Skip to content
ISO/IEC 27001RazorERP is ISO/IEC 27001:2022 certified. View the certificate for your security review→
ISO/IEC 27001 certified · View the certificate →
RazorERP
AboutSupportRequest a Demo
Chain of custody

Chain of custody in ITAD: what a defensible record looks like

When a client asks what happened to one device, the answer should already exist.

By the RazorERP team · Updated November 2026

On this page
  1. What chain of custody means
  2. The events worth recording
  3. Record it as the work happens
  4. Exceptions are part of the record
  5. Test it with one serial number
  6. Frequently asked questions

What chain of custody means

Chain of custody is the record of who held an asset, when, and what happened to it. In ITAD it runs from the client’s site through transport, receiving, processing, and on to resale, recycling, or destruction.

It matters because the client’s risk does not end when the truck leaves. If a device with data goes missing, the record is how you show what happened.

The events worth recording

Start with the handoff: the pickup, the carrier, and the receipt, including any shortages or unexpected items. Then record each meaningful touch: audit, testing, erasure or destruction, grading, and moves between locations.

Finish with the outcome: which buyer or downstream vendor received the device, and when. Each event should show the time and the person or system responsible.

Record it as the work happens

A custody report assembled at the end of a job is only as good as what people remember and which files they can find. Events captured during the work, by scanning at each step, are harder to get wrong and much easier to defend.

That is the idea behind a single asset record: every team adds to the same history, so nobody has to rebuild it later.

Exceptions are part of the record

Real jobs include shortages, devices not on the manifest, failed erasures, and units that change disposition. A record that only shows the clean path is not believable.

Keep exceptions visible, along with who resolved them and how. An honest history of what went wrong and how it was fixed builds more confidence than a perfect one.

Test it with one serial number

Here is a simple test for any ITAD operation. Pick a serial number from a job six months ago, then time how long it takes to show where it was received, how it was sanitized, and where it went.

If that takes minutes and one screen, you are in good shape. If it takes an afternoon and three people, that is the gap to close. A client portal can take this a step further by letting authorized clients see what you share with them directly.

Keep reading

CapabilityChain of custody in RazorERPA time-stamped history for every asset.Open →ArticleR2 compliance softwareThe records an R2 audit relies on.Open →CapabilityAI imaging receivingCapture evidence at the first touch.Open →

Frequently asked questions

What is chain of custody in ITAD?

It is the record of who handled an asset, when, and what happened to it, from pickup through final disposition.

Why does chain of custody matter?

Clients remain concerned about their data and equipment after it leaves their site. A complete record lets a provider show what happened to any device, and helps with audits.

What should a chain of custody report include?

Typically client and job references, serial numbers, pickup and receipt details, processing events, data sanitization evidence, and final disposition.

Trace a device from pickup to disposition.

Bring a real job and we will walk through it.

Request a DemoITAD software