Anyone holding a certificate link can download the certificate as a PDF without signing in — a separate switch from the page above.
Evidence by the batch, not by the device
Nobody clearing a pallet wants to open one certificate at a time.
- Export a scanned batch to CSV straight from the lookup screen
- Bulk device lookup from a CSV of up to 30,000 identifiers
- Certificate PDFs generated and sent in batch, not one device at a time
- Certificate links travel inside exported reports, so a buyer can open the evidence from the file you send them
When the platform refuses to erase.
A sanitisation record is only worth what the conditions around it were worth. These gates exist so a record cannot be produced in circumstances that would make it meaningless.
- No real serial number
- If the system, board and chassis serials are all blank or placeholders — “To Be Filled By O.E.M.”, “Default string”, all zeros — the erase is refused. An erase that cannot be tied to a machine is not evidence of anything.
- Low battery
- Below 25% on battery, the erase will not start until a charger is connected. A long overwrite that dies halfway leaves a device nobody can account for.
- Frozen target list
- The list of drives is fixed before erasure begins. A drive connected afterwards cannot become a target, and the boot media itself is never listed.
- Serial re-check
- Immediately before writing to each drive, that drive's serial is checked again against the one collected at intake.
- Interruption
- If a run is interrupted, nothing further is erased until an operator decides. The device is either erased again or recorded as an interrupted failure — never quietly passed.
- Failed verification
- A drive that cannot be verified is recorded as UNVERIFIED, and an unverified drive counts as a failed erase. There is no state in which a drive passes because the controller said it should.