By Surplus Cascade · Updated October 25, 2026
Identify where information may be stored.
List built-in drives, removable media, connected computers, controllers and other known storage. Include configuration, measurement records, project data and credentials when deciding what requires review. Do not assume that a powered-off instrument or a removed cable means stored information is gone.
Identify who can make the data decision.
Your organization should decide what must be retained, what can be removed, which media must stay and who may approve the work. Discuss confidentiality and an NDA before sending restricted inventory details. Keep passwords and actual confidential data out of a general equipment enquiry.
State the requirement, not just “wipe it”.
Tell the proposed provider which assets and media are included, the required method or standard, verification expectations and the records your organization needs. Different devices and conditions can require different treatment. Do not assume a method intended for one type of media applies to every instrument.
Confirm who will perform the work.
Surplus Cascade may perform data sanitization directly or use a contractor. Acceptance of equipment with storage does not automatically include a specified method, standard or certificate. These details must be confirmed before scheduling, including whether the requested documentation can be supplied.
Make equipment release a separate checkpoint.
Agree whether work occurs before release, after receipt or through another arranged route. Keep the authorized asset list, scope and required records together. A pickup receipt demonstrates collection; it is not by itself proof of completed data sanitization.
Four decisions to settle with the equipment owner
- Which information must be retained before release?
- Which storage devices remain with the seller or with the equipment?
- Who authorizes the data work and accepts the method?
- What asset-level record must be delivered, and by whom?
Keep these decisions separate from the equipment price. If a particular standard or certificate is required, obtain confirmation that the agreed provider can meet it before scheduling. This guide does not establish that a device has been sanitized.
Raise requirements at the first discussion.
Describe your policy requirements without sending the sensitive data itself. If the proposed scope cannot meet them, resolve that before moving equipment. See recycling and data arrangements and the pickup checklist, or contact us about a confidential review.