On-site destruction, mail-in, free recycling, or wipe and resell: which is right for your retired hardware?
Four ways a hard drive leaves a building. Only two of them end with proof that the data is gone. Here is what each one actually does, what it costs, what you get to keep, and where each one fails, so you can match the option to the data rather than to the price.
Side by side
Scroll sideways on a phone. The first two columns are what we do; the last two are what most retired hardware gets.
| On-site destruction | Mail-in destruction | Free recycling | Wipe and resell | |
|---|---|---|---|---|
| What happens to the data | Storage is physically destroyed in front of you: degaussed and shredded, or disintegrated to 2 mm. | Same destruction, at our facility, within five business days of arrival. | Usually nothing. Most free recyclers resell working drives or wipe them without records; some shred, without proving which. | Drive is overwritten with software, then sold. If the wipe fails, or the drive is an SSD with unreachable blocks, the data ships with it. |
| Who watches | Your own staff, who sign the log. | Nobody from your side; you rely on the seals, the arrival photograph, and the certificate. | Nobody. The drive leaves on a pallet. | Nobody. The vendor’s tool reports success and the vendor trusts the report. |
| Evidence you receive | Signed Certificate of Destruction and a serial-level media log, with two technician names and your witness on every row. | The same certificate and log, plus the sealed-package photograph. | A receipt or a bulk weight ticket, sometimes a generic certificate with no serials. | A per-drive wipe report if the vendor keeps one; often a spreadsheet of what sold. |
| Standards met | NIST 800-88 Rev. 2 Destroy at the High categorization; NSA/CSS 9-12 methods; HIPAA, CJIS, GLBA, CMMC, NERC CIP, DIN 66399 E-5. | Same standards. CUI may travel by tracked carrier under 32 CFR 2002; classified never ships. | Rarely documented. R2 or e-Stewards certification covers the recycler’s environmental practice, not the fate of your data. | NIST 800-88 Clear or Purge if done and verified per device; not Destroy. Not accepted at High for media leaving your control. |
| Cost | Priced per job; small jobs from a few hundred dollars, larger ones per drive. E-scrap up to about 1,000 lb goes with us free; above that, recycling is priced by the pound. | $8 per drive, $59 minimum, label included under 10 lb. | Free, or you are paid a little for the metal. | Free, or the vendor pays you a share of resale. The savings are the data risk. |
| Time | Usually one visit; about 4,000 drives a day per trailer. | Ship this week, certificate within five business days of arrival. | Immediate. That is the appeal. | Weeks to months while inventory sells. |
| Best for | Any regulated data, any volume over a few dozen drives, anything an auditor will ask about. | A drawer of drives, a handful of laptops, small offices, remote sites, suppliers meeting a flow-down. | Hardware that never held data: monitors, keyboards, empty chassis, cabling. | Nothing that held regulated data. Defensible only for Low-impact media with per-device verification. |
| The risk | None to the data; the drive no longer exists. Cost and scheduling are the only variables. | The shipment: mitigated by seals, tracking, and the arrival photograph. | The drive shows up on eBay, at a downstream buyer, or in a breach notification with your name on it. | Morgan Stanley: two decommissions, a wipe-and-resell vendor, unwiped servers with a downstream buyer, about $155 million. |
What it costs, by quantity
Mail-in prices are the published ones. On-site figures are illustrative, using the market ranges from our cost page (a stop charge of about $350 in a next-day metro, per-drive rates that fall with volume); every on-site job is quoted individually and the quote is the price.
| The job | Shred by Mail | On-site (illustrative) | Better value | Notes |
|---|---|---|---|---|
| 10 laptop drives (2.5-inch) | $80. Ten at $8; the box is about 3 lb, so the label is included. | $500 to $550: a stop charge of about $350 plus ten drives at the small-batch rate of $15 to $20. | Six times cheaper by mail. On-site only makes sense if your policy requires your own witness. | |
| 25 desktop drives (3.5-inch) | $245. Twenty-five at $8 is $200; about 35 lb, so the 25-to-50 lb label adds $45. Serial log included at 20 or more items. | $650 to $725: stop charge plus 25 at $12 to $15. | About a third of the cost by mail. Two people can pack 25 drives in twenty minutes. | |
| 50 mixed drives (the mail-in maximum) | About $490. Fifty at $8 plus two boxes under 50 lb at $45 each. | $850 to $950: stop charge plus 50 at $10 to $12. | Mail, narrowly | The gap closes. If anyone will ask who watched, the on-site price buys the witness and the same-day certificate. |
| 20 M.2 or NVMe cards to 2 mm | $240. Twenty at $12; light box, label included. | $650 to $750: stop charge plus 20 at $15 to $20. The 2 mm standard is slower per item on-site. | Solid-state by mail is the clearest case: small, light, and the same disintegrator either way. | |
| 100 drives | Not offered by mail; over 50 data-bearing items is a custom quote. | $1,150 to $1,350: stop charge plus 100 at $8 to $10, about $12 per drive all in. | On-site | Past the mail-in limit, on-site is the option, and the per-drive cost is already below the mail rate. |
| 250 drives | Custom quote. | $2,100 to $2,600: about $8 to $10 per drive all in. Chassis and rails up to about 1,000 lb go with us free. | On-site | One afternoon. Your witness signs the log; the certificate is emailed that day. |
| 1,000 drives (a data center row) | Custom quote. | Roughly $5,500 to $8,000, about $5 to $8 per drive all in, quoted per job. Serials captured against the host; e-scrap removed with weight tickets. | On-site | About 4,000 drives a day per trailer, so a thousand is a morning. |
The rule of thumb
Under about fifty items, mail it: the label is included or nearly so, the certificate is the same, and the per-item price is lower than any truck can match on a small count. Over a hundred, bring the truck: the stop charge spreads thin, the per-drive rate falls under the mail rate, your own witness signs every row, and we haul the chassis. Between fifty and a hundred, the prices are close, and the decision is about the witness: if a HIPAA officer, a CJIS auditor, or an assessor will ask who watched, the on-site price buys that answer.
What moves the on-site number
- Distance. Next-day metros carry the lowest stop charge; extended-range sites add travel.
- The standard. Solid-state media to 2 mm runs slower per item than a magnetic drive through the shredder; a rack of SSDs is priced differently from a rack of hard drives.
- Site access. A dock with power and a badge process ready is a shorter day than a walk-up through three doors.
- E-scrap. On any on-site job we take the e-scrap with us free of charge up to about 1,000 lb: chassis, rails, boards, cables, monitors, and the rest of the closet. Above that, recycling is priced by the pound on the quote, because loading, hauling, and processing a truckload is labor, and we bring the box truck. We do not pay for scrap. Businesses that do are built around volume and low-cost labor; ours is built around security and technical judgment, and the two models do not mix.
- Staff time on your side. Mail-in costs you about a minute a drive to pack; on-site costs a witness for the duration. Both are real, and both are smaller than the cost of a drive that was never destroyed.
On-site destruction
The truck comes to your dock. Your staff carry the media out, watch it go through the degausser and the shredder or the disintegrator, and sign the log. The certificate lists every serial. Nothing with data on it leaves your property intact, which is why this is the only option that fully satisfies HIPAA, CJIS, CMMC, and NERC CIP auditors without a follow-up question. It costs more than the other three because a truck, two technicians, and three machines come to you; for jobs over a few dozen drives the per-drive price falls quickly, and we take up to about 1,000 lb of e-scrap with us at no charge. The services. What it costs.
Mail-in destruction
The same machines and the same certificate, for quantities too small to bring the truck. You pack the drives, ship with the prepaid label, and we photograph the sealed box, log every serial, destroy, and email the certificate within five business days. The trade-off is that nobody from your organization watches; the seals, the tracking, and the arrival photograph stand in for the witness. That is enough for HIPAA, GLBA, and CUI under NIST 800-171, and it is what a small supplier uses to meet a prime's flow-down. Classified media never ships. Shred by Mail.
Free recycling
Free recycling is a fair deal for hardware that never held data: monitors, keyboards, empty chassis, cable. For drives it is a bet. Most recyclers make their money reselling working equipment, so a drive that spins is worth more to them whole than shredded, and the certificate you receive, if you receive one, usually covers weight, not serials. R2 and e-Stewards certifications, which many recyclers advertise, govern environmental handling; neither one promises that your data was destroyed. The FBI's own Inspector General found drives with no serial record leaving field offices for a shredder, and those were going to the FBI's own facility. What the audit found.
Wipe and resell
Overwriting a drive and selling it recovers the most value, which is why so many vendors offer it. NIST 800-88 Rev. 2 accepts it as Clear or Purge when the technique matches the media and every drive is verified, and that is where it breaks down in practice: an SSD's spare blocks are unreachable by an overwrite, a tool reports success on a drive that later reads fine, and the per-device records that make a purge defensible are expensive to keep at scale. Rev. 2 does not accept it as Destroy, and at the High categorization it is not accepted for media leaving your control. Morgan Stanley hired a vendor to wipe and resell two data centers' worth of servers; unwiped units reached a downstream buyer, and the total came to about $155 million. The case. Why we never resell whole devices.
How to choose
Did the media ever hold regulated or confidential data?
If yes, it needs destruction with a serial-level record: on-site or mail-in. If it never held data, free recycling is fine.
How much is there?
Under about fifty items, mail it. Over that, or anything an auditor will ask about, bring the truck; the per-drive cost drops and your own witness signs the log.
Will anyone ask for proof?
A HIPAA officer, a CJIS auditor, a CMMC assessor, a regional entity, a bank examiner: if any of them might, choose the option whose evidence is a serial number, not a weight ticket.
Is resale value the reason?
Run the numbers on the per-device purge records first. For most organizations the labor of a defensible wipe costs more than the drives sell for, which is why we destroy the storage and recycle the rest.
Questions
Is a certificate from a free recycler good enough for an audit?
Only if it lists each drive by serial number and states the method and equipment, and most do not. A weight ticket proves you gave up some metal; it does not prove which drives were destroyed or that any were.
Can we wipe drives ourselves and then recycle them for free?
You can, and NIST 800-88 Rev. 2 permits Clear or Purge for media that stays under your control or holds Low-impact data. The work is keeping a per-device record of the tool, its version, the verification, and the failures. Most organizations find that record costs more to keep than destruction costs to buy.
Why is on-site more expensive than mail-in for the same drives?
Because the truck, two technicians, and three machines come to you, and your witness signs every row. Per drive, on-site is cheaper than mail-in once the count is in the hundreds; below about fifty, mail-in is the better value.
Does free recycling at least keep the drive out of a landfill?
Usually, and that is its value. It says nothing about the data. A recycler can be R2-certified and still resell your drive whole, because R2 governs environmental handling, not sanitization.
More answers on the FAQ.