Compliance & Security
Compliance posture
Built for regulated environments
We align our processes with the frameworks your organization answers to, so a move never becomes a compliance gap.
HIPAA-aware handling
Procedures designed for environments with protected health information, including access control and documented handling.
SOC 2-aligned processes
Operational controls modeled on SOC 2 principles for security, availability, and confidentiality.
Chain of custody
Every asset is tracked from de-rack to re-rack, with custody recorded at each transfer.
Audit-grade documentation
Runbooks, asset logs, and verification records you can hand to auditors and stakeholders.
Note: References to HIPAA and SOC 2 describe our operational practices and process alignment. They are not a claim of certification. We are glad to walk your security and compliance teams through our controls during procurement.
What a regulated environment changes about a move
Moving servers is a logistics problem. Moving servers that hold patient records, payment data or other regulated information is a logistics problem with a paper trail. The equipment is the same, but the questions your auditors, privacy officers and security team will ask afterwards are different: who had access, where was each device at every point, and how do you know nothing was lost or exposed along the way.
We plan regulated moves backwards from those questions. Before we decide how to pack or load anything, we agree with your team on which systems carry sensitive data, who is allowed to touch them, which records you need at the end, and what has to be true before a system is considered moved. That agreement becomes part of the runbook, so the controls are built into the work instead of being reconstructed after the fact.
Our approach is aligned with the principles behind HIPAA and SOC 2, including access control, documented handling, availability and confidentiality. We describe it as alignment, not certification, and we are glad to walk your security and compliance teams through it during procurement.
How we handle data-bearing equipment
Servers, storage arrays and many network devices contain drives or memory that can hold data. We treat every one of them as data-bearing until your team tells us otherwise in writing.
- Drives stay inside the chassis and travel with the device they belong to, unless you have asked us to remove them and tell us where they go.
- Each device is labeled and tied to a line in the asset inventory before it is powered down, so a serial number can always be matched to a location.
- Equipment is packed in anti-static, shock-protected materials and crated where the route or the equipment calls for it, with containers sealed and recorded.
- Anything that is being retired instead of moved goes through decommissioning and asset disposition, with the sanitization or destruction method agreed with you in writing first.
Chain of custody from de-rack to re-rack
Chain of custody is the record that answers the question "where was it, and who had it". For us it starts at the rack and does not stop until the equipment is installed and verified at the destination.
- Custody is recorded at every transfer: de-installation, loading, delivery and re-installation.
- Loads travel on exclusive-use vehicles, so your equipment is not shared with other customers’ freight.
- Each container or rack is checked against the inventory when it is loaded and again when it is received.
- Any discrepancy, such as a damaged carton or a count that does not match, is written down when it is found and raised with your contact right away.
Documentation you can hand to an auditor
Good documentation is what turns a successful move into one you can defend. Depending on the scope we agree with you, the records for a move can include:
- The asset inventory, with serial numbers, locations and labels
- The sequenced runbook, with owners, checkpoints and the rollback path
- Cable and port documentation, so the environment can be rebuilt as it ran
- The chain-of-custody log for each shipment
- Condition notes and photographs taken at pickup and at delivery
- Verification records showing each system was checked after the move
What we ask of your team
Compliance on a move is shared work. We will ask you to identify the systems that carry regulated data, name the people who are authorized to approve access, tell us about any site rules at the origin and destination such as escorts, badge requirements or restricted hours, and confirm the records your auditors expect to see. The earlier we have those answers, the fewer surprises there are on move day.
To see how these controls fit into the full sequence, read about our relocation process, or request a quote and tell us about your requirements.
Common questions
Frequently asked questions
- Are you HIPAA or SOC 2 certified?
- No. Our operational practices are HIPAA-aware and aligned with SOC 2 principles, but we do not claim a certification. We are happy to review our controls with your security and compliance teams so you can judge whether they meet your requirements.
- Can you work inside our own security rules?
- Yes. We build site rules into the runbook, including escorts, badge access, restricted hours, approved personnel lists and documentation requirements, so the move follows your policies instead of ours.
- What records do we receive after a move?
- That depends on the scope we agree, but typically an asset inventory, chain-of-custody logs, condition notes and verification records. Tell us in advance which records your auditors need and we will plan to produce them.
- What happens to drives that should not be moved?
- Retired equipment is handled through decommissioning, with the data sanitization or destruction method agreed in writing before work begins, and documentation of the outcome.See decommissioning services