One platform. Every audit, one record.

No. R2v3 certifies facilities, not software, and Stenfox holds no third-party certification. R2v3-certified ITAD processors can run Orion as their erasure and device-record system and use its signed reports as evidence in their audits. The certification belongs to the processor.

No. Stenfox is not ADISA certified. Orion's reporting is built around ADISA: the method is chosen per media type, every device is verified, and the result is recorded in a signed report. ADISA-certified processors can use these reports as evidence in their own audits.

When personal data sits on a device, Orion's signed report records the device, the erase method, the verification result, the operator and the time. The controller can use that record to show how and when the data was erased.

Yes. The same signed report per device, and the device history in Stenfox Portal, can be shown to an R2v3, ADISA or ISO 27001 auditor, used as evidence for HIPAA, SOX and PCI-DSS audits, shown to a customer, or to a data-protection officer. Each framework decides what it accepts; Orion keeps the record consistent across them.

Both. Orion follows the Clear and Purge guidance of NIST SP 800-88 Rev. 1 and Rev. 2. Rev. 2 was published in September 2025 and restructured the guidance.