What is ITAD and why do enterprises need it?

ITAD is the documented retirement of corporate IT — pickup, sanitization, asset recovery, recycling, and audit-ready reporting. Enterprises need it because retired devices are the single largest source of unaccounted-for sensitive data, and because regulators, customers, and auditors increasingly expect documented disposition, not just a recycling receipt. Mature ITAD programs reduce data-exposure risk, recover residual asset value, and produce evidence that closes audit findings without follow-up.

How long does an ITAD engagement take from request to audit pack?

Typical engagements: pickup scheduled within one business week, intake and sanitization complete within two to three weeks of pickup, audit pack delivered within five business days of close. Multi-rack data center decommissioning runs on a project timeline scoped against your power-down windows. Onsite destruction can compress the cycle to same-day-certificate when chain of custody must remain on your dock.

What information do I need to provide for a quote?

Pickup city or ZIP, approximate asset count, asset types (laptops, servers, networking, mobile, etc.), target pickup window, onsite-versus-in-facility destruction preference, and compliance frameworks in scope (HIPAA, GLBA, PCI DSS, etc.). A coordinator follows up within one business day with a quote and pickup window. If your inventory is uncertain, ballpark counts are fine — final scope is reconciled at intake.

Do I get paid for asset recovery?

Often, yes. Late-model laptops, servers, and networking gear regularly recover enough to offset pickup, sanitization, and recycling — sometimes producing net proceeds. We provide a settlement-versus-services estimate during scoping so you know whether the engagement runs at cost, revenue-positive, or as a paid service. Recovery economics depend on hardware mix, condition, and your willingness to allow remarketing.

How is chain of custody maintained from pickup to disposition?

Sealed totes with tamper-evident locks at your dock, GPS-tracked transport by background-checked crews, signed transfer at every handoff, serialized intake reconciled against your manifest, and a custody record bundled into the audit pack. Continuous, signed, and traceable from your dock to final disposition. Custody is what makes a destruction certificate defensible. Without it, even a perfect destruction can fail a sophisticated audit.

How do I run an RFP for an ITAD vendor?

Start with our ITAD RFP Checklist — a 17-section evaluation grid covering security controls, sanitization standards, custody model, certifications, downstream transparency, reporting structure, retention, insurance, and pricing. It's the same framework enterprise procurement teams use to compare ITAD vendors apples-to-apples. If you bring a structured RFP to the table, you'll get structured answers; vague RFPs produce vague vendor responses.

Are pickup vehicles GPS-tracked and sealed?

Yes. All TexasITAD pickup transport is GPS-tracked end-to-end, with sealed tamper-evident totes loaded at your dock and broken only at the destruction or intake facility under documented conditions. Seal-break events in transit are flagged, photographed, and disclosed on the engagement record. For high-sensitivity engagements, dual-driver transport and route locks are available.

Can I get insurance evidence for an ITAD engagement?

Yes. Certificates of insurance covering general liability, errors and omissions, cargo, and cyber are available on request and customizable to name your organization as additional insured where required. Bring your insurance evidence template to scoping and we'll align before mobilization. Insurance evidence is a standard procurement gate; surface it early to avoid last-minute legal review delays.

What happens if I find a missing device after the engagement closes?

Submit the serial through your account contact and we cross-reference the engagement records (intake manifest, sanitization log, settlement, recycling summary) to locate the disposition. If the device wasn't in our intake, we say so plainly so you can investigate the upstream gap on your side. We don't paper over inventory gaps. The reconciliation report flags exceptions for your team to resolve before close.

Can you redeploy assets internally instead of reselling them?

Yes. Internal redeployment — sanitize, refurbish, image to your build, return to your inventory — is the highest-value reuse path. It avoids resale fees, eliminates re-procurement, and keeps assets inside your security boundary. Common for school districts, healthcare systems, and franchise retail. Bring your standard build images and asset-tag conventions to scoping and we'll align the redeployment workflow.

Do you work with managed service providers and resellers?

Yes. White-glove ITAD delivered as part of an MSP or reseller client offering is a regular engagement type. Brandable reporting, per-tenant audit packs, margin-protected pricing, and MSA-friendly contracting are standard. Bring your delivery model to scoping and we'll align. MSP partners typically run TexasITAD as a back-end ITAD provider while keeping the customer relationship; we support that explicitly.

What's the difference between onsite and offsite ITAD?

Onsite ITAD performs destruction or sanitization at your facility under your supervision; chain of custody never leaves your dock. Offsite ITAD seals media at your dock for transport to a destruction facility under GPS-tracked custody. Onsite is preferred for high-sensitivity media; offsite is more cost-efficient at scale. Many programs blend both: onsite for classified or PHI-bearing media, offsite for the routine fleet.

How is data actually destroyed during ITAD?

Methods are matched to the media class per NIST SP 800-88 Rev. 2 — Clear (verified overwrite), Purge (cryptographic erase, ATA Sanitize, or degauss), or Destroy (physical shred). Onsite and offsite options are available, and every device receives a per-asset certificate tied to the chain-of-custody manifest. Method selection is driven by media type, data sensitivity, and reuse intent — not by a single blanket policy across the fleet.

How do I choose between wiping, shredding, and degaussing?

Wipe (Clear) when the device is reused inside your security boundary. Shred (Destroy) when it's end-of-life, damaged, or policy-mandated. Degauss (Purge) for highly classified magnetic media, often paired with shredding for defense-in-depth. SSDs default to verified Purge or physical destruction; degaussing does not work on flash. When in doubt, our Data Destruction Decision Guide walks through media class, confidentiality, and reuse intent in a single decision tree.

What happens to data on networking gear, copiers, and POS terminals?

Networking gear (firewalls, switches with running config), copiers and MFPs (image cache), and POS terminals (cardholder data residue) all hold sensitive data and are sanitized using NIST SP 800-88 Rev. 2 aligned methods at intake — never assumed clean because they're 'not a computer.' This is one of the most common gaps we see in customers' previous ITAD vendors — non-PC media routinely went unprocessed.

What's the difference between Clear, Purge, and Destroy?

Clear is logical sanitization (verified overwrite) that resists keyboard-level recovery. Purge is media-specific physical or logical techniques (cryptographic erase, ATA Sanitize, degauss) that resist laboratory recovery. Destroy is physical destruction (shred, disintegrate). NIST SP 800-88 Rev. 2 maps each to media type and confidentiality category. Choose Clear for in-boundary reuse, Purge for cross-boundary reuse, Destroy when reuse isn't in scope or risk demands it.

Do you handle mobile devices, tablets, and phones?

Yes. Mobile devices are sanitized using verified workflows or destruction — factory reset alone is not equivalent to NIST sanitization. SIM cards and SD cards are removed and destroyed separately when present. Per-device certificates are issued for engagements where individual mobile traceability matters. BYOD recovery and corporate-mobile refresh are common engagement types; both produce per-device evidence.

Why can't degaussing destroy data on SSDs?

Degaussing erases magnetic media by collapsing the magnetic field that stores bits. SSDs and flash media store data in semiconductor cells, not magnetically, so a degausser has no effect on them. NIST SP 800-88 Rev. 2 explicitly excludes degaussing as a sanitization method for flash-based media. For SSDs, use verified cryptographic erase, vendor sanitize commands, or physical destruction (shred, disintegrate).

What shred size do you use for hard drives?

Standard production shred size is 1.5 inch for HDDs and 0.5 inch (or smaller) for SSDs and high-confidentiality media, aligned with NIST SP 800-88 Rev. 2 Purge/Destroy guidance and DIN 66399 H-5/E-5 levels. Smaller particle sizes available for classified workloads on request. Particle size requirements increase with data sensitivity. Confirm your control framework's required size before scoping.

Is a single-pass overwrite enough for modern drives?

For modern HDDs, NIST SP 800-88 Rev. 2 confirms a single verified overwrite pass is sufficient as a Clear method. Multi-pass DoD-style overwrites are legacy guidance no longer required by NIST. For SSDs, overwrite is not a reliable method — use cryptographic erase or destruction instead. Vendors still selling 'DoD 7-pass wipes' as a premium option are charging for outdated technique, not stronger security.

Can destruction be witnessed by my team or recorded on video?

Yes. Witnessed destruction (your security or compliance staff present) and video-documented destruction (continuous recording from intake to shred) are both standard offerings. Common for breach response, FOIA-bearing media, classified deployments, and engagements feeding evidence packages for regulators. Schedule witnessed destruction during scoping; video documentation can be added to almost any engagement on request.

What's cryptographic erase and when should I use it?

Cryptographic erase (CE) destroys the encryption key on a self-encrypting drive, rendering ciphertext unrecoverable in seconds. NIST SP 800-88 Rev. 2 lists CE as a valid Purge method for SED HDDs, SEDs, and many SSDs — provided encryption was enabled before data was written and the key destruction is verified. CE is the fastest enterprise-scale Purge available; pair with verification logs to make it audit-defensible.

How quickly can you mobilize onsite destruction?

Same-day onsite destruction is available across major Texas markets (Houston, Dallas, Fort Worth, Austin, San Antonio) for breach response and time-critical engagements. Standard onsite scheduling is 3–5 business days. Mobile shred trucks and crews are dispatched from regional hubs to compress travel time. Pre-arranged engagements (recurring schedules, master agreements) move faster because contracting is already in place.

How do you handle export of e-waste internationally?

TexasITAD does not export restricted e-waste streams (CRTs, mercury-bearing devices, batteries, focus materials) to non-OECD countries. Downstream destinations are documented and disclosable on request. This is the single most common ESG-review question and the answer is in writing, not just on a website. Get this answer in writing from any ITAD or recycler you evaluate. It's a fast tell for downstream rigor.

Is TexasITAD R2v3 or e-Stewards certified?

TexasITAD aligns operations with R2v3 and e-Stewards principles for responsible electronics recycling. We do not claim third-party certifications we do not hold; ask about current certification status before procurement and we'll give you a straight answer rather than marketing copy. Many enterprise RFPs ask for alignment, not certification. Confirm what your evaluation criteria actually require before disqualifying a vendor.

What categories of electronics do you accept?

Servers, networking, laptops, desktops, monitors, mobile devices, copiers/MFPs, printers, POS terminals, AV gear, lab and medical electronics with data-bearing components, UPS systems, batteries (Li-ion, lead-acid, alkaline), cabling, and rack hardware. Specialty items (CRTs, refrigerated equipment) are quoted case-by-case. If you're unsure whether an item is in scope, send a photo and serial during scoping — we'll route it to the right downstream stream.

How do you process lithium-ion batteries safely?

Li-ion batteries are isolated at intake, terminal-protected, packed in UN-approved containers, segregated by chemistry, and routed to permitted battery processors — never landfilled or commingled with general e-scrap. Damaged or swollen cells are quarantined per DOT 49 CFR and EPA Universal Waste rules. Battery handling is one of the highest-risk steps in the recycling chain; ask how any vendor handles damaged Li-ion specifically.

What happens to assets that can't be reused?

End-of-life material is mechanically separated into commodity streams (ferrous, non-ferrous, plastics, copper, precious-metal-bearing boards) and routed to permitted refiners and smelters. Hazardous fractions (CRT glass, mercury, batteries) go to specialized processors. The downstream chain is auditable to final disposition. Downstream transparency separates legitimate recyclers from brokers. Ask for the downstream map before signing.

Do you provide weight-based recycling reports?

Yes. Every engagement closes with a recycling summary by weight and category — total weight processed, reuse versus recycle ratio, hazardous-fraction weights, and landfill diversion rate. Reports feed ESG, CDP, GRI, and SASB disclosures and are traceable back to underlying intake records for assurance review. Request the report format during scoping so it lands in the structure your sustainability team needs.

Can you handle bulk monitor and CRT disposal?

Yes. CRTs and large LCD/plasma displays are processed through permitted CRT processors with leaded-glass handling protocols. Bulk monitor refreshes (school districts, call centers, corporate offices) are common; we coordinate dock logistics, palletization, and freight to minimize handling damage and OSHA exposure. CRT volumes are dropping but still a real ESG and compliance concern for K-12 and government refresh programs.

What's the difference between recycling and ITAD?

Recycling is the end-of-life material processing step — shredding, separation, refining. ITAD is the full lifecycle: secure pickup, chain of custody, sanitization, asset recovery (resale, redeployment), and only then recycling for what can't be reused. Pure recycling skips the value-recovery and security-evidence steps that protect the enterprise. If a vendor only offers recycling, you're paying for the cheapest end of the lifecycle — and missing the parts auditors care about.

Do you charge for electronics pickup?

It depends on the asset mix. High-value fleets (recent laptops, servers, networking) often offset pickup costs through asset recovery, sometimes producing net proceeds. Low-value or hazardous-heavy loads (CRTs, printers, batteries) carry processing fees. Scoping produces a settlement-versus-services estimate before mobilization. Don't choose a recycler purely on free pickup — 'free' often means undocumented downstream and no audit pack.

Are recycling certificates issued separately from destruction certificates?

Yes. Destruction certificates document data sanitization per device or lot; recycling summaries document material disposition by weight and category. Both ship in the engagement audit pack, plus an ESG summary aggregating reuse, recycle, and diversion metrics for sustainability reporting. Two different documents, two different audit purposes — keep them paired in your records.

Are you NIST-certified?

No. NIST publishes guidance and does not certify commercial vendors. TexasITAD is NIST-aligned — workflows align with NIST SP 800-88 Rev. 2 media sanitization guidance. Any provider advertising 'NIST certification' is misusing the term and using it as a marketing shortcut. This is the most common buyer-confusion question. The right phrasing is 'aligned with NIST SP 800-88 Rev. 2.'

What's a certificate of destruction and when do I need one?

A certificate of destruction confirms that data-bearing media was sanitized or physically destroyed using a defined method. You need one for any device that ever held sensitive data — and most enterprise security, audit, and regulatory programs require one per device or per lot, retained for the regulatory window. TexasITAD certificates align with NIST SP 800-88 Rev. 2 method tagging and are tied to the chain-of-custody manifest.

Can you support HIPAA, GLBA, FERPA, FACTA, and PCI DSS engagements?

Yes. TexasITAD provides NIST SP 800-88 Rev. 2 aligned sanitization, serialized chain of custody, and per-asset certificates structured to feed HIPAA, GLBA, FERPA, FACTA, and PCI DSS evidence packages. Mapping documents are included so reviewers can verify any device against any framework without follow-up. BAAs are signed for HIPAA engagements involving PHI-bearing media.

How do you support breach-response disposition?

Breach-response engagements are scoped for speed and defensibility — onsite destruction, witnessed shredding, video documentation, same-day certificates, and an evidence package suitable for forensic and regulatory review. We can mobilize quickly across major Texas markets when timing matters. Don't wait until breach to figure out who handles disposition. Pre-arranged engagements with documented procedures move significantly faster.

What records do you keep about my engagement and for how long?

Manifests, certificates, settlement reports, recycling summaries, and supporting intake records are retained per the engagement's documented retention schedule, defaulting to seven years for regulated industries. Records are recoverable in the original format on request to support delayed audits or breach response. Build retention into the master service agreement so the records are still there years later when you need them.

How does TexasITAD support HIPAA disposition for healthcare?

PHI-bearing media is sanitized per NIST SP 800-88 Rev. 2 with method matched to media class, custody is sealed and serialized from your dock, and per-device certificates feed HIPAA Security Rule evidence (164.310(d)(2)(i–ii)). A signed BAA covers the engagement and OCR-ready documentation is included in the audit pack. Healthcare buyers should default to onsite destruction or sealed offsite with witnessed intake for highest-sensitivity media.

What does a defensible audit pack actually contain?

Pickup manifest, signed transfer records, intake reconciliation report, per-asset sanitization log with NIST SP 800-88 Rev. 2 method tag, per-device or per-lot certificates of destruction, asset recovery settlement, recycling summary by weight and category, and an ESG summary. Indexed, searchable, and retained per the agreed schedule. If your current vendor only ships a one-page PDF, you're missing most of the evidence reviewers ask for.

How do you handle GLBA Safeguards Rule disposition for banks?

Bank disposition follows the GLBA Safeguards Rule and FFIEC IT Handbook expectations: NIST SP 800-88 Rev. 2 aligned sanitization, sealed and tracked custody, written disposition records, and evidence aligned to your information security program. Common for branch refresh, ATM decommissioning, and core-system modernization. Bank examiners care less about which method you used than that you can prove which method was applied to which device.

What does PCI DSS require for retired payment-related media?

PCI DSS Requirement 9.4.6/9.8 requires that media containing cardholder data is rendered unrecoverable when no longer needed — by shredding, incineration, or pulping for hard copy, and NIST SP 800-88 aligned methods for electronic media. Certificates and chain-of-custody are expected evidence during QSA assessment. POS terminals, back-office payment servers, and call-recording systems are common in-scope items often missed by general ITAD vendors.

Do you support Texas state agency and local government disposition?

Yes. Texas DIR cooperative-contract-friendly engagements with serialized custody, NIST-aligned sanitization, and audit packs structured for state records-retention requirements. Common for ISDs, municipalities, county governments, courts, and higher-ed institutions across Texas. If you're procuring under a DIR or BuyBoard cooperative, mention it during scoping so contracting aligns from day one.

How does ITAD documentation feed SOC 2 audits?

Per-device certificates, chain-of-custody records, and retention logs map directly to SOC 2 Common Criteria CC6.5 (asset disposal) and CC6.7 (data transmission and disposal). Auditors expect evidence per disposed asset; our audit pack is structured so a reviewer can sample any serial and trace it end-to-end. If your auditor asks for 'evidence of secure disposal,' the answer is a serialized COD plus the custody manifest — not a recycler receipt.

Are FERPA and student-data records covered for K-12 and higher-ed disposition?

Yes. FERPA-protected student data on retired devices is sanitized using NIST SP 800-88 Rev. 2 aligned methods and documented per-device. Common engagements include K-12 Chromebook refresh, classroom desktop turnover, and higher-ed lab and administrative equipment retirement under district or system-wide cooperatives. Loaner-device programs (1:1 take-home) generate steady disposition volume; build a recurring schedule rather than annual scrambles.

What Texas markets does TexasITAD serve?

TexasITAD operates statewide with primary coverage across Houston, Dallas, Fort Worth, Austin, San Antonio, El Paso, Corpus Christi, Lubbock, Amarillo, McAllen, the Permian Basin, and the I-35 corridor. Pickups in smaller cities are routed through the nearest hub with same-week scheduling for most of the state. Multi-site engagements across Texas are coordinated through one project manager and one audit pack — not a separate engagement per city.

How fast can you schedule a Houston ITAD pickup?

Standard Houston-area pickup scheduling is one business week, with same-week and next-day windows available for breach response or time-critical engagements. The Houston metro is served by a regional hub with multiple crews, so scheduling rarely backlogs even at quarter-end. Energy-sector and Medical Center engagements often run on tight power-down windows; pre-book the dock window during scoping.

Do you cover the Dallas-Fort Worth metroplex?

Yes. DFW is one of our highest-volume regions, with crews based for Dallas, Fort Worth, Plano, Frisco, Arlington, Irving, and surrounding suburbs. Multi-site refreshes across the metroplex are coordinated under one project plan with consolidated reporting at close. DFW data center decommissioning is a routine engagement type given the regional concentration of colocation and enterprise data centers.

How does TexasITAD serve Austin and the Central Texas tech corridor?

Austin engagements are served by a local crew supporting downtown, North Austin, Round Rock, Cedar Park, San Marcos, and the I-35 corridor toward San Antonio. Common engagements include startup and scale-up office consolidation, semiconductor lab equipment retirement, and SaaS data center cage decommissioning. Tech-sector engagements often need fast turnaround on M&A or lease-end timelines; build the pickup window into the move plan early.

Do you serve San Antonio and South Texas?

Yes. San Antonio is served by a regional hub covering the city, New Braunfels, Schertz, the Medical Center district, and engagements south to Laredo and the Rio Grande Valley. Military, healthcare, and cyber-sector engagements are common given the regional industry mix. Engagements involving DoD-adjacent or controlled-information media are scoped for witnessed onsite destruction by default.

What about West Texas — El Paso, Lubbock, Amarillo, Midland, Odessa?

West Texas is served from regional hubs with route-based scheduling — typical pickup windows are 1–2 weeks for El Paso, Lubbock, Amarillo, Midland, and Odessa. Multi-city Permian Basin engagements (oil and gas operators, banks, healthcare systems) are routed under a single project plan to minimize freight cost. Distance doesn't change the audit pack — same custody model, same NIST-aligned sanitization, same evidence package.

Texas IT Asset Disposition & Electronics Recycling for Business

TexasITAD provides secure IT asset disposition, NIST SP 800-88 aligned data destruction, and certified electronics recycling for businesses across Texas — offices, facilities, and data centers only, not residential pickups. Serialized chain of custody, audit-ready reporting, and asset recovery from Dallas–Fort Worth to Houston, Austin, and San Antonio.

Book a Pickup · Call 877-321-ITAD

Certificate of Data Destruction & Certified Electronics Recycling in Texas

Every engagement closes with a per-device or per-lot certificate of data destruction tied to a serialized chain-of-custody manifest and tagged to the NIST SP 800-88 Rev. 2 method applied (Clear, Purge, or Destroy). Certified electronics recycling follows a reuse-first hierarchy with audited downstream accountability and ESG documentation. Review the sample certificate of destruction and certified electronics recycling in Texas.

Certifications

R2v3 Responsible Recycling — responsible downstream processing
NAID AAA — secure data destruction concepts
NIST SP 800-88 Rev. 2 — media sanitization alignment

Texas Metro Coverage

View all Texas markets

Book a Pickup

Schedule a secure, business-only pickup for retired IT equipment anywhere in Texas. Book a Pickup or call 877-321-ITAD.