Media / device disposal record

Media / Device Disposal Procedure

Field	Value
Document title	Theora Media / Device Disposal Procedure
Version	1.0
Effective date	29 May 2026
Owner / Author	security@theorahq.com (Security Lead)
Approved by	Engineering Lead
Review cadence	Annually, or on material change to the endpoint fleet

0. Document control history

Version	Date	Author	Change
1.0	29 May 2026	security@theorahq.com	Initial published version.

1. Scope and architecture statement

Theora is a fully cloud-native SaaS running on Google Cloud Run + Cloud SQL Postgres + Google Cloud Storage in GCP project tactile-stack-491017-c0 (us-central1). Theora owns no physical production media: no on-prem servers, no portable hard drives carrying customer data, no backup tapes, no DVDs. All persistent customer data lives in Google-managed storage subject to Google's own SOC 2 / ISO 27001-attested media sanitization process when underlying hardware is retired by Google. See docs/soc2/vendor-list.md for the Google Cloud sub-processor entry.

This procedure therefore applies only to endpoint devices (laptops used by Theora employees and contractors), which are the only physical media in scope.

2. Endpoint disposal — required steps

When an endpoint device is retired (departing employee, hardware failure, refresh):

Endpoint OS	Required sanitization step	Evidence captured
macOS	Sign out of iCloud → System Settings → General → Transfer or Reset → Erase All Content and Settings, which cryptographically erases the FileVault keys backing the SSD (NIST SP 800-88 Rev.1 "Purge" via cryptographic erase). Alternative: Apple Configurator 2 with a connected supervised wipe.	Screenshot of the post-wipe Setup Assistant + signed disposal-log entry under docs/soc2/evidence/disposal/<device-id>-<YYYY-MM-DD>.md
Windows	Suspend BitLocker → delete the recovery key from escrow → Settings → System → Recovery → Reset this PC → Remove everything → Clean the drive fully (NIST SP 800-88 "Clear" + key destruction = "Purge").	Screenshot of the Reset progress + signed disposal-log entry.
Linux	If a LUKS volume: cryptsetup luksErase /dev/<device> destroys all key slots (cryptographic erase). Optionally follow with blkdiscard for SSDs.	Terminal log of the luksErase command + signed disposal-log entry.
Any OS, hardware failure	Physical destruction: drill through the SSD/HDD platters at minimum two locations, or use a certified third-party shredder and retain the Certificate of Destruction.	Photo of destroyed device + third-party Certificate of Destruction (if used).

3. Disposal log

Every disposal event MUST be recorded in docs/soc2/evidence/disposal/disposal-log.md with the following fields: device serial number, OS, last user, departure or retirement date, method (table row above), sanitization timestamp, operator name, evidence-file references, and notes on chain of custody if any. The log is the audit trail; individual screenshots and Certificates of Destruction are the per-event evidence attached to the log entries.

4. Cloud storage media (out of scope)

Cloud SQL volumes, GCS objects, and Cloud Logging buckets are deleted via the Theora Customer Data Deletion Procedure (see /trust/soc2/customer-data-deletion-record/) for logical deletion and inherit Google Cloud's underlying media sanitization for physical deletion. No additional action is required from Theora when Google retires a server backing these services.

5. Vanta evidence posture

If no endpoint disposal has occurred during the audit window, this procedure document plus the Not Applicable designation is the acceptable evidence. The Engineering Lead and Vanta auditor should agree to mark the test Not Applicable with this URL as the justification for the inaugural reporting period. As soon as one endpoint disposal occurs, the disposal log entry (with sanitization screenshot or Certificate of Destruction) becomes the primary artifact and replaces the NA designation.