Choosing an IT asset disposition vendor means selecting who will handle your retired equipment and data-bearing media, knowing the liability stays with you. Under environmental regulation the generator of the waste retains liability for its eventual handling, and under data protection law the data controller remains accountable for personal data on media it no longer possesses.
A vendor who cuts corners downstream creates exposure that lands back on the organization that hired them, often years later and usually through a regulator rather than through the vendor. This makes vendor selection a due diligence exercise rather than a procurement one, and the difference shows up in what questions get asked.
Which Certifications Should an ITAD Vendor Hold?
Two certification schemes dominate responsible recycling in North America, and either one is a reasonable baseline.
R2, currently in its v3 revision, certifies responsible recycling practices including data security, downstream due diligence, and environmental handling. e-Stewards is generally stricter on export of hazardous waste to developing countries and prohibits landfill and incineration of covered material.
NAID AAA certification addresses data destruction specifically, with unannounced audits of destruction processes and personnel screening. A vendor doing physical destruction of media should hold it; a vendor who only brokers equipment may not.
ISO 14001 covers environmental management systems and ISO 45001 occupational health and safety. Neither speaks to data security, and a vendor presenting them as evidence of data handling is answering a different question than the one asked.
Verify certificates directly with the issuing body rather than accepting a PDF. Certificates lapse, scopes are narrower than they appear, and a certificate covering one facility says nothing about the facility that will actually process the material.
Where Does Retired Equipment Actually Go?
Usually through several downstream processors, and the certification schemes require downstream due diligence precisely because most of the risk sits below the first tier.
A vendor should be able to name their downstream processors, describe what happens at each stage, and produce audit records for them. "We use certified downstream partners" is not an answer; the names and the audit dates are. Material frequently passes through three or four hands before final processing, and each transfer is a point where the chain can break.
Export practices deserve specific questions. Transboundary movement of e-waste is regulated under the Basel Convention and its amendments, and the United States occupies an unusual position as a non-ratifying country, which affects what is permissible and what is merely common. A vendor should be explicit about which countries material reaches.
Ask what percentage of intake is resold versus recycled, and what happens to material that is neither. The answer describes the business model, and the business model predicts behavior under pressure.
Separate the Data Question From the Equipment Question
Disposition covers two distinct risks that often get one contract and one conversation.
For data, the controlling standard is NIST SP 800-88, which distinguishes clear, purge, and destroy and ties the choice to the sensitivity of the data and the intended disposition of the media. A vendor should be able to state which method they apply to which media types and why, and the answer should reference the standard rather than a marketing term.
The decision of whether sanitization happens on site or at the vendor's facility is a risk decision, not a logistics one. On-site destruction means media never leaves in a readable state and the chain of custody is short. Off-site processing is cheaper and introduces a transport leg that needs the same controls as any secure equipment movement — sealed containers, documented handoffs, and a manifest that reconciles at both ends.
Serial-level reporting is the requirement that separates serious vendors from the rest. A certificate that says "one pallet of drives destroyed" is not auditable. A certificate listing every serial number, matched against the serials that left your site, is.
Read the Commercial Terms Carefully
Value recovery and risk allocation are where contracts diverge from the sales conversation.
Resale revenue share arrangements vary widely, and the settlement basis matters more than the percentage. Understand whether the share is of gross or net, what costs are deducted before the split, and how equipment is valued. Ask for recent settlement reports from comparable clients.
Indemnification should cover data breach and environmental liability arising from the vendor's handling, and it should be backed by insurance with limits proportionate to the exposure rather than to the contract value. Request certificates and check that the coverage is current and names the right entity.
Right to audit should be explicit, should extend to downstream processors, and should be exercised at least once rather than held in reserve. A vendor who resists an audit clause during negotiation will resist the audit.
Establish who bears the cost of material with negative value. Equipment worth less than the cost of processing it exists in every estate, and if the contract is silent, that conversation happens after the truck has left.
How Do You Verify an ITAD Vendor After Signing?
Check the first engagement closely, because selection is not finished when the contract is signed. The first engagement is the one that tells you whether the process described in the sales cycle is the process that runs.
Reconcile the serial-level certificate against your own outbound manifest, line by line. Gaps on the first run are informative and correctable. Gaps on the third run indicate something structural.
Where volume justifies it, witness a destruction run. Vendors doing the work properly are generally willing to host it, and an afternoon at the facility answers questions that no amount of documentation will.
Certificates belong with the destruction and recycling record for the engagement. Keep them with the asset records they correspond to. An auditor asking about a specific device in three years is asking a question the paperwork can only answer if the two were connected at the time.