Certified and Compliant Data Recovery Services
SalvageData has recovered data since 2003 for more than 100,000 clients, from individuals to federal agencies. Strict privacy and security certifications back every recovery, so your data is handled under the safest protocols from evaluation to return. Documentation is available on request. Call our team 24/7/365 at +1 (800) 972-3282.
Certifications and credentials
Three things decide how safely a failing drive is handled: the room it is opened in, the process that governs the work and the repair program we participate in. Each one can be checked at its source.
ISO Class 5 cleanroom
Physical recoveries are performed in an ISO Class 5 cleanroom, certified to ISO 14644-1:2015 by Laboratory Certification Services, Inc. Opening a damaged drive in filtered, controlled air keeps particles from causing further damage to the storage media.
ISO 9001:2015 quality management
Every case follows documented, repeatable procedures under a certified ISO 9001:2015 quality management system, so you get a consistent process you can review.
Apple Independent Repair Provider
SalvageData is an Apple Independent Repair Provider. Apple's program gives independent repair companies access to genuine Apple parts, tools, training and diagnostics for out-of-warranty repairs on iPhone and Mac, such as iPhone display and battery replacements and Mac logic board and video card replacements.
Security
Security covers what happens to your data, not just your device. These controls are audited, can be reviewed by your team and apply to every case.
SOC 2 Type II audit
An independent auditor examines our security controls. The report is available on request under NDA, so your security team can review it before you approve a recovery.
FIPS 140-3 Level 3 encrypted return media
Recovered data can be returned on FIPS 140-3 Level 3 validated encrypted media, available on request. FIPS 140-3 is the NIST standard federal agencies use to validate encryption, so your data stays protected on the way back.
Documented chain of custody
Every device is tracked from the moment it is picked up or dropped off until it is returned, with a documented record you can review. Most clients ship their device free or drop it at one of our 100+ receiving locations. When a device cannot leave your premises, or time is critical, remote and on-site recovery services are available. Recovered data returns on encrypted media or by secure transfer. For regulated environments, that record is what your compliance team needs on file.
Data Privacy Framework participation
SalvageData participates in the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework, for non-HR data. The U.S. Department of Commerce administers these frameworks, which give organizations in the European Union, the United Kingdom and Switzerland a recognized way to transfer personal data to U.S. companies. The record below shows our participation.
Compliance
Regulated organizations need paperwork before they approve a recovery. SalvageData supports healthcare, government, defense and education buyers with the registrations and agreements below.
HIPAA healthcare data recovery
SalvageData's recovery services are HIPAA compliant. Hospitals, clinics, medical and dental practices, and the IT providers who support them can send us drives, servers and RAID arrays that contain protected health information (PHI). A Business Associate Agreement is available on request, so the terms for handling PHI are in writing before recovery begins. Every device stays under a documented chain of custody from intake to return.
GSA contract for government buyers
SalvageData holds GSA Multiple Award Schedule contract 47QTCA19D00AD (SINs 54151S, 811212 and OLM), SAM UEI LPJBBR4T58E5, CAGE code 3XFQ8 and NAICS 541519, as a Small Business. Agencies can order through GSA Advantage!, cooperative purchasing or a purchase order.
DD Form 2345 and ITAR for defense data
SalvageData is registered under the U.S.-Canada Joint Certification Program (DD Form 2345), which defense agencies and contractors look for before sharing controlled technical data. ITAR compliance documentation is available on request.
FERPA for student records
Schools remain responsible for student records under FERPA. SalvageData works under a written data privacy agreement with the institution, available on request, with documented chain of custody.
Warranty-safe data recovery services
Our technicians are qualified to provide data recovery services to all data storage manufacturer brands without affecting your device’s warranty.
Industry recognition
Forbes Advisor, the Chamber of Commerce and 99 Firms have named SalvageData among the best data recovery services.
Certification and compliance FAQ
Straight answers to the questions security, compliance and procurement teams ask most before approving a recovery.
A drive with physical damage has to be opened in a controlled environment. The platters are delicate, and a speck of dust, a skin flake or a hair can scratch the surface. That is why physical recoveries are done in our ISO Class 5 cleanroom. Logical problems, such as a deleted file or corrupted data on a healthy drive, do not need the drive opened. Our free evaluation tells you which case you have.
Yes. The report is available on request under NDA. A Type II report goes beyond a checklist: an independent auditor tests whether security controls work over a period of time, not only whether they exist on paper. Security and compliance teams typically review it during vendor approval. Call +1 (800) 972-3282 or email support@salvagedata.com, and we will send it before you decide.
Yes. SalvageData is HIPAA compliant, and a Business Associate Agreement is available on request. Healthcare organizations should have a BAA in place before handing over any device that may hold protected health information, so ask for it when you start your evaluation. Recovered data can be returned on encrypted media.
Yes. FERPA is met through the contract between the school and the vendor, not through a certificate. SalvageData works under a written data privacy agreement with the institution, available on request, so the school can document that student records stay under its control. Schools typically put this in place once, as a master agreement covering future recoveries, instead of signing for every device.
No. SalvageData is an Apple Independent Repair Provider. Apple lists the two separately: Authorized Service Providers offer in-warranty and out-of-warranty service backed by Apple, while Independent Repair Providers offer out-of-warranty repairs for iPhone and Mac. You can confirm our status on Apple's provider verification page.
Yes. Recovered data can be returned on FIPS 140-3 Level 3 validated encrypted media, available on request, or by secure transfer under documented chain of custody. FIPS 140-3 is the NIST standard federal agencies use to validate encryption. Tell your advisor when you open the case so the media is ready.
Call +1 (800) 972-3282 any time, 24/7/365, or email support@salvagedata.com. Our team can provide the SOC 2 Type II report under NDA, ITAR compliance documentation, FIPS return-media details, and a BAA or data privacy agreement. Government buyers can find contract identifiers and the DD2345 approval letter on the government data recovery page.
Certifications at a glance
Every credential SalvageData holds, what it covers, and where to check it.
| Credential | What it covers | How to verify |
|---|---|---|
| SOC 2 Type II | Independent audit of security controls | Report on request, under NDA |
| ISO 9001:2015 | Quality management system | Certificate on request |
| ISO Class 5 cleanroom (ISO 14644-1:2015) | Controlled air for physical recoveries | Report from Laboratory Certification Services, Inc., on the cleanroom page |
| FIPS 140-3 Level 3 media | Encrypted return media | On request |
| HIPAA | Protected health information | BAA on request |
| FERPA | Student education records | Data privacy agreement on request |
| GSA MAS | Federal, state and local ordering | Contract 47QTCA19D00AD, on GSA Advantage! |
| DD Form 2345 | Controlled technical data for DoD and DND | Approval letter on the government page |
| ITAR | Defense-related technical data | Documentation on request |
| Apple Independent Repair Provider | Out-of-warranty iPhone and Mac repair | Apple's provider verification page |
| EU-U.S. DPF, UK Extension and Swiss-U.S. DPF | Transfers of personal data (non-HR) from the EU, UK and Switzerland | Active participant on the Data Privacy Framework Program list |
| BBB accreditation | Accreditation with the Better Business Bureau | In progress |
Free data recovery analysis and quote 24/7
