Security at WipeCert

Trust center

How we protect your data, prove every wipe, and control who can act on your fleet. Security review teams can request our DPA and subprocessor list at any time.

Signed certificatesPublic verificationMFA requiredNIST 800-88 aligned

Certificates

Every certificate is signed and anyone can check it.

Each wipe certificate is digitally signed with industry-standard cryptography the moment the wipe is recorded. The signature is what makes the certificate useful to an auditor:

Tamper-evident. Change one character in a serial number or a hash and the certificate no longer verifies.
Verifiable by anyone. An auditor, a customer or a regulator can check a certificate online without a WipeCert account.
Built to last. Certificates stay verifiable after our signing keys rotate, so a record from years ago still checks out.

Verify a certificate

Signing Keys

The signing key stays locked away.

StorageHeld encrypted, with access restricted to authorized staff. It is never shown in any screen.

RotationKeys can be rotated at any time. Certificates signed with an earlier key stay valid.

Incident responseIf a key were ever exposed we would stop using it, issue a new one, post a notice on our status page, and reissue every affected certificate under the new key.

Data Protection

What we hold, and how we protect it.

HostingHosted in the United States.

EncryptionEncrypted in transit and at rest, including backups.

Staff accessAccess to customer data is limited to authorized staff.

Breach notificationWe notify affected customers without undue delay if a breach affects their data.

IsolationEach organization's records are kept separate from every other organization's.

Account dataName, work email, organization membership and role. Passwords are stored only as one-way hashes.

Device and wipe recordsDevice and drive details (make, model, serials, capacity), the method and standard used, verification results, timestamps and the signed certificate.

What never leaves the deviceYour files and file names. The one exception: if a drive fails the post-wipe check, the report carries up to three 64-byte samples of what remained so the failure can be investigated.

Access Control

Who can act on your fleet.

Sign-inEmail and password, or Microsoft sign-in.

Multi-factor authAuthenticator-app MFA is required to access the dashboard.

RolesEvery user belongs to an organization and acts within the role their administrator assigns.

Agent keysStored hashed and shown once, at creation. Revoke a key and it stops working immediately.

Abuse protectionWipe creation, device check-ins and public verification are rate limited.

Standards

What we align with.

NIST SP 800-88 Rev. 2

Media sanitization (Clear and Purge)

DoD 5220.22-M

Multi-pass overwrite (legacy support)

GDPR Art. 17

Right to erasure (data subject requests)

HIPAA §164.310(d)(2)

Disposal of electronic PHI

Privacy & Documents

Privacy requests, DPA and subprocessors.

Privacy requestsTo export or delete your account data, email privacy@wipecert.com from the account's registered address. We respond within 30 days.

DPAWe sign a Data Processing Agreement with customers on request. Email support@wipecert.com.

SubprocessorsA current list of subprocessors is available on request from support@wipecert.com.

Responsible Disclosure

If you find something, tell us.

We welcome reports from security researchers. Please email security@wipecert.com with:

A description of the issue and the affected page
Steps to reproduce
Impact assessment in your own words
Your contact information for follow-up

We acknowledge reports within 2 business days, triage within 5, and aim to patch critical issues within 14 days. We will not pursue legal action against researchers acting in good faith. Please don't pivot beyond the proof of concept, don't exfiltrate other customers' data, and don't test against accounts you don't own.

Live system status

Current health of verification, signing and downloads.

security@wipecert.com

Vulnerability reports and security review questionnaires.