Security at IQValidate

Your wipe records are business records. Here is what controls who can see them, and what the agent does and does not send.

Security Features

Encryption

Connections to the website and API use HTTPS. Stored client credentials are encrypted before they are saved.

Access Control

Roles (Admin, Operator, Auditor, Viewer) decide who can start wipes, change settings or only look.

Activity Log

The activity log shows who did what in your organization, so you can review changes.

Infrastructure

Hosted in the cloud, so there is no server for you to run. Ask us about hosting details.

Data Isolation

Each organization only sees its own records. The one public page is the certificate check, which needs a verification code and hides most of the serial number.

Authentication

Sign-in goes through IQAuth, which supports single sign-on. Ask us about multi-factor options for your account.

Standards We Write Records For

IQValidate does not certify you against any of these. It gives you records to show your auditor.

NIST SP 800-88

Guidelines our wipe records refer to

R2

Responsible recycling: records for your auditor

NAID

Data destruction: records for your auditor

GDPR

Data protection: proof a drive was wiped

How It Works in Practice

Who can see what

Four roles: Admin, Operator, Auditor and Viewer
Every record belongs to one organization
Sign-in is handled by IQAuth
Agents link to your organization with their own key

What the agent sends

Drive serial number, make and model
Method, progress and read-back result
Start and finish times and the operator
Not the contents of your drives

Checking a certificate

Each certificate has a verification code and QR code
The public check page needs only that code
It shows the serial number partly hidden
A SHA-256 fingerprint of the facts is printed on the certificate

Ask us for details

Hosting and backup arrangements
How long records are kept
Security questionnaires for your review
Reporting a problem you found

Vulnerability Disclosure

We take security seriously and appreciate responsible disclosure of vulnerabilities.

If you discover a security vulnerability in our platform, please report it to our security team. We commit to:

Acknowledging your report
Providing regular updates on our investigation
Fixing verified issues
Crediting researchers who report valid vulnerabilities

Report vulnerabilities to: security@dispositioniq.com

Security Questions?

Need a security questionnaire answered or a review for your own process? Get in touch.