RecyclicTech Editorial · Published 2026-08-21 · Updated 2026-08-21 · 7 min
ISO/IEC 27001 is a management-system standard. An ITAD operator can implement the Annex A practices that logging, evidence and record protection require long before a registrar issues a certificate number. RecyclicTech does the first of those things on this site and refuses the second until a number can be checked.
The practical output is a hash-chained audit trail against an opaque public reference. Donations mint EDU- codes. Corporate assessments mint RT- codes. There is no public directory of people.
What the log actually stores
Operational facts: equipment categories, origin country, courier, whether a label and tracking number exist, sanitisation method when it has run. Actor identity is stored as a SHA-256 of an email, never the address. Street addresses and names stay on the job row, not on the chain.
Each event records the previous hash, a canonical input string, and the SHA-256 of that string. The table rejects updates and deletes. New facts are new rows.
Controls, not a badge
The live mapping is ISO/IEC 27001:2022 A.5.9 inventory, A.5.14 transfer, A.5.28 evidence, A.5.33 protection of records, A.7.10 storage media, A.8.10 information deletion, A.8.15 logging and A.8.16 monitoring. Opening a trail recomputes the hashes.
Pending stages — received at depot, media classified, sanitisation completed, job pack issued — stay labelled as not yet recorded until the work happens. Pre-writing a destruction certificate is not an audit trail.