Standards & compliance
The standards behind provable sanitization
ProofWipe implements the Clear and Purge sanitization categories defined by NIST SP 800-88. Here’s what those categories mean, where they come from, and how ProofWipe maps to them.
ProofWipe implements published sanitization standards. It is not a third-party-certified product.
The source documents
Two public standards, one shared model
NIST SP 800-88
Guidelines for Media Sanitization · NIST, United States
The reference framework for media sanitization. It defines the Clear / Purge / Destroy taxonomy, guides selecting a category based on data sensitivity and where the media goes next, and calls for verification and documentation of the result. It is the vocabulary auditors, ITAD downstreams, and security teams share.
CSE ITSP.40.006
IT Media Sanitization · Canadian Centre for Cyber Security
Canada’s guidance on sanitizing IT media, published by the Communications Security Establishment’s Canadian Centre for Cyber Security. It covers sanitization methods by media type and the record-keeping expected in Government of Canada contexts, the reference point for Canadian public-sector disposition programs.
Read CSE ITSP.40.006 at cyber.gc.caThe taxonomy
Clear, Purge, Destroy: what each one means
Clear
Overwrites user-addressable storage so data cannot be recovered with standard tools.
Clear uses logical techniques (typically overwriting every user-addressable location) to protect against simple, non-invasive recovery: file-recovery utilities, undelete tools, casual keyboard attacks. It is generally appropriate when the media stays within an organization’s control or the data is of moderate sensitivity.
In ProofWipe
ProofWipe Clear overwrites the full addressable space with fixed or cryptographically random patterns, handles unwritable sectors by isolating and disclosing them, and then verifies the result by read-back.
Purge
Uses the drive’s own firmware sanitize commands to render data recovery infeasible even with laboratory techniques.
Purge applies physical or logical techniques that make recovery infeasible even with state-of-the-art laboratory methods. For modern drives that usually means the device’s own firmware sanitize operations, which can reach cells and reserved areas that host software cannot address, including flash over-provisioning and remapped sectors.
In ProofWipe
ProofWipe Purge issues ATA SANITIZE / Secure Erase to SATA drives and Sanitize / Format operations to NVMe drives, detects when a drive genuinely supports them (and says why when it doesn’t), and captures post-sanitize read-back evidence.
Destroy
Physical destruction (shredding, disintegration). ProofWipe is the alternative to Destroy: it enables resale.
Destroy renders the media itself unusable: shredding, disintegration, incineration. It is the right choice for damaged media or the very highest sensitivity levels, but it also destroys the asset’s remaining value and creates e-waste.
Where ProofWipe stands
ProofWipe deliberately does not do this. Its purpose is to make Clear and Purge provable enough that serviceable hardware can be resold instead of destroyed.
The mapping
What the guidance asks for, and what ProofWipe does
Media-sanitization guidance converges on the same operational asks: pick an appropriate method, verify it worked, write it down, and account for the edge cases. Here is how ProofWipe answers each one.
Sanitization method appropriate to the media and sensitivity
Operator chooses Clear (overwrite) or Purge (firmware sanitize) per drive; unsupported methods are greyed out with the reason stated, never silently substituted.
Verify the sanitization result
Read-back verification at 1%, 10%, or 100% sampling, always including the first and last regions; caches are flushed before reads; skipped sectors are excluded and disclosed.
Document the sanitization (who, what, when, how, result)
Tamper-evident certificate (HTML + PDF) records device identity and serial, method, verification level and outcome, operator, timestamps, arming method, BitLocker status, and hidden-area findings, secured with a SHA-256 log hash.
Account for hidden and reserved areas
HPA/DCO detection on ATA drives at enumeration; disclosed in the UI and on the certificate, with the note that an overwrite Clear cannot reach hidden areas while an ATA SANITIZE Purge does.
Record every outcome, not just successes
A certificate is generated for every outcome, including cancelled or partial wipes.
FAQ
Common questions about sanitization standards
What is the difference between Clear and Purge?
Clear overwrites the storage a computer can normally address, protecting against recovery with standard software tools. Purge goes further: it uses the drive’s own firmware sanitize commands to also reach reserved and remapped areas, making recovery infeasible even with laboratory techniques. Purge is generally recommended for solid-state drives and for media leaving the organization’s control.
Is software sanitization as good as shredding?
For most scenarios, a properly executed and verified Purge (or a verified Clear where appropriate) renders the data unrecoverable while keeping the hardware usable. Physical destruction remains appropriate for damaged media or when policy explicitly requires it. The key differences are verification and documentation: ProofWipe proves what was done, which a shredding bin receipt cannot say about the data itself.
Why do SSDs need firmware sanitize instead of multi-pass overwrites?
SSDs remap writes across flash cells and keep over-provisioned spare areas that host software cannot address, so overwrite passes may never touch every cell. Firmware sanitize commands (ATA SANITIZE, NVMe Sanitize) are executed by the drive itself and cover those areas. Multi-pass overwrite schemes were designed for older magnetic media and add wear, not assurance, on SSDs.
Is ProofWipe certified against these standards?
ProofWipe implements published sanitization standards. It is not a third-party-certified product. The methods, verification, and certificate contents are designed so your process documentation can stand on its own in an audit.
What should a sanitization certificate contain?
At minimum: the device’s identity and serial number, the sanitization method and category, the verification performed and its result, who performed it and when, and any caveats such as skipped sectors or hidden areas. ProofWipe records all of these and binds the certificate to the wipe log with a SHA-256 hash so alterations are detectable.
Put the taxonomy to work
See how Clear, Purge, verification, and certificates come together on a real bench.