Phones hold more personal data per gram than anything else an organisation owns — mail, contacts, saved credentials, photographs, location history, chat archives. They also get replaced faster than any other device, usually in bulk, usually by a supplier who wants them back quickly.
The default answer is a factory reset. On a modern encrypted handset that is genuinely quite good, because it discards the encryption key. On older devices, on devices with removable storage, and on anything where the reset did not complete, it is not good at all.
We erase and then verify, which is the part a reset never gives you. Each handset produces a certificate carrying its IMEI or serial, so a device you handed to a supplier can be accounted for later.
The Risks This Removes
Resets That Do Not Finish
An interrupted reset leaves the device looking clean and the storage intact. Nothing warns you, because nothing checked.
Locks That Block Processing
A handset still tied to an account cannot be reset or resold. It sits in a box holding its data indefinitely.
No Record Against the IMEI
Without a per-device certificate there is no way to show which handsets were cleared and which merely left the building.
Identify, Erase, Verify, Report, Then Decide
A handset is an asset with a serial number, and it is treated as one from the moment it arrives.
- 01
Identify
IMEI, model and storage recorded per handset as it comes out of the box or the rack.
- 02
Erase
The erasure method the platform itself defines, applied per device rather than as a bulk reset.
- 03
Verify
The handset is confirmed back at a clean state before anything is certified against it.
- 04
Report
A certificate per device carrying the IMEI, plus a summary for the batch it was processed in.
- 05
Trade In, Resell or Recycle
The document is what a trade-in or recycling contract asks for, and it names the handset.
Bulk Processing, Per-Device Evidence
Handsets are processed in racks rather than one at a time, and each one is tracked by IMEI or serial through the whole run. The output is a certificate per device and a summary for the batch, which is what a trade-in or recycling contract needs.
Checked Before It Is Cleared
Before erasure we check lock status, so devices that cannot legitimately be processed are separated rather than discovered later. After erasure we verify the storage, so a device that failed is reported instead of shipped.
The Process, Step by Step
Collect and Log by IMEI
Every handset is recorded against its IMEI or serial at the point it changes hands, so a device can be traced through the whole process.
Check the Locks
Activation locks and management profiles stop a device being processed or resold. They are identified now, not discovered later.
Establish How It Is Encrypted
A modern encrypted handset can be cleared by discarding its key. An older or unencrypted device cannot, and takes a different route.
Erase
The device's own sanitize path where it is trustworthy, an overwrite of the user partition where it is not, and destruction where neither can be relied on.
Verify
The handset is checked after the erase rather than trusted to report honestly. A device that still returns data is failed.
Certify per Handset
One document carrying the IMEI, so the phone on your asset list and the phone on the certificate are provably the same phone.
Handsets and Handhelds We Process
Anything with a screen and a battery that has held company data. If it left the building with an employee, it belongs here.
Phones and tablets
- Android phones, every major manufacturer
- iPhone, including devices with Activation Lock
- Android tablets
- iPad and cellular-enabled tablets
- Dual-SIM and enterprise-issue handsets
- Older feature phones with removable storage
Work devices
- Rugged handhelds and barcode terminals
- Point-of-sale and payment handsets
- Two-way radios with stored contacts
- Smartwatches and paired wearables
- Company tablets used as kiosks
Complications we handle
- Devices still enrolled in mobile device management
- Google or Apple account locks
- Cracked screens that still power on
- Handsets that will not boot at all
- SIM and removable memory cards inside them
Which Method Applies
| Situation | What We Do |
|---|---|
| Modern encrypted handset, unlocked and working | Sanitize the device and discard the encryption key, then verify |
| Older or unencrypted device | Overwrite the user storage, then verify — a reset alone is not enough here |
| Device is locked to an account we cannot clear | It cannot be resold. Storage is destroyed and the certificate records that |
| Device is enrolled in MDM | Enrolment is removed with your authorisation first, or the device is destroyed |
| Handset will not power on | Logic board and storage destroyed — an erase that cannot run cannot be verified |
| SIM or memory card still fitted | Removed, processed separately, and listed on its own line |
What Makes a Handset Erase Trustworthy
IMEI on Every Record
A phone is identified by its IMEI, so the certificate names the exact device rather than a model and a colour.
Verification After the Reset
A factory reset reports success either way. The check is a separate read of the device, which is the part a reset has never given you.
Cryptographic Erase, Explained
An encrypted handset stores everything scrambled. Destroying the key makes it unreadable instantly — genuinely effective on a modern device, which is why we confirm the device really is encrypted before relying on it.
Locks Found Before Resale
An account lock discovered by the buyer is a returned device and a lost sale. It is identified at intake instead.
Destruction Where Erasure Cannot Run
A dead handset still holds readable storage. It is destroyed rather than quietly set aside.
Batch Handling
Built for a fleet refresh: hundreds of handsets, each tracked as its own job so one failure never hides inside a batch.
What You Hold per Handset
The IMEI is what makes a mobile certificate useful. Without it a document describes a model rather than a device, and cannot answer a question about the one phone somebody is asking about.
- Make, model and IMEI or serial number
- Whether the device was encrypted, and whether the key was discarded
- The sanitization method applied
- The verification read and its result
- Any account lock or management enrolment found
- Whether a SIM or memory card was present, and what happened to it
- Start and finish time, and the operator who ran it
- A digital signature, so an edited certificate no longer validates
- iOS + AndroidBoth Platforms, One Process
Each is erased by the method its own platform defines, and both finish with the same document.
- IMEIRecorded Against Every Handset
A serial number is what ties a certificate to a physical device. For a phone that is the IMEI, and it goes on the record.
- 100%Of Handsets Checked After Erase
The device is confirmed back at a clean state before it is certified, not simply sent the reset command and set aside.
- 1 per handsetCertificate, per Device in the Batch
Racks of phones are processed together, but each one carries its own record. A trade-in contract asks about the device, not the batch.
The Standards a Handset Erase Is Run Against
These are the published procedures the work follows, not certifications held by this company.
NIST SP 800-88 Rev. 2
Covers mobile devices explicitly, and accepts cryptographic erase as a Purge method where the device's encryption can be relied on. That condition is the important half of the sentence.
When it appliesThe default reference for handset disposal, and the one an auditor is most likely to name.
IEEE 2883-2022
Defines Clear, Purge and Destruct for flash storage, which is what every modern handset contains, and requires the result to be verified.
When it appliesWhere a recently written policy governs mobile disposal.
DPDP Act, 2023 (India)
Requires personal data to be erased when its purpose ends. A work handset holds contacts, mail and photographs — some of it about people who never worked for you.
When it appliesAny organisation processing personal data of people in India.
GDPR, Article 17 and Article 5(1)(e)
The right to erasure, and the rule that personal data is not kept longer than necessary. A retired phone in a drawer fails the second one before anybody asks about the first.
When it appliesAny organisation holding personal data of people in the EU or UK.
PCI-DSS
Where a handset was used to take payments, cardholder data on it has to be rendered unrecoverable at disposal, and the disposal has to be documented.
When it appliesPayment-taking handsets and point-of-sale devices.
ISO/IEC 27001, Annex A
Its controls on mobile devices and on secure disposal expect a documented process covering equipment that leaves the premises — which describes every handset you have ever issued.
When it appliesOrganisations certified to ISO 27001 or audited against it.
Where People Go from Here
A Factory Reset Does Not Always Erase a Phone
What a reset actually does, when it is enough, and when it is not.
Read moreFlash Storage Sanitization
The memory cards and SIMs that come out of the handsets, handled as their own devices.
Read moreEnterprise IT
Handset refresh as part of a wider asset retirement programme.
Read moreFrequently Asked Questions
Is a factory reset enough on a modern phone?
On a current encrypted handset it is usually effective, because the key is discarded. It still tells you nothing about whether it worked. Certified erasure adds the verification step and the document — which is what you actually need when a device leaves your control.
Do you handle both Android and iOS?
Yes, both, along with tablets on either platform. Method depends on the storage and the platform rather than the brand.
What happens to locked devices?
They are separated and reported. A device tied to an account cannot be processed or resold legitimately, and we will not pretend otherwise.
Can you erase before we hand devices back on lease?
Yes, and this is the right time to do it. Once the handset is back with the leasing company, the certificate is the only record you hold.
Clear a Batch of Handsets
Tell us the volume and the platforms and we will size the job against your return deadline.