Compliance your auditors can read
Every wipe maps to a NIST 800-88 outcome, and every job produces a chain-of-custody report.
| tScrub method | Class | NIST 800-88 |
|---|---|---|
| NVMe Crypto / Block / Overwrite Purge · SAS Sanitize (overwrite) | PURGE | Purge |
| ATA Enhanced Secure Erase | PURGE | Purge |
| ATA Secure Erase / NVMe Format / software overwrite | CLEAR | Clear |
| Unrecoverable / frozen | — | Destroy |
NIST 800-88
Clear and Purge outcomes mapped directly to each erasure method — a Destroy fallback for drives that can't be wiped.
IEEE 2883-2022 opt-in
Boot with tscrub_standard=ieee2883 and each drive is labelled IEEE 2883-2022 only where five gates pass — technique, coverage, verification, completion and media scope — with the level recorded (Clear or Purge). A refused drive keeps the NIST technique name and records the gate it failed.
tScrub is not certified to IEEE 2883, and no third party has audited it against that standard — exactly as nothing is "NIST 800-88 certified". Certificates say so: IEEE 2883-2022 methods described, not IEEE certified.
UK GDPR & ICO
Verifiable erasure supports the "right to erasure" with a documented audit trail that aligns with ICO guidance.
HIPAA
PHI on decommissioned media is erased and recorded per device.
ISO 27001
Fits asset-disposal and media-sanitisation controls with repeatable reporting.
Chain of custody, built in
Each run is tied to a Chain of Custody ID and captures drive model, serial, per-drive method, certification, and final status — including how each drive was destroyed (the technique and the NIST SP 800-88 level reached) and the media disposition (sanitised in place and reusable, or physically destroyed). The report is the evidence — hand it to your auditor as-is.
What the report proves
- Which method ran — the exact sanitise operation for each drive (crypto purge, enhanced erase, and so on).
- What outcome it achieved — the NIST SP 800-88 level reached (Clear, Purge, or Destruction), the technique used (for example cryptographic erase), and whether the media was sanitised in place or physically destroyed.
- Where and when — drive serials, Chain of Custody ID, and timestamp.
- Drive health before and after — pre/post-wipe SMART (status, temperature, power-on hours, wear) recorded in the report and certificate.
- Verification of the wipe — sample sectors are re-read after erasure to confirm the data is gone, with the result recorded per drive, together with which kind of check produced it (planted sentinel sectors, a sampled percentage of the address space after a software overwrite, or the crypto-erase exemption where a read-back proves nothing either way).
- Verification of the certificate itself — every certificate QR carries a signed code that can be checked with no network at all, against the published signing key. It proves the certificate was issued by us and has not been altered; the recorded content stays a matter for the online record.
- Hidden-area handling — HPA/DCO areas are removed before the erase so the full native capacity is sanitised.
- What failed — frozen, locked, and blocked drives are recorded, never silently marked clean.
- The machine behind the drive — system and board serials, BIOS, TPM, Secure Boot, CPU, RAM, display, and battery, so the evidence is tied to a specific device.
- Audit-proof identity — every report carries a report_id and a SHA-256 digital identifier, so each report is individually identifiable and tamper-evident.
Certified by you — evidenced by tScrub
Your Certificates of Destruction are issued by your own organisation — the data controller responsible for the assets — and carry your company's name, registration number, and address. tScrub is the tool that produces the item-level evidence: per-drive serials, wipe method, SMART before/after, and a tamper-evident record traceable by Certificate ID. Each certificate states how the data was destroyed — the method, NIST level, technique and media disposition — and opens its device annex with a destruction method summary.
Every certificate is also issued as a signed, machine-readable JSON-LD document — so compliance platforms and automated auditors can ingest and verify the evidence without parsing the PDF.
tScrub is operated by TFix Ltd, a UK IT asset disposition provider specialising in certified data destruction. TFix is licensed, insured, and registered as follows:
- Company — TFix Ltd, registered in England & Wales, company number 07892418.
- VAT — GB 156 1511 30.
- Data protection — registered with the ICO, reference ZB787416.
- Waste carrier — upper-tier licence CBDU656692 (lower tier CBDL16710).
- Cyber security — Cyber Essentials certified (IASME).
- Environment — WEEE T11 exemption EXP/UP3043JD.
- Insurance — employer's and public liability insurance (policy 702734085).
Licence and certificate details, including reference numbers and expiry dates, can be verified at www.tfix.co.uk/information/documents.
tScrub supports NIST 800-88 workflows; it is not itself a certification. Validate final requirements with your compliance team.