R2v3 Certification FAQ

R2 is the electronics reuse and recycling standard owned by SERI, and being R2 Certified means an accredited certification body has audited your facility against it. The R2 Standard sets common criteria for responsible reuse and recycling across the used portion of the electronics lifecycle. R2 Certification is the program for evaluating and monitoring businesses against those criteria, protecting the environment, worker health and safety, data and communities, and supporting a circular economy. R2v3 is the current and only active version.

It means an R2 certificate covers one facility address, so it doesn't move with you. The R2 facility must be a commercial place of business, and all R2 requirements apply at that address. If you move, notify your certification body (CB); it performs a transfer audit at the new location to confirm your processes haven't changed, and a new certificate is issued with the new address. For example, a phone refurbisher that outgrows its unit and moves to a larger building must tell its CB, pass the transfer audit, and then receive a certificate showing the new address.

R2v3 requires a certified environmental, health and safety (EH&S) management system. Paradygm recommends ISO 14001 together with ISO 45001, because those certificates are recognized worldwide and across industries. A certified quality management system (ISO 9001) is required only if your scope includes test and repair (Appendix C) or brokering (Appendix F).

The REC (R2 Equipment Categorization) is SERI's companion document for grading every asset an R2 facility receives. Each asset is evaluated on cosmetic and functional criteria after testing, and that evaluation sets its final grade. For example, a phone that tests fully functional but has a cracked screen grades lower until the screen is replaced; after a successful repair it can be regraded higher.

Generally no. The one exception is an external vendor that is itself R2v3 certified for those processes; then testing and refurbishment can be outsourced to it.

Only if the vendor you bought them from is an R2v3 certified facility. If the vendor is not R2v3 certified, failed or "DOA" assets cannot be returned to it.

There are three outcomes: repair, harvest parts, or recycle. You can repair or refurbish the asset for resale using new or existing parts; harvest the good working parts into a parts inventory and recycle the rest (plastics, metal, circuit boards) through qualified downstream vendors; or recycle the asset when repair would cost more than it is worth.

Logical data sanitization means using software to overwrite or otherwise make data unrecoverable on a device that will be reused. R2v3 requires all data-bearing assets to be sanitized. For reuse, Appendix B expects software that controls the process and records the result. A manufacturer's factory reset on its own is not always enough: it can count only when it is controlled and recorded by an application and verified, as explained in the answers below.

Physical data sanitization means destroying the storage media, for example by shredding, crushing or disintegrating it, so the data can't be recovered. Choose destruction equipment and particle sizes that meet a recognized specification, such as the NSA evaluated products lists for media destruction devices, and record each destruction. Degaussing is treated as a purge technique for legacy magnetic media, not a destroy method, under NIST SP 800-88 Rev. 2.

In Appendix B, "software" means an application that automates logical sanitization and creates a record of it. It should control and direct the whole process, overwrite all user-addressable storage with non-sensitive data, and record the date and time, the device's unique identifier, the method used and the verification result.

Not always. A reset can erase data but may not make it unrecoverable by commercial software, so it can't be the primary logical method on its own. Where no dedicated sanitization software exists for a device, the reset can count as software if an application documents and controls it, records the results in detail, and can be shown to meet Appendix B's software and records requirements.

Manual sanitization following the manufacturer's instructions is still acceptable, if it is controlled. You need a documented process, a tool that verifies the sanitization worked, and a detailed record of the date and time, device identifier, method and verification result.

Because software makes sanitization consistent, recorded and provable. It gives rigor (the same complete process every time), transparency (detailed records for every device) and confidence (evidence that data was overwritten), which commercial reuse needs.

Yes. Individuals can wipe their own devices at their own risk, but that approach lacks the rigor and records required when a facility commercially reuses devices.

On an unencrypted device, a reset doesn't actually erase the data; it stays hidden and can be recovered with commercial software. That exposes the previous user to a real privacy risk.

On an encrypted device, a reset destroys the encryption key, so the remaining data is permanently unreadable even with specialized software. That gives much stronger protection than resetting an unencrypted device.

No. Encryption isn't mandatory on every device and users can sometimes turn it off. Any data stored after encryption is disabled is not protected by a later reset.

Use a process that is software-based, verified and recorded. In practice: use devices with full-disk encryption on by default and don't disable it; use sanitization software that meets the R2v3 Standard's software and verification requirements; use a professional, R2 certified sanitization service for sensitive data or many device models; and wipe devices before any physical disposal.

R2v3 sets logical sanitization between NIST's Clear and Purge levels: data must not be recoverable with commercially available software. Clear applies where all addressable storage can be overwritten; visual inspection alone isn't enough to verify it. Purge makes recovery infeasible even with laboratory techniques, which R2v3 doesn't require for logical sanitization. These levels come from NIST SP 800-88 Rev. 1; NIST replaced it with Rev. 2 in September 2025, which keeps clear, purge and destroy as the three methods.

Appendix B(13) goes further than checking that a record exists: it requires actually trying to recover data from sanitized devices with commercially available software, to confirm the sanitization worked.

Then data recovery with commercial software is impossible by design. If a device has no working I/O ports or remote access, retrieving data would need specialized forensic analysis, which goes beyond what Appendix B(13) requires.

No. Formatting a drive or resetting an unencrypted device can look clean but often leaves pictures, contacts and messages that commercial recovery software can find.

Mainly because they don't reach all the data. Some methods overwrite only part of the storage; remnants can remain on the media; hidden partitions may be untouched by formatting or resets; and encryption may be off or user-configurable, leaving data exposed.

Yes. R2v3 internal auditor training is its own course, delivered on-site at your facility, and every participant who completes it receives a certificate of completion. It covers R2v3's Core and Process Requirements, auditing the legal compliance plan, downstream vendors and data sanitization, and the records auditors need to see.

Yes: Guaranteed Certification within the first attempt. Paradygm has a 100% R2 track record, more than 25 years of experience and over 200 clients, and is a SERI Approved Consultant. Audits are always carried out at your facility; we don't do remote or hybrid audits.