Secure Drive Transport

Secure drive transport is the physical movement of data-bearing drives and media between locations under controls that prove nothing was lost, opened or swapped on the way. We carry client-encrypted media in locked, sealed cases with bonded couriers, GPS tracking and a signed record at every handoff. We never access the data on the drives.

When do you need secure drive transport?

You need it whenever data-bearing media leaves a controlled space. Common cases are moving production drives to a new data center, sending media to an off-site vault, returning drives from leased equipment, and shipping retired drives to a destruction facility. In each case the drives are out of your building and out of your direct control, so you need evidence of who had them, when, and in what condition. Regulated organizations need that evidence for audits. Healthcare providers, for example, must keep records of the movement of hardware and electronic media under the HIPAA device and media controls, and card-processing environments follow the media handling requirements in the PCI Security Standards Council data security standard. Our job is the physical side: sealed containers, vetted couriers, tracking and documentation. Your compliance team decides which rules apply. The guide to secure drive transport, encryption and custody explains how the pieces fit together.

Does DataTech encrypt or verify the drives?

No. Encryption is your IT team’s responsibility, and we never access, unlock or test the drives we carry. Before pickup, your team confirms that each drive is protected by hardware encryption (self-encrypting drives) or software encryption such as BitLocker or LUKS, and gives us a written attestation listing the serial numbers. We record that attestation on the chain-of-custody record and carry it with the shipment. That keeps the two jobs clear. Your team owns the state of the data. We own the physical custody of the media from the moment it is sealed until the recipient signs for it. If a drive is not covered by your attestation, we flag it before loading so your team can decide whether to ship it, hold it, or send it for drive destruction instead. This split matters in an audit: the record shows exactly who was responsible for each control, with no assumptions about what a courier checked.

How is media protected in transit?

Drives travel in locked, foam-lined hard cases closed with serialized tamper-evident seals. We record each seal number against the drive serials inside. Couriers are insured and background-checked, and vehicles are GPS-tracked from pickup to delivery. For high-value or high-risk shipments, a security escort can add 24/7 physical surveillance in transit. Every change of custody is a signed handoff, and stops on the route, including any overnight stop, are planned before the move. Drives bound for destruction travel the same way as production drives, because their data is just as exposed until they are shredded.

Control	What it proves
Serial-number manifest	Which drives were shipped
Encryption attestation	Your team confirmed encryption
Serialized seals	Cases were not opened
GPS tracking	Route and timing
Signed handoffs	Who had custody, and when

Together these records give an auditor a complete picture without anyone needing to see the data itself.

What happens at delivery?

The recipient’s identity is checked against the names on the shipping record. The courier and recipient inspect each seal together and compare seal numbers to the record. Cases are opened, drives are counted, and serial numbers are matched against the manifest. If everything matches, the recipient signs and the record is closed. If anything does not match, such as a broken seal or a missing serial, the courier documents the exception with photos before anyone moves the drives again, and your team is told straight away. Any functional testing of the drives is done by your IT team or the receiving party, not by us. A blank chain-of-custody form shows the fields we capture at each step. The completed record, with photos and signatures, goes to you for your audit files and stays available for later review.