ClearRecord turns “we think it was deleted” into a certificate an auditor accepts.
Past their retention window. Still on the disk. Still recoverable. And you can’t prove otherwise.
Watch it work
Install to certificate, playing on its own. Everything stays inside your network.
The difference
A normal delete just unlinks the file. The bytes sit on the disk until something happens to overwrite them — and you have no record either way. ClearRecord overwrites, deletes, and logs.
How it works
ClearRecord runs as a Windows service on each workstation and reports to a Hub on your own network. Here is exactly what happens to a file — in the order it actually happens.
Each workstation watches the folders you choose — by default Downloads (30 days) and the Recycle Bin (7 days). Recycle Bin items age from when they were deleted, not created.
Every 6 hours the agent rescans. A file can outlive its window by up to one sweep, then it is flagged. Nothing is deleted on guesswork.
🔒 Gate: the agent only acts after the Hub hands it an approved policy — files under a legal hold are never touched.The file is overwritten with a single zero-fill pass across its full length, flushed to disk, and deleted — identical on every drive type.
NIST 800-88 R2 — ClearThe agent dials out to the Hub over mutual-TLS (it has no inbound port) and the deletion is written into a SHA-256 hash-chained audit log. Your files never leave the workstation; only the metadata of what was destroyed does.
From the Hub, an authorized user generates a destruction certificate (PDF/A) covering any date range — the artifact you hand an auditor.
The mechanism, honestly
On a traditional hard drive, one zero-overwrite makes the data unrecoverable. SSDs remap writes, so a single overwrite can leave copies in spare cells — which is why ClearRecord detects and reports BitLocker as an independent layer. Full-disk encryption means any residual bytes are indistinguishable from noise without the key. BitLocker is reported, never used as the deletion method.
Before overwrite:
After zero overwrite:
Before overwrite:
After “zero overwrite”:
All data encrypted at rest:
After file deletion:
SYSTEM. No inbound port — the agent dials out only.localhost only (console / RDP access).The proof
The whole site promises destruction certificates. Here is one. This is a sample — the real document is generated from your own deletion records.
| Workstation | User | Files | BitLocker |
|---|---|---|---|
| FIN-WS-04 | j.harmon | 312 | Enabled |
| HR-WS-11 | a.okafor | 208 | Enabled |
| LEGAL-WS-02 | r.delgado | 176 | Enabled |
| OPS-WS-19 | s.whitman | 588 | Not detected |
The files listed in the accompanying record were overwritten with a single zero-fill pass across the full file length, flushed to disk, and deleted, consistent with NIST SP 800-88 Rev. 2 “Clear.” Each action is recorded in a tamper-evident, hash-chained audit log.
Tamper-evident
Every deletion record is hashed together with the one before it. Edit any historical row and every hash after it stops matching. It doesn’t prevent tampering — it makes tampering impossible to hide.
When the Hub runs “Verify chain,” it reports the first record where the hash no longer matches — so an altered or deleted log entry is detectable, not silent.
What you can prove
Each field on the certificate answers a question an auditor is required to ask.
| What the certificate shows | Why it matters | Citation |
|---|---|---|
| Who, what, when, and the method of destruction | Documented, repeatable disposal of records containing protected data | HIPAA 45 CFR 164.310(d)(2) |
| Tamper-evident audit log of every deletion | Records of information-system activity that can be reviewed | HIPAA 45 CFR 164.312(b) |
| Retained certificate + 6-year record | Retention of required documentation | HIPAA 45 CFR 164.316(b) |
| Media sanitization to a recognized standard | Sanitize or destroy media before disposal or reuse | NIST 800-171 / CMMC 3.8.3 |
| Documented destruction of education records | Evidence supporting records-disposal obligations | FERPA 34 CFR Part 99 |
After you deploy
Push the agent to workstations through Group Policy. It enrolls to your Hub over mutual-TLS automatically.
Agents take no action until the Hub hands them an approved policy. You set the folders and windows; holds are respected.
A file in use is retried, tracked, and escalated as a Dashboard alert if it stays locked — never silently skipped.
A short walkthrough of the Hub, a real deletion, and the certificate it produces.
Request a demo