The journey
Sixteen years of watching it go wrong, and one decision to fix it.
Data Safe Solutions was not started to sell a better eraser. It was started because two people who had spent their careers inside IT asset disposal could see that nobody in it could prove the data was gone, and that everybody was certifying it anyway.
The only company we can find anywhere in the world that warrants the outcome and guarantees permanent, irretrievable data destruction.
A new standard nobody has yet been able to match, backed by £10 million of professional indemnity insurance.
Timeline
How it happened
Dated, and where a date can be checked against an independent source, that source is named next to it.
Before Data Safe Solutions
An IT asset disposal company, founded in North Wales
Chris Littlewood and Derek Johnston set up an IT asset disposal business built on data security and environmental responsibility. Fifteen years of running disposal at the sharp end is where the problem in this industry first became visible, and where the idea for everything that followed started.
An NHS trust asks for something that did not exist
Preparing for GDPR, an NHS trust set a specific requirement: no data was to leave its premises before redundant equipment was disposed of. Nothing on the market answered that. The question became the brief for DSS Mobile.
Data Safe Solutions
Data Safe Solutions Ltd is incorporated
Registered at the Port of Liverpool Building, Mann Island, to build the answer to that question as a product rather than a service.
Companies House 12245066DSS Mobile goes out on its first live customer job
Developed under Rafal Gorczynski as CTO, the unit went from a prototype the size of a server cabinet to a portable device that destroys data on site, across laptops, desktops, servers and Apple hardware, before anything moves.
ADISA awards Product Assurance
Independent testing under the ADISA Product Assurance scheme, against NIST SP 800-88 Rev 1, with scope including NVMe Purge. Listed publicly by ADISA rather than claimed by us.
ADPA016 · ADPA039Patent applications filed
Applications covering automated per-device sanitisation method selection, filed in the UK and the United States. This is the part no other product does: the engine interrogates the individual drive and determines the correct command itself, with no operator choice and no method list to select from.
Work begins with the University of Liverpool
The start of the AI and data integration platform now offered to NHS trusts and enterprise, consolidating data across siloed systems on open-box AI that can be inspected rather than trusted.
The UK application is published as GB2638704A
Publication puts the invention on the public record and, from that point, into the prior art. The United States application, 19/064,309, is also published and under examination.
GB2638704A · 19/064,3091,036 Freedom of Information requests
One question, put to UK public bodies: what recorded evidence do you hold that the data on your disposed storage devices was actually destroyed? The largest study of its kind, run at private expense rather than commissioned.
Submission to the Information Commissioner’s Office
The findings were put to the regulator rather than kept as marketing material, because a gap this wide in accountability for disposed personal data is a regulatory question before it is a commercial one.
The findings are published in full
Of 684 substantive answers, 437 held no outcome warranty and no device-specific evidence. Every response is public, every reference is the authority’s own, and the questions asked are published alongside the answers given.
£10 million of professional indemnity insurance goes behind the warranty
The certificate stops being a record that a process ran and becomes a warranted outcome with a financial consequence attached. As far as we can establish, no other supplier in this industry carries one.
Current ADISA Product Assurance registration
Valid and verifiable now, listed by ADISA and checkable without asking us.
Where it goes
The standard has to be testable, including on us
Everything above exists to support one claim, and a claim that cannot be tested is worth nothing. So the certifications are published with the reference numbers, the research is published with every response, and the warranty is published with the number that sits behind it.
If you want to test it, the assurance register lists what we hold and where to check each item independently.
Read the assurance register → See what 437 public bodies told us →