Compliance  ·  5 min read

What a certificate of data destruction must actually contain, and how to check one in ten seconds

If you have ever handed a stack of old laptops to a recycler and gotten back a single PDF a week later, you already know the problem with most certificates of data destruction. The PDF says something like "40 devices processed" and has a signature block at the bottom. It does not name a single device. It does not name a single drive. It proves that a piece of paper exists. It does not prove that any specific hard drive was actually erased.

That gap matters more than it looks. When an auditor, a client, or a regulator asks "prove this laptop's drive was wiped," a batch statement cannot answer the question. Neither can a spreadsheet the technician filled out by hand. Neither can a sticker on the box.

The batch statement problem

Most certificates in circulation today cover a shipment, not a device. One document, forty serial numbers folded into a total count, one signature from the company that did the wiping and also wrote the certificate. There is no way to check the document against the actual machine in front of you, and no way for anyone outside that company to confirm the wipe happened at all.

This is not a small paperwork gap. If the certificate cannot be tied to one specific device and verified by someone other than the company that issued it, it is not evidence. It is a promise.

The six fields a certificate has to carry

A certificate that actually proves something records these six things, per drive, every time:

1. Device serial number. The specific machine, not a batch or a client name.
2. Drive serial number. The physical disk inside that machine, because a device can hold more than one drive, and a serial number on the outside of a laptop tells you nothing about what is soldered or bolted inside it.
3. Sanitization method, stated against the NIST SP 800-88 term. Clear or Purge, not a marketing phrase like "military-grade" or "DoD wipe" with no standard behind it.
4. Start and end time. A wipe that claims to sanitize a modern NVMe drive in four seconds did not run a real pass.
5. Verification result. Whether the wipe was checked after it ran, and what that check found. A certificate that only states intent, not outcome, is not a certificate.
6. Who attests to it. A named issuer, tied to a signature, not just a company logo in the header.

If any one of those six is missing, you are looking at a statement of intent, not a record of what happened.

Why a signature matters

A PDF is just a file. Anyone with a PDF editor can open one, change a serial number, change a date, change a result, and save it back out looking exactly like the original. Nothing about a plain PDF stops that, and nothing about a plain PDF lets a third party tell the difference between the original and the edited copy.

A certificate that cannot be checked independently of the company that issued it is a letter of assurance. You are trusting the vendor's word a second time, on top of trusting them to have run the wipe correctly in the first place. That is not evidence. Evidence has to stand on its own, checkable by someone who was not in the room. This is what a cryptographic signature is for. WipeCert signs every certificate with an Ed25519 key at the time the wipe completes. The signing key's public half is published, so anyone, not just WipeCert, can confirm that a given certificate was signed by that key and has not been altered since.

How to verify one in ten seconds

You do not need an account, a login, or a phone call to check a WipeCert certificate. The process is:

1. Open the certificate. Find the certificate ID or scan the QR code printed on it.
2. Go to the public verification page and paste in the certificate ID.
3. The page recomputes the signature check and tells you whether it matches the signed record.

That is the whole process. No sales call, no support ticket, no waiting on a vendor to confirm anything by email. The verification page either matches the signed record or it does not.

What WipeCert does not claim

Being direct about the limits of a claim is part of making the claim trustworthy. WipeCert is not SOC 2 Type II audited. WipeCert does not hold NAID AAA certification, and does not hold R2v3 certification. Those two certifications apply to physical destruction and recycling facilities, evaluating things like chain of custody, background-checked staff, and facility access controls. They do not apply to erasure software, and no erasure software vendor needs to hold them to prove a wipe happened. What proves a wipe happened is a signed, per-device, independently verifiable record, which is the six fields above and the signature that backs them.