What is chain of custody in ITAD?
The asset custody log that proves your equipment — and the data on it — was accounted for at every step between your dock and final disposition.
Quick answer
Chain of custody in ITAD is a documented, timestamped record of every transfer and handling step for each asset — from pickup or mail-in receipt through wiping, destruction, or resale — proving nothing was lost or accessed along the way. Trace includes a complete chain of custody free on every job, alongside a serial-level Trace Report.
What a chain of custody captures
A chain of custody is a running log, not a single form. Each entry records who had the assets, when, and what they did with them. A complete ITAD chain of custody captures:
- Timestamps for every custody event — collection, sealing, transit, facility intake, processing, and final disposition.
- Named handlers and signatures at each transfer, so responsibility is never ambiguous.
- Serial-level asset manifests — every device scanned at pickup and verified again at intake, so counts always reconcile.
- Tamper-evident seal numbers applied at your site and confirmed intact on arrival.
- Transport details — vehicle, route, and any intermediate stops.
- Final disposition per asset — wiped and resold, physically destroyed, or transferred to a certified downstream recycler.
Why it matters
The riskiest window in IT asset disposition is between your loading dock and the processing facility — drives still hold live data, and a missing device is a potential breach. A chain of custody closes that gap with evidence: if an auditor, regulator, or incident response asks what happened to a specific serial number, the log answers with timestamps and signatures rather than assurances.
Frameworks such as HIPAA, SOX, and GLBA expect organizations to demonstrate control over media containing regulated data through disposal. A serial-level custody log, paired with a Certificate of Destruction, is the standard way to demonstrate it.
Chain of custody vs. Certificate of Destruction
The two documents answer different questions. The chain of custody proves continuous control — every handoff from pickup to disposition. The Certificate of Destruction attests to the outcome — that specific media were sanitized or destroyed by a stated method on a stated date. Auditors typically want both, which is why serious ITAD providers issue them together.
How Trace handles this
Trace includes a full chain of custody free on every job — on-site pickups and nationwide mail-in kits alike. Assets are serial-scanned at collection, sealed with tamper-evident seals, verified at intake, and logged through wiping (aligned to NAID AAA / i-SIGMA specifications), physical destruction from $15 per drive, or refurbishment for resale. You receive the custody log with your serial-level Trace Report and Certificate of Destruction, and we retain the records for seven years.
Related answers
- What is a Certificate of Destruction? — the companion document that attests each drive was sanitized or destroyed.
- What is IT asset disposition (ITAD)? — where chain of custody fits in the full disposition process.
- See a sample chain of custody document — a real example log with custody events, seals, and a serial manifest.
- How Trace asset tracing works — serial-level tracking from pickup to final disposition.