Questions about ITAD compliance and evidence.
Plain answers to the questions brands and ITADs ask us most. Each one is reviewed every quarter.
Want the short version? Download the ITAD evidence checklistThe problem
Who checks that an ITAD followed our disposal contract?
In most programmes, nobody independent does. The certificates, settlement reports and downstream records that show your terms were met are almost all produced by the ITAD doing the work. Your team receives them, but rarely has the time or the serial-level data to reconcile what left your sites against what came back. An independent check compares each unit's evidence with the clause it relates to and reports what is missing, late or inconsistent. Odys One does that, working only for the brand.
What is independent ITAD compliance reporting?
It is a check, run by a firm with no stake in the disposal, of whether the evidence an ITAD supplies proves the brand's own disposal terms were met. The standard is the brand's contract, not an industry scheme. The output is a report of findings: what was checked, against which clause, what was found, and where the evidence sits. It complements ITAD certifications and internal audit rather than replacing either.
Why can't we rely on the reports our ITADs send us?
You can rely on them for what they say, but not for what they leave out. An ITAD's report is written by the party being measured, usually in its own format, and often summarises by weight or batch rather than by serial number. That makes gaps hard to see: units collected but never evidenced, certificates without serials, or top-up collections with no record of what moved. An independent reconciliation shows which of your conditions the evidence actually proves.
What is the difference between an ITAD audit and a report of findings?
An audit gives an opinion. A report of findings gives the facts an opinion would rest on. Odys One reports what was checked, against which rule, what was found and where the evidence sits, without passing judgement on the ITAD. If you have an internal or external auditor, they can review the same record and reach their own opinion.
Certifications
Is R2 or e-Stewards certification enough to show our ITAD met our contract?
No. R2 and e-Stewards check a facility's management system against an industry standard: data security, environmental controls, downstream due diligence. They don't check whether your terms were met, on your hardware, in a given cycle. A certified ITAD can still send a certificate without serials, miss a deadline your contract sets, or resell an item you required destroyed. Certification tells you the facility is capable; contract evidence tells you what happened to your units.
What does NAID AAA certification cover, and what doesn't it?
NAID AAA, run by i-SIGMA, checks that a provider's data destruction process meets its standard, including unannounced audits of the facility. It covers how destruction is done. It doesn't show that every serial you handed over was destroyed, when, or in which country, against the terms of your own contract. That needs the unit-level evidence checked against your terms.
Our ITAD passed our vendor audit. What does an independent check add?
A vendor audit looks at the ITAD's processes on the day of the visit. An independent check looks at the evidence for every unit, every cycle, after the fact. The two answer different questions: "can this ITAD do the job?" and "did this ITAD do the job on our hardware?" Most brands have a good answer to the first and a partial answer to the second.
Evidence and data destruction
How do I check my ITAD's certificates of data destruction against serial numbers?
Match the serials on each certificate to the serials on your collection record, one by one. Then check that the method, date and location match what your contract requires. The common gaps are certificates that list a batch or weight instead of serials, serials that appear on the collection record but on no certificate, and certificates issued before the collection date. A look-back review does this for a full closed cycle.
What should a certificate of data destruction include?
At minimum: the serial number of each data-bearing device, the method used (erasure or physical destruction), the date and location, the tool or equipment used, the result of the check that sanitisation worked, and the name and signature of the person responsible. NIST SP 800-88 Revision 2, published in September 2025, is the most widely referenced guide to media sanitisation. Your own contract may require more, such as destruction in a set country.
What evidence should an ITAD give for each serial number?
Enough to trace each unit from collection to a final outcome: received, then erased or destroyed, resold or recycled. For each step, a record with a date, and for the final outcome a document that names the method or the buyer. Evidence varies in strength. In order: someone's word, a signed ITAD document, an independent record, and data that can be checked automatically.
What is a defensible chain of custody for decommissioned servers?
One where every unit can be traced from your site to its final outcome, with no gaps, using records that can't be altered after the fact. In practice that means serial-level records at each handover, timestamps, and a signed record at each transfer. The test is simple: could you show an auditor or regulator where any given serial went, and the document that proves it?
What does it mean when evidence for a unit never arrives?
It means the unit is unaccounted for, and that is a finding in itself. On a closed cycle the evidence should already exist, so a missing document is not a paperwork delay. It is a gap in what you can prove. Odys One treats silence as a signal: units with no final evidence are listed, by site and ITAD, with what is still open from earlier cycles.
Why isn't weight-based ITAD reporting enough?
Weight can't show which units are missing. A report that says 4.2 tonnes were recycled tells you nothing about whether a specific drive or GPU was destroyed, resold or lost. Serial-level reporting counts units and ties each one to an outcome. Odys One's evidenced rate counts units, not weight, and sits alongside your published circularity figure rather than replacing it.
Resale and restricted items
Can an ITAD resell decommissioned GPUs?
Often yes, but under conditions. Many brands require their approval before any GPU is resold. Advanced AI chips, and servers and boards that contain them, can remain subject to export controls after first use. Under US export rules the controls follow the item, so a resale or re-export can be an export transaction in its own right, and the EU controls some advanced computing chips too. Odys One checks each GPU resale against the approval, buyer and destination conditions in your own terms and reports any gap. We don't classify items, decide whether a licence is needed or give legal advice.
How do we know who bought our used hardware?
Only if your ITAD records the buyer's identity, not just its type. "Sold to a reseller" can't be screened against a restricted-party list. A named buyer can. Odys One checks whether the records your ITADs send name each buyer, whether each one was screened before sale where your terms require it, and whether the destination matches what was approved. A buyer that clears our checks has been found on a company register and not matched on the lists we search. That supports your own screening; it doesn't replace it.
What is an end-user certificate and when is it needed?
It is a signed statement from the buyer of controlled or sensitive equipment saying who will use it, for what, and where. Brands often require one before restricted items such as GPUs are resold, and export authorities may ask for one as part of a licence or as due diligence. Odys One checks that each certificate your terms require exists, is signed by someone with authority, and matches the units and the destination. We check the document; we don't assess whether the end use is permitted.
How do we check our ITAD's downstream partners?
Ask for the list of downstream processors your ITAD uses, their certifications and their locations. Then check that the units your ITAD sent on went only to partners on that list. Most ITADs already keep this list to maintain their own certification. Odys One checks the downstream records against the partners and conditions in your terms.
Disposal terms
How do I write ITAD disposal terms that can actually be checked?
Give every condition three things: a measurable test, the evidence that proves it, and a deadline. "Destroy data securely" can't be checked. "Provide a certificate listing each serial, the method and the date within 30 days of collection" can. A disposal terms review shows which of your existing conditions can be checked with the evidence you receive today, and the small additions that would close the rest.
What are the most common gaps in ITAD contracts?
Four come up most: conditions with no deadline for evidence, goals with no control behind them, buyer records that capture type rather than identity, and certificates that don't have to list serials. None of these needs a change to how you sell. Each is closed by asking for one more field or one clear deadline in the evidence your ITADs already send.
Reporting
How do we report hardware circularity figures that hold up to audit?
Back every figure with unit-level evidence. A circularity percentage built from ITAD summaries by weight is hard to defend when an auditor asks how it was calculated. A figure built from serial-level outcomes, with the document behind each one, isn't. Odys One gives your sustainability team figures that say where they came from.
What should a quarterly ITAD review cover?
Each ITAD's record against your terms for the quarter. Evidence on time and late, units still open from earlier cycles, findings raised and resolved, and any change to certifications or downstream partners. It should compare ITADs on the same basis, so the conversation is about evidence, not impressions.
Working with Odys One
What is Odys One?
Odys One is an independent compliance firm based in Ireland. It checks the evidence that IT asset disposition (ITAD) companies provide against a brand's own disposal rules, unit by unit, and issues a report of findings. Odys One does not buy, sell or handle hardware, and takes no share of what the hardware sells for.
Does Odys One buy or sell hardware?
No. Odys One doesn't touch the goods, decide awards or take a share of what they fetch. Its only work is checking evidence against the brand's rules and reporting what it finds. That separation is what makes the findings independent.
How does a look-back review work, and how long does it take?
You send the files you already hold for one fully closed cycle: terms, listing file, award record, collection records and ITAD evidence as received. Odys One checks every unit against the terms that applied and returns the report, the evidence pack, a cleaned manifest and a list of open questions. It takes about four weeks from receiving the files, followed by a 30-minute walkthrough.
What data does Odys One need, and where is it kept?
Only files you already hold, in the form you hold them: spreadsheets, PDFs, scans and emails. Your data is held in a dedicated environment we run for you, hosted in Dublin, with a full access log. Files are fingerprinted on arrival and never altered. At the end of an engagement your data is returned or deleted, and you receive a deletion certificate.
Does Odys One replace our auditor?
No. Odys One produces a report of findings, not an audit opinion. Your internal or external auditor can review the same evidence and reach their own opinion, which is what makes the report useful to them.
For ITADs
My customer wants us to use Odys One. What do we have to do?
Provide the evidence your contract already requires, uploaded the way you hold it: PDF, spreadsheet, photo, zip or forwarded email. Larger ITADs can send a scheduled export from the system they already run. You'll see what is due per collection, what was read from your files so you can confirm or correct it, and your own record of evidence received and matched.
Do ITADs see findings before the customer does?
No. Findings go to your customer first. Where your customer has brought you onto the platform, you can see and correct any factual error in what we read from your files, and you have a right of reply to any finding about your firm. Findings describe gaps in evidence, not judgements on how you process equipment.
