ITAD · R2v3 Facilities

Audit-ready every day, not the week before.

ItemStage runs your processing floor as a serialized, evidence-gated workflow — so the custody record your R2v3 auditor asks for is produced by doing the work, not assembled from spreadsheets afterward. Built per facility, priced per facility, exactly like your certificate.

Book an Audit-Readiness Conversation The State of R2v3: Our 2026 Data

20 minutes, no demo unless you ask for one. We're talking to facilities about how audit evidence actually gets assembled — the conversation is useful whether or not you buy anything.

The problem

A certification you can't cram for.

R2v3 surveillance audits recur every year, recertification every three — and some audits arrive unannounced. A facility can't prepare for an inspection it doesn't know is coming. It can only run a process that is continuously audit-ready.

The evidence burden is the job

Serial-level custody records, sanitization evidence per device, sampling verification, downstream due-diligence files — the paperwork an auditor reviews is a parallel production line on top of the real one.

Spreadsheets don't enforce anything

A tracking sheet records what someone remembered to type. It doesn't stop a drive from shipping before its sanitization record exists, and it can't prove the record wasn't edited later.

Assembly under pressure reads badly

Evidence pulled together in the week before an audit is exactly as convincing as it sounds. Records generated at the moment of work, with server timestamps, are a different conversation.

What ships today

Enforcement, not reminders.

Every capability below is live in the product and enforced at the database layer — gates fail closed, records are append-only, and there's no quiet override.

Serialized, stage-gated workflow

Every unit is scanned into a configurable stage flow. Each transition is recorded append-only with server timestamps and the team member who made it — the audit trail assembles itself as the floor works.

Append-only sanitization records

One record per sanitization attempt — pass or fail — with the operator and completion time enforced server-side. Records cannot be edited or deleted after the fact.

The sanitization gate

A unit cannot leave the sanitization stage until its latest sanitization event is a pass. The gate is enforced in the database for every role — there is no supervisor override that quietly skips it.

Automated independent sampling

The system automatically selects a random sample — at least 5% of logically sanitized media each month — for verification, and enforces that the verifier is not the operator who sanitized the media.

Erasure-certificate import

Import certificates from your erasure tooling by CSV with configurable column mapping. Matching is idempotent and serial-based; unmatched serials are reported, never silently dropped.

Downstream-vendor controls

A vendor register with certification status and approved media scope. Outbound shipments to inactive or expired-cert vendors are blocked, and every shipment ties specific units to the vendor that received them.

Photo-evidence gates

Stage questions can require photo answers — the photo is bound to the specific question it answers, and the unit does not advance until required evidence is captured.

Media lots

Track loose media as lots with quantity, make, type, and capacity — the same gated workflow applies whether the unit is a server or a box of drives.

Data portability

Item records and process answers export to CSV; photo evidence exports as organized image archives. Your records remain yours.

ItemStage does not perform data erasure — it is the system of record and enforcement around your erasure tooling and physical processes.

Where it fits

Mapped to the R2v3 process you're certified to.

609 of the 789 US R2v3 facilities hold both a data-sanitization appendix and Test & Repair. That combination — serial-level custody plus verified sanitization — is what ItemStage's workflow enforces.

Your process area	What the auditor looks for	What ItemStage enforces
Data sanitization (Appendix B)	Sanitization records per device, verification sampling, quality-control independence	Append-only sanitization events; the sanitization gate; automated ≥5% monthly sampling with enforced operator-independence; erasure-certificate import
Test & repair (Appendix C)	Documented functional testing and repair flow per unit	Configurable test/repair stages with required checklist answers and photo-evidence gates per stage
Downstream chain (Appendix A / core)	Due diligence on downstream vendors; traceable outbound shipments	Vendor register with cert status and media scope; shipments blocked to inactive or expired-cert vendors; unit-level shipment records
Tracking throughout (core)	Serial-level custody from receipt to disposition	Serialized intake with barcode labels printed on-site; append-only stage history with server timestamps and handler attribution; media lots for loose drives

ItemStage is workflow and custody software; it is not affiliated with SERI and using it does not itself constitute R2v3 conformance. Your certification body audits your whole process — ItemStage's job is to make the evidence side of that process automatic.

Pricing

Priced like your certificate: per facility.

R2v3 certification is issued per facility. So is ItemStage — unlimited users, no per-seat math, every operator on the floor on one price.

Compliance Facility

$1,499/mo per certified facility

The full compliance workflow for a single R2v3-certified facility.

• R2v3 compliance mode — append-only records, fail-closed gates
• Sanitization events, gate, and automated independent sampling
• Erasure-certificate import + media lot tracking
• Downstream-vendor register and shipment controls
• Unlimited users, mobile + web, CSV and image-archive export

Book a Conversation

Compliance Facility Plus

$2,499/mo per certified facility

The design-partner tier. Everything in Compliance Facility, plus direct input on the next set of compliance capabilities we're building — audit-pack assembly, extended evidence retention, and API access — with your facility's audit calendar setting the priorities.

• Everything in Compliance Facility
• Design-partner seat: roadmap capabilities built against your process
• Direct line to the engineering team
• Limited seats — we work with a small number of facilities at a time

Ask About Design-Partner Seats

Running multiple certified facilities? Multi-site pricing is quoted per facility with a volume step-down — talk to us. Restoration and refurbishment operations without compliance requirements start at $299/month.

Why us

Built inside a working facility, not a pitch deck.

ItemStage was developed inside the contents operation of Millers Restoration, where it processed 10,059 items in its first five months with 118,000+ photos captured at gated stages — the full production numbers are published. The compliance capabilities on this page were built the same way: as enforced workflow on a real floor, then hardened at the database layer. High-volume custody tracking is the same problem whether the units are a family's belongings or a pallet of decommissioned servers — what changes is who audits the record.

What a first conversation covers

1. How your facility assembles audit evidence today, end to end
2. Where the manual assembly time actually goes
3. Whether enforced gating fits your floor's throughput reality
4. If there's a fit: a walkthrough on your own process, not a canned demo

Book an Audit-Readiness Conversation

FAQ

ITAD questions, answered plainly.

What does ItemStage do for an R2v3-certified ITAD facility?

It runs the processing floor as a serialized, stage-gated workflow where the compliance evidence is produced by doing the work: every unit carries an append-only history of stage transitions, sanitization events, photos, and checklist answers with server-side timestamps and handler attribution. Items physically cannot advance past a sanitization stage until a passing sanitization record exists, so the record an auditor asks for is the record the floor already made.

How does ItemStage support R2v3 Appendix B (data sanitization)?

Three shipped mechanisms: append-only sanitization event records (one per attempt, server-enforced operator and timestamp) with a workflow gate that blocks items from leaving the sanitization stage without a passing result; import of third-party erasure certificates (e.g., from erasure tools) matched to serials with unmatched serials reported rather than dropped; and an automated sampling engine that randomly selects at least 5% of logically sanitized media each month for independent verification, with operator-independence enforced at the database level.

Does ItemStage manage downstream vendors?

Yes. A downstream vendor register tracks each vendor's certification status and approved media scope, and outbound shipments are blocked for vendors that are inactive or whose certifications have expired. Shipment records tie the units on the truck to the vendor that received them.

How is ItemStage priced for ITAD facilities?

Per facility with unlimited users, matching how R2v3 certification itself is issued. The Compliance Facility tier is $1,499/month per certified facility. Compliance Facility Plus at $2,499/month adds capabilities we are building now with a limited number of design-partner facilities. Multi-facility operations are quoted with a volume step-down.

Does ItemStage perform data erasure?

No. ItemStage is not an erasure tool and does not sanitize media. It is the system of record around your sanitization process: it records events, enforces the workflow gate, imports certificates from your erasure tooling, and drives the independent sampling verification.

Can we export our data?

Yes — item records and process answers export to CSV, and photo evidence exports as organized image archives. Data portability is deliberate: custody evidence you can't take with you isn't evidence.