Is onsite hard-drive destruction worth the premium over offsite?

Recycle Bridge publishes both routes for Toronto and the Greater Toronto Area, which makes the premium easy to see. The onsite service starts with a CA$250 service call and certification charge. That covers travel within the service area, equipment setup, destruction witnessed at your location and a signed Certificate of Destruction. Each hard drive or solid-state drive then costs CA$40. The offsite service starts with a CA$65 pickup and certification charge and costs CA$25 per drive, with destruction at the provider's facility. The page's own onsite example is 10 drives for CA$650.

So the premium has a fixed part and a per-drive part. You pay CA$185 more for the visit however many drives you have, and CA$15 more for each drive.

The fixed CA$185 is spread over fewer drives on a short list. Over five drives it adds CA$37 to each one, and over 40 it adds about CA$4.63. A short list therefore pays the highest premium per drive and the lowest premium in total. The page doesn't mention tax, so these totals leave it out. Recycle Bridge says special pricing may be available for orders of 50 or more drives, so a larger job is worth a quote.

These are one provider's prices. Carbon Neutral Shredding, another Toronto-area provider, lists $10 per hard drive destroyed in front of the customer, without naming a currency, with emailed before-and-after photos. It may charge extra when a drive has to be removed from a machine. Greentec and other full-service providers price by quote. To see the premium in a quote, ask for both routes on the same drive count. Have the visit or minimum charge, the per-drive charge, any labor to remove drives from equipment, and the container and transport charges listed separately.

The premium removes the trip. Greentec's hard drive destruction guide describes both routes. Onsite, technicians destroy the drives before anything leaves the premises, and your staff can witness it. Offsite, the drives are picked up in sealed containers under documented chain-of-custody procedures. They travel in GPS-tracked vehicles to a certified facility with industrial-scale equipment, and the pickup and transport are documented with dates, locations, asset counts and handler identification. Paying for onsite means there is no period when intact drives sit outside your building in someone else's custody.

NIST SP 800-88r2 treats that period as a real decision factor. It lists on-site versus off-site work among the things to weigh, and it notes that losing control of media holding certain sensitive data can amount to a data breach. The same guideline gives the example of media transported securely to a maintenance provider under a contract that specifically protects the information's confidentiality, and treats that media as still under the organization's control. So a trip doesn't have to mean losing control. Offsite can be a sound route when your policy approves the method and your risk assessment accepts the contract terms and custody records. Onsite takes the transport leg out of that assessment.

If you require NAID AAA certification, check the endorsement that matches the route. A mobile job needs a Mobile Operation Endorsement that names your media, and a plant job needs the facility-based endorsement for the plant that receives the drives. Under either one, i-SIGMA's manual requires a provider with the hard-drive endorsement to give you a written process description before the job. It also requires a serial-number log returned afterward unless you opt out.

Paying for onsite doesn't by itself buy a better method. NIST cautions that some destructive techniques become ineffective as data density and component hardness increase, and that pulverizing and shredding "should be avoided for anything but the lowest security categories of data." That caution is about the method, so it applies to a truck and a plant alike. Methods can also differ between routes. Recycle Bridge's onsite service crushes drives mechanically and shreds M.2 drives, so ask what each line of a quote does to the drive. Settle which method your policy approves for the data, and then compare locations.

The premium doesn't buy a complete count either. Witnessing shows what happened to the drives that reached the machine. A drive that never reached it shows up only when you reconcile the returned serial log against your own inventory, and that step is the same on both routes. NIST's sample sanitization certificate records the make, model, serial number, method and date for each device, which is the level of detail reconciliation needs.

Where a contract or policy bars intact media from leaving the site, the premium is a cost of compliance. Offsite is ruled out, so the useful comparison is between onsite quotes.

Sensitive drives with no rule against transport are the judgment call. Set the quoted premium beside what the offsite quote commits to in writing: sealed containers, tracking, custody records and a reconciled serial log. On the rate card above, that premium is CA$365 on 12 drives. If your risk assessment accepts those controls, the offsite route does the job for less. If it doesn't, the premium is what it costs to take the trip out of the job. The serial log still needs reconciling on either route.

Volume pushes toward offsite. The premium grows by CA$15 with every drive and reaches CA$785 at 40, so a large decommission is where offsite saves the most. That only helps when your policy lets the drives travel, because volume doesn't override a custody rule.

Working drives in equipment you could resell are a different case, because shredding them gives up whatever the equipment would resell for. Greentec's secure destruction page says remarketable devices are resold after erasure, with rebate value that can be passed back to the customer, and that destroyed assets return no recovery value. That loss is the same on either route. NIST makes the matching point about drives that won't be reused because they're damaged or obsolete: for those, destruction may be the simplest and most cost-effective method.

Suppose an Ontario company is retiring 80 working laptops and 12 failed server drives. Its policy approves shredding for the data on those drives and requires failed drives to be destroyed before they leave the building. It permits working laptops to travel in sealed containers for erasure. The 12 failed drives go on the onsite list and the 80 laptops go to the plant.

Greentec's certified shred article says devices are shredded at its plant or on-site with its mobile shredder. Its secure destruction page says working devices are wiped with licensed software and any device that fails the wipe is shredded. Greentec prices by quote, so the company would request a quote with three lines. The first is the mobile shredder visit for the 12 drives. The second is the same 12 drives shredded at the plant. The policy rules that route out, so the second line is there only to show what the rule costs. The third is pickup, erasure and reporting for the laptops.

The difference between the first two lines is Greentec's onsite premium for this job, and the split confines it to 12 drives. The quote should also say how the rebate on resold laptops is calculated and what's charged when a laptop fails its wipe and is shredded.

After the visit, the records let the company check both halves. Greentec says its certificate of destruction lists the time of destruction and the make, model and serial number of each device, so the company can match it to its list of 12. The erasure report gets matched to the list of 80, and any laptop that failed its wipe should appear among the destroyed devices.

Under this policy the company pays the premium, because the failed drives can't leave the building. Under a policy that let them travel, the same figure is what it would weigh against Greentec's sealed containers, tracked vehicles and plant records.