Serial Xtractor™
Automated chain of custody for ITAD.
Scan. Xtract. Destroy. Every serial read in under a second, onto an append-only record.
Ten seconds a device becomes under one. The audit evidence writes itself.
For ITAD providers, shredder manufacturers and data centers.
- Xtraction
- < 1 second
- With an asset list
- 100% accurate
- Connectivity
- Online or offline
- Chain of custody
- Append-only record
Who it is for
Four operations, one record
The obligation looks different depending on where you sit. Pick the one that is yours.
ITAD operators
You carry your client's obligation. The record you hand over is the product.
OEM and equipment
Your customers are being asked to evidence every device. Build the answer in.
Data centers
Decommissioning your own estate. The reconciliation is the hard part.
Auditors
What to ask an operator for, and what a good answer looks like.
The problem
Chain of custody in ITAD is slow, manual, and recorded after the fact.
“What we thought would take us a few hours took all day!”
What a failure costs
- The United States average cost of a data breach in 2026 — more than twice the global figure
- $11.5M
- To identify and contain a breach that came through the supply chain
- 258 days
- What supply-chain compromise adds to a breach — the largest amplifier in the study
- +$227,250
To your client, an ITAD vendor is the supply chain in those two figures — the costliest amplifier IBM measured, and its second most common way in.
IBM Cost of a Data Breach Report 2026, published 29 July 2026, covering 602 organizations breached between March 2025 and February 2026.
Serial Xtractor captures the evidence at the moment it happens and writes it to an append-only record — automatically, in under a second. One device, one serial, from the rack to the cutting head.
Per job
What it costs you on a real job
A job runs between 300 and 1,000 devices depending on the client. Here is the same job, done both ways.
A barcode scanner is six seconds a device at best and ten at typical. With an asset list — which your client almost always supplies — a match confirms in one second, and that is the whole cycle. Without a list the serial is still extracted in one second; the operator review window is yours to configure.
For a mobile operator working to a client's site window, hours are the constraint that decides how many jobs fit in a week.
Work it out
What does your current process cost you?
Put in your own volume and time estimate. For recording only — handling and destruction take what they take.
- 5.6
- Hours a week, currently
- 0.6
- Hours a week with Xtractor
- 5.0
- Hours saved, every week
Xtractor is calculated at a flat one second per device against an asset list. Measured times are under that.
Why we built it
There has to be a better way
- ~10 sec
- per device with a barcode scanner
- ~360
- devices an hour at that rate
- By eye
- the serial picked off a crowded label by a technician
We've spent decades handling sensitive information and chasing phantom breaches. We know what a chain of custody has to survive.
So we built Serial Xtractor™
- < 1 sec
- serial number xtracted
- Up to 3,600
- devices an hour, same station
- 100%
- identified against an asset list
With an asset list, a match records itself. Immediately. 10x devices throughput, in the same hour, with the same technician.
It's still wrong that chain of custody for ITAD operations comes down to a handheld barcode scanner and a spreadsheet. We set out to end this slow manual process.
Barcode scanner timings are collected from openly published figures for comparable ITAD scanning systems. Our own timings are measured against a variety of device types from capture to serial number identification.
Deployments
Built for how ITAD and data centers actually run
One model, six ways to run it.
However assets move through your site — a bench, a shredder, a conveyor, or a van out on a collection — there is a way to capture the serial without adding a step to the job.
The fail-safe
Automated — not unsupervised
The serial shows on screen before it writes. Your operator gets a configurable timeframe to review. Say nothing and it writes itself.
- Against an asset list, an exact match writes immediately
- Anything unexpected or duplicated waits for technician review
- Every scan keeps its image and its xtraction
- Written to an append-only record
What rests on the record
A system your client's auditor can trust. Not just a record.
A spreadsheet can meet every line below. The difference is the evidence — made at the device, per device, in under a second.
| Standard | Asks for | With Serial Xtractor |
|---|---|---|
| NIST SP 800-88 Rev. 2 · §4.6 | A certificate of sanitization for each item | Partly recorded: One certificate per job, a line for every device |
| NIST SP 800-88 Rev. 2 · §4.6 | The serial number, per item | Recorded by Serial Xtractor: Read from the label in under a second |
| NIST SP 800-88 Rev. 2 · §4.6 | Verification — each item checked and recorded | Partly recorded: Each device recorded with its time and capture |
| R2v3 · Appendix B(2) | Traceability for each device * | Recorded by Serial Xtractor: Per device, on an append-only record |
| R2v3 · Appendix B(15)(b) | Processed matches received | Recorded by Serial Xtractor: Matched, missing and unexpected — by serial |
| NAID AAA · 4.3 | Every drive serial, logged and returned † | Recorded by Serial Xtractor: A per-device log on the certificate, sent to the client |
Every scan writes to an append-only record
A record is written once and never rewritten. A correction after the event is a new entry beside the original, not an overwrite.
That is the difference between a chain of custody and a spreadsheet.
Serial Xtractor is not a certification. It produces the per-device evidence those standards demand, automatically.
Get in touch to find out more- Recorded by Serial Xtractor
- Partly recorded
NIST SP 800-88 is guidance. * R2v3 also accepts “tracking through other means”. † Unless the client opts out. The full matrix, with sources
The certificate
The record that matters
Compliant evidence of destruction is what your client needs.
Generated in a single click, with your brand.
- Device serial, model and type
- Destruction method, date and time
- Totals by category
- An image of every asset
- Your branding, not ours
What changes
The job that took all day takes a couple of hours
Same team, same equipment, same client.
- Job running later than anticipatedFinished, and onto the next job
- A discrepancy that means back to square oneAsset manifests that match — searchable, auditable, append-only
- One job per day, turning work downOn to the next job with hours to spare
- A scanner and a spreadsheetA process your auditor would recommend
Where it stands today
Live with customers — the tablet in production, the iOS app in beta — and open for business.
We are taking on new ITAD and data center operations now, and talking to equipment manufacturers and ITAD ERP vendors about building this in.
Early customers shape what gets built next.
We're on a mission to bring automation to ITAD
Interested in hearing more, or got something you'd like to talk through? Get in touch.