Certifications and Compliance
IT Revalue is the ITAD division of PN California, whose primary certification is R2 — the leading standard for responsible electronics recycling and IT asset disposition, held for over 15 years. Under R2, the operation maintains RIOS as its supporting certification. These aren't marketing credentials — they govern specific operational requirements that affect how equipment is processed, how data is destroyed, and how downstream partners are selected and monitored.
R2 certification requires annual third-party audits by an accredited certification body. That means compliance is independently verified every year, not self-reported. Consistent certification over time reflects ongoing operational compliance, not a one-time audit pass.
R2 Certification (Primary)
R2 (Responsible Recycling) is the leading certification standard for electronics recyclers and IT asset disposition companies. The PN California operation behind IT Revalue has held R2 certification for over 15 years. It requires documented processes for data destruction, downstream partner qualification, environmental health and safety management, and equipment testing and tracking. An accredited third-party auditor verifies compliance annually.
Working with an R2-certified provider means every device is processed under a verified framework. The standard specifically addresses how equipment is evaluated, how data is destroyed, and how downstream recycling partners must be qualified and monitored.
RIOS — the supporting standard under R2
R2 requires an accredited environmental, health-and-safety, and quality management system operating beneath it. The operation meets that requirement through RIOS (Recycling Industry Operating Standard) — the supporting certification that previously sat under R2 as an ISO-based system and is now fulfilled by RIOS.
Together, R2 as the primary standard and RIOS as the supporting management system cover the full scope of responsible disposition: data security, environmental management, worker safety, and downstream accountability, all independently audited.
Data Sanitization Standards
Data sanitization follows NIST SP 800-88, the federal standard governing media sanitization. It establishes requirements for logical data sanitization on devices being prepared for reuse, including verified overwriting that defeats forensic recovery. The existing process, using specialized device auditing software, is designed to meet these requirements.
Devices cleared for reuse are sanitized to the NIST SP 800-88 Purge standard with per-device verification. Drives that cannot be sanitized to this standard due to damage or drive type are routed to certified physical destruction.
Environmental Management
Under R2 and its supporting RIOS management system, the operation maintains an environmental management system that requires identifying environmental impacts, setting measurable reduction objectives, and demonstrating continuous improvement through regular audits. For an ITAD company, this governs equipment processing, hazardous material handling, and downstream partner qualification.
IT equipment contains lead, mercury, cadmium, and flame retardants that require controlled handling. These standards govern how the operation identifies, tracks, and reduces those environmental impacts across operations.
Worker Health and Safety
R2 and the supporting RIOS management system integrate an occupational health and safety management system. It requires systematic hazard identification, controls implementation, and ongoing improvement in worker safety outcomes. For electronics processing facilities, it covers equipment containing hazardous materials and the physical risks of high-volume processing.
Electronics disassembly involves sharp components, heavy equipment, and materials requiring protective handling. These standards ensure those risks are systematically identified and controlled under a documented management system that is audited annually.
What Certifications Mean for Your Organization
Working with a certified ITAD provider protects your organization three ways. You get documented proof that data was destroyed under a verified standard. You get downstream recycling that meets recognized environmental requirements. And your compliance and legal teams have an auditable record they can rely on if questions come up.
For organizations subject to HIPAA, GLBA, FERPA, or other data privacy regulations, third-party certification adds a layer of defensibility that a self-reported internal process cannot. Certificates of data destruction are available on request for every engagement.
Request a Buyback Quote
Work with a certified ITAD provider with over a decade of continuous third-party-audited compliance. Submit your equipment list for a no-obligation buyback offer.