How to choose an ITAD vendor comes down to five checks: a current facility-level certification you can look up yourself, a written data destruction method with serial-level certificates, a downstream chain they will disclose, insurance that covers your equipment, and documents that match your inventory. The 12 questions below help you test each one before you sign.
Each question comes with why it matters and what a good answer sounds like. You can also paste the list into an email to every vendor on your shortlist. The page works the same whoever you end up hiring. If you're new to the process, start with our guide to IT asset disposition.
How to choose an ITAD vendor in five checks
The EPA recommends using a certified electronics recycler, and it names two accredited standards, R2 and e-Stewards. That is the first filter, but only the first. The other checks are about proof you can hold in your hand.
- Certification: A current R2v3 or e-Stewards certificate for the facility that will actually process your equipment.
- Data destruction: A written method for each type of media, and a certificate of destruction by serial number.
- Downstream: A chain of downstream vendors that the provider qualifies, tracks and will tell you about.
- Insurance: Policies that cover your equipment and the risks of the job, shown on a certificate of insurance.
- Documents: Reports you can reconcile line by line against your own inventory.
If a vendor passes all five, it is worth a closer look. The questions below let you test each check in writing, and they slot into the wider IT asset disposition process from inventory to close-out.
The 12 questions to ask an ITAD vendor
These are the questions to ask before you choose an ITAD vendor or e-waste recycler. Send them in writing and ask for written answers. A vendor that answers quickly and specifically usually does this work every day. Vague answers, however, are information too. Together, the answers are the practical side of how to choose an ITAD vendor.
1. Which certifications do you hold, and which facility do they cover?
ITAD certifications to look for: R2v3 and e-Stewards certify electronics recyclers. NAID AAA, run by i-SIGMA, certifies data destruction providers. One recognized recycler certification is the usual baseline.
Why it matters: R2v3 is certified per facility, so a vendor can hold a certificate for one site and still process your equipment at another.
A good answer names the standard, the facility address and the certifying body, and comes with a copy of the certificate. You can see our R2v3 certification as an example of what to ask for.
2. Can I verify the certificate myself?
Yes, and you should. Ask for a copy, then check the facility name, address, expiry date and scope. On an R2v3 certificate, the scope lists the process requirements audited at that site, such as Appendix B for data sanitization. e-Stewards and i-SIGMA both publish directories of certified companies.
Why it matters: Logos on a website are easy to copy, but a listing in a public directory isn't. The EPA page also points to ANAB, which accredits the bodies that issue these certificates.
A good answer includes a certificate number and the name of the body that issued it, so you can check both.
3. How will you sanitize or destroy each type of media, and to what standard?
Why it matters: Hard drives, SSDs, phones and tapes need different methods. NIST SP 800-88 Rev. 2, finalized in September 2025, is the current federal guidance. Under R2v3, a recycler that wipes drives for reuse needs Appendix B on its certificate.
A good answer names a method for each media type, says when drives are wiped for reuse and when they are physically destroyed, and offers on-site destruction if your data can't leave the building. Our guide to data destruction methods explains the difference.
4. What will the certificate of destruction list?
Why it matters: A single certificate for a whole truckload proves very little. If a client asks about one laptop, you need to find its serial number.
A good answer is a certificate that lists each device by serial number, with the method, the date and who did the work. Ask how long it takes to arrive and whether it costs extra, and ask for a redacted sample before you book.
5. How do you track equipment from my site to final disposition?
Why it matters: Chain of custody is the record of who had each device, where and when. Gaps in that record are where devices go missing.
A good answer describes a signed pickup record, scanning at intake, separate secure handling for data devices, and a final report you can match against your own inventory.
6. Who are your downstream vendors, and how do you check them?
Why it matters: Few recyclers process every material themselves, so circuit boards, batteries and glass often go to specialist downstream vendors. R2v3 requires certified recyclers to qualify their downstream vendors and track material to final disposition, or to the first R2v3 facility when the chain is registered with SERI.
A good answer explains how they run a downstream vendor audit and whether they will share the vendor list with you.
7. Do you subcontract or broker any part of the job to another ITAD vendor?
Why it matters: Some ITAD companies are brokers. They collect equipment and then pass it to someone else for transport, destruction or resale. Every handoff is another link in the chain.
A good answer says plainly which steps they do in-house and names any subcontractor, so you can check that company too.
8. What happens to equipment with resale value, and how is value shared?
Why it matters: Newer laptops, servers and networking gear can be worth something. Vendors handle this in different ways. For example, some buy equipment outright, while others share resale value after costs.
A good answer explains the model in writing before the pickup and promises a settlement statement listing what was sold.
9. What insurance do you carry, and will you send a certificate of insurance?
Why it matters: If a truck is in an accident or a drive goes missing, insurance decides who pays. Common policies include general liability, commercial auto, pollution liability and cyber or professional liability. R2v3 requires pollution liability cover for facilities that manage negative-value material streams.
A good answer is a current certificate of insurance that names your company as certificate holder. Then check the policy types and dates yourself.
10. What are you responsible for if data is recovered from my equipment?
Why it matters: Hiring a vendor doesn't hand off your own duty to protect customer data. The contract's liability and indemnity clauses decide what happens if something goes wrong. Healthcare organizations also usually ask for a business associate agreement.
A good answer is a contract your legal counsel has read and is comfortable with. This guide isn't legal advice, so have counsel review the terms.
11. What does the quote include, and what costs extra?
Why it matters: A low or free quote can leave out the parts of the job you need most. Collection, de-installation, on-site destruction and a few items such as some batteries and bulbs are often priced separately.
A good answer is a written quote that lists what is included and names any item with a fee. Still, free collection isn't a warning sign by itself. Many recyclers collect standard equipment free because its material and resale value covers the work.
12. Can you handle our timeline and site?
Why it matters: Lease returns and move-out dates don't move. Neither do building rules on loading docks, elevators and after-hours access.
A good answer confirms the date in writing, asks about access and floors, and tells you who will be on site. For the steps your own team should take before pickup day, use our commercial e-waste compliance checklist.
ITAD vendor red flags
These red flags come up often when you choose an ITAD vendor. One on its own isn't always a reason to walk away, but it is a reason to ask more questions.
| Red flag | Why it matters | What to ask instead |
|---|---|---|
| Says "certified" without naming a standard or facility | The claim can't be checked | Which standard, which facility and which certifying body? |
| The certificate has expired or covers a different site | Your equipment may go somewhere that wasn't audited | Where exactly will my equipment be processed? |
| Won't name downstream vendors | You can't tell where material ends up | How do you qualify and track downstream vendors? |
| One certificate for a whole load, with no serial numbers | You can't prove what happened to a single device | Can you certify destruction by serial number? |
| No written destruction method | You can't compare it with NIST guidance | Which method do you use for each media type? |
| "We export for reuse" with no paperwork | You can't confirm the equipment was reused | What documents show reuse and final disposition? |
| No certificate of insurance | You may carry the loss if something goes wrong | Can you send a current certificate of insurance? |
| Cash offered for everything, with no inventory | The offer may not match what was collected | Can you give me an itemized settlement statement? |
| A junk hauler with no CEWID or recycler approval | Your electronics may never reach a recycler | What is your CEWID, and who recycles the equipment? |
ITAD vendor selection checklist
Print this ITAD vendor selection checklist and fill in one column per vendor. Mark yes, no or unclear, then note what each vendor sent you. The vendor with the most clear, written answers is usually the safer choice, even if it isn't the cheapest. If an auditor later asks how you chose an ITAD vendor, the completed scorecard is your answer.
| Question | Vendor A | Vendor B | Notes |
|---|---|---|---|
| Certification named, with facility and certifying body | |||
| Certificate checked in a public directory, in date, scope fits | |||
| Written method for each media type | |||
| Certificate of destruction by serial number, sample seen | |||
| Chain of custody from pickup to final report | |||
| Downstream vendors qualified and disclosed | |||
| Subcontractors named, or none | |||
| Resale model explained in writing | |||
| Certificate of insurance received and checked | |||
| Contract reviewed by counsel | |||
| Written quote with fee items named | |||
| Date and site access confirmed |
What official rules say about picking an ITAD vendor
Official guidance on how to choose an ITAD vendor, or any disposal company, points the same way. The FTC Disposal Rule, which covers consumer report information, gives examples of reasonable steps when you hire a disposal company. They include reviewing an independent audit of the company, checking references and requiring certification by a recognized trade association or similar third party.
In California, Civil Code 1798.81 requires businesses to take reasonable steps to dispose of customer records by shredding, erasing or otherwise making the personal information unreadable. The duty sits with your business, so the vendor's documents become your evidence.
How Dream E-Waste answers these ITAD vendor questions
If you need to choose an ITAD vendor in San Diego County and Dream E-Waste is on your shortlist, send us these questions and ask for written answers. A few are simple, so we answer them here. We are R2v3 certified, with CalRecycle CEWID 127772. Every data-bearing device we receive is wiped and data-destroyed by default.
Business customers get a standard certificate of destruction that lists serial numbers. It is included and takes 3 to 5 business days. Pickup is free for 5 or more computing devices. Large volumes need approval first, and for clean-outs or office equipment we ask for photos before we book. Read more about our IT asset disposition in San Diego.
Frequently asked questions
Do I need a vendor with both e-Stewards and R2v3?
No. One recognized recycler certification is the usual baseline, and R2 and e-Stewards are the two accredited standards the EPA names. Some organizations prefer one in their policy, so check yours first. What matters more is that the certificate is current and covers the facility that will process your equipment.
Is NAID AAA certification required by law?
No. NAID AAA is a voluntary certification from i-SIGMA for companies that destroy data, backed by scheduled and unannounced audits. No law requires it, but some clients and contracts do. If your contracts mention it, look up the vendor in the i-SIGMA directory before you sign anything.
Should I visit an ITAD vendor's facility?
Yes, if you can, especially for recurring work. A visit shows you how equipment is received, how data devices are kept apart and secured, and how drives are logged. Ask to see intake and the area where drives are wiped or destroyed. In general, a vendor that does this well is glad to show you.
Is a free ITAD offer a red flag?
Not by itself. Many recyclers collect standard business equipment free because its material and resale value covers the cost. Ask what is excluded, which items carry a fee and which documents come with the free service. However, a free offer with no certificate of destruction or asset report is the real warning sign.
How often should we re-check an ITAD vendor?
At least whenever a certificate or a contract renews. That's because certificates expire, facilities change and downstream vendors come and go. Ask for the current certificate, the latest certificate of insurance and any changes to the downstream chain. Keep the answers in your vendor file so the next review is quick.
