Quick answer: Redkey USB is a bootable USB stick that permanently wipes hard drives and SSDs, so old laptops and PCs can be reused, sold or recycled without leaking data. It is cheap (one-time price, unlimited wipes) and easy to use, and the Professional and Ultimate editions create PDF wipe reports.
Can an ISO 27001 company use it? Yes. ISO 27001 does not ban or require any specific tool. It will not hurt your certification if you use the right wipe method for each drive type, verify the result, keep a record for every device, and document the tool's limits in your risk assessment. Use something else (or physical destruction) for Apple Silicon Macs, ARM laptops, RAID servers, failed drives, highly sensitive data, or when a customer contract demands an independently certified erasure tool.
Last updated: October 2026. Product details are taken from Redkey's official website at the time of writing and may change. Techyami is not affiliated with Redkey.
Every company eventually has a pile of old laptops: an employee leaves, a lease ends, or machines get upgraded. Those drives still contain emails, passwords, customer files and sometimes saved VPN or Wi-Fi credentials. Deleting files or formatting the drive does not remove that data; free recovery tools can bring most of it back.
That is the problem tools like Redkey USB are built to solve. In this guide I explain, in simple language, what Redkey USB is, how it works, its benefits and drawbacks, when you should and shouldn't use it, and exactly what an ISO 27001 certified company needs to do so the tool helps the audit instead of creating a finding.
Table of contents
- What is Redkey USB?
- How Redkey USB works (step by step)
- Editions, price and licence
- Why "delete" and "format" are not enough
- Benefits of Redkey USB
- Drawbacks and limitations
- Redkey USB and ISO 27001: is it allowed?
- Can it cause an ISO 27001 non-conformity?
- How to use Redkey USB the ISO 27001 way (checklist)
- ISO 27001 audit evidence pack (what to keep)
- When you should NOT use Redkey USB
- Alternatives compared
- Final verdict: should your company use it?
- FAQ
- Sources and evidence
What is Redkey USB?
Redkey USB is a data erasure (data wiping) tool on a USB stick, made by Redkey USB Ltd, a UK company. You plug it into a computer, start the computer from the USB stick instead of Windows, and Redkey erases the internal drives so the old data cannot be recovered.
Think of it like this: deleting a file is like removing a book from the library catalogue; the book is still on the shelf. Redkey removes the books themselves and wipes the shelves clean.
Key points in one place:
- Works outside Windows: it boots its own small operating system, so it can wipe the Windows (or Linux) system drive itself.
- Drive types: hard disks (HDD), SATA SSDs, NVMe SSDs and supported USB storage, according to Redkey.
- Methods: Redkey says it supports "Clear" and "Purge" style sanitisation from international guidance (the terms used in NIST SP 800-88), using the drive's own hardware erase commands where supported, or software overwriting.
- Reports: the Professional and Ultimate editions create PDF reports with the disk details, method, date, time and result, a unique ID and a digital signature.
- Unlimited use: one-time purchase, no per-wipe fees or subscription.
How Redkey USB works (step by step)
- Activate the stick once. Activation and software updates need a Windows 7 or later computer with internet. The software download is about 2 GB.
- Back up anything you need. Erasure cannot be undone, and it removes the operating system too.
- Plug Redkey into the target computer and boot from USB. On some machines you must change BIOS/UEFI boot or storage settings first.
- Select the drives and the erase method. Redkey can erase up to 16 disks per computer in one go, including the system disk.
- Let it run and check the result. Review the on-screen result and any warnings. You can inspect the disk with built-in hex/binary viewers and SMART data.
- Save the PDF report (Professional/Ultimate) to the Redkey stick or another USB drive, and attach it to your asset record.
There is also an AutoNuke mode for automatic erasure of supported disks, and a Remote Mode to erase one networked computer at a time (needs at least 4 GB RAM).
Redkey USB editions, price and licence
| Edition | Best for | Main features | Price (official site, Oct 2026) |
|---|---|---|---|
| Home | Individuals | Computer drive erasure | See official site |
| Professional | Small businesses, IT support | Everything in Home + detailed, signed PDF reports | US$79.95 |
| Ultimate | IT teams, ITAD, refurbishers | Everything in Professional + Apple/Android phone and tablet erasure, scripts for repeat jobs, report data import, advanced disk controls | US$99.95 |
Licence: one-time purchase with lifetime software updates and unlimited wipes on compatible computers, under Redkey's End User Licence Agreement. Redkey lists a 2-year warranty and a 90-day money-back guarantee for unopened, unactivated items. Prices and stock change, so check the official site before buying. Bulk business packs are also listed.
For a company that needs audit evidence, Home is not enough, because it does not produce PDF reports.
Why "delete" and "format" are not enough
| What people do | What actually happens | Is the data safe? |
|---|---|---|
| Delete files / empty Recycle Bin | Only the file's entry is removed; the data stays on disk | No, easy to recover |
| Quick format | A new empty file table is written; old data remains | No, easy to recover |
| Windows "Reset this PC" (remove everything) | Better, especially with "clean the drive", but no proof or report | Partly; no audit evidence |
| Proper sanitisation (secure erase, purge, crypto erase) | Drive's data area is erased using the right method for the media | Yes, when verified |
| Physical destruction (shredding) | Drive is destroyed | Yes, but drive can't be reused |
SSDs need special care. Because of wear levelling, spare (over-provisioned) blocks and garbage collection, simply writing zeros over an SSD may not reach every memory cell. Redkey itself says, in its NIST sanitisation guide, that SSDs should be erased with sanitise commands or cryptographic methods, not old HDD-style overwrites.
Benefits of Redkey USB
- Low cost: a one-time price with unlimited wipes is much cheaper than per-licence enterprise erasure tools for small and medium companies.
- Very easy to use: graphical interface in 10 languages, plus a text mode. A trained IT support engineer can use it within minutes.
- Works without Windows: because it boots from USB, it can erase the system disk, and it works even if Windows is broken.
- Supports HDD, SATA SSD and NVMe: and uses the drive's hardware erase commands where supported, which is the right approach for SSDs.
- Audit-friendly reports: signed PDF reports with a unique ID, disk details, method, date and result. You can add asset numbers, operator name and your logo.
- Erase many disks at once: up to 16 disks in one computer.
- Checks hidden areas: Redkey checks and clears supported hidden areas such as HPA.
- Phones and tablets (Ultimate): erase supported iPhones/iPads and Android devices from the same kit.
- Reuse instead of destroy: wiped laptops can be reassigned, sold or donated, which saves money and reduces e-waste.
- No internet needed while wiping: useful in secure areas (internet is only needed for activation and updates).
Drawbacks and limitations
- No current independent certification: Redkey's own certification page says it does not currently hold an active ADISA Product Claims Test certificate. It held ADISA certification in the past and says it is working toward reassessment. Some customers, auditors or contracts ask for an independently certified tool (for example ADISA or Common Criteria); Redkey may not meet that requirement today.
- Not for Apple Silicon or ARM: Apple M-series Macs and ARM-based Windows laptops are not supported, according to the official product page. Only Intel Macs from about 2006 to 2020 are listed.
- Some RAID systems and specialist servers are not supported: not ideal for data-centre hardware.
- One machine at a time: it is a hands-on tool. There is no central management console like large enterprise products have, so it gets slow for hundreds of devices.
- BIOS/UEFI changes may be needed: some laptops need boot or storage mode settings changed before Redkey can see the drive.
- Results depend on the drive: the methods available depend on what each disk and computer supports. Faulty or failing drives may not erase fully and should be destroyed.
- Reports are not a compliance guarantee: Redkey states its reports document the process but do not guarantee legal compliance. Your process and records still matter.
- It is a powerful, destructive tool: plugged into the wrong machine (especially with AutoNuke), it can wipe a working production PC. It must be controlled.
- Activation needs Windows + internet: a small hurdle in Linux-only or air-gapped teams.
- Doesn't cover cloud or server data: it only erases physical devices you plug it into. Data in Microsoft 365, backups and file servers needs its own deletion process.
Redkey USB and ISO 27001: is it allowed?
Yes. ISO/IEC 27001 is a management system standard. It tells you what to control, not which brand of tool to buy. No tool is "ISO 27001 approved" or "ISO 27001 banned". What matters is that your chosen method is suitable for the risk and that you can prove it worked.
The ISO 27001:2022 Annex A controls that apply to data wiping are:
| Control | What it asks for | How Redkey fits |
|---|---|---|
| 7.14 Secure disposal or re-use of equipment | Storage media must be checked so that sensitive data and licensed software are removed or securely overwritten before disposal or re-use | Main control Redkey supports, with a wipe report per device |
| 8.10 Information deletion | Delete information in systems, devices and media when no longer required, using suitable methods, and keep evidence | Redkey covers physical devices; you still need processes for cloud, backups and servers |
| 7.10 Storage media | Manage removable and other media through their life cycle, including disposal | Covers USB drives and also how you control the Redkey stick itself |
| 5.9 Inventory of information and other assets | Keep an asset register | Each wipe report should match an asset record and serial number |
| 5.12 Classification of information | Classify information by sensitivity | The classification decides whether wiping is enough or destruction is needed |
| 5.19 to 5.22 Supplier relationships | Assess and monitor suppliers | Record why you chose Redkey and its known limits (including certification status) |
Auditors usually also look at your disposal procedure, the asset register, the disposal log and the wipe certificates together, and check that every disposed device can be traced.
Can Redkey USB cause an ISO 27001 non-conformity?
The tool itself won't. How you use it can. These are the realistic ways a company gets a finding:
| Risk | Why it's a problem | How to avoid it |
|---|---|---|
| Missing wipe report for a device | Auditor can't prove the device was sanitised; even one gap can be a minor non-conformity | Use Professional/Ultimate, save every report, link it to the asset ID |
| Wrong method for the drive (e.g. a quick overwrite on an SSD) | Data may remain in hidden SSD areas | Use purge/sanitise or crypto erase for SSDs; document the method per media type |
| Wiping devices Redkey doesn't support | Apple Silicon Macs, ARM laptops and RAID servers may leave the company un-wiped | Have a documented alternative for each unsupported type |
| Failed or partial wipe not noticed | Data still present on a drive that is sold or donated | Check results and warnings; failed drives go to physical destruction |
| Contract requires a certified tool | Breach of customer requirements (ISO 27001 clause 4.2 needs interested parties' requirements) | Check contracts; use a certified tool or certified destruction vendor where required |
| Stick lost or misused | Someone could wipe a production machine (availability incident) | Store it locked, keep an issue log, limit to trained IT staff |
| Only wiping laptops | Data on backups, cloud, phones, printers and copiers is forgotten | Cover all media in your deletion and disposal procedure |
How to use Redkey USB the ISO 27001 way (checklist)
- Write it into your procedure. Name Redkey (edition) as an approved tool in your Secure Disposal / Media Sanitisation procedure, with the scope it covers.
- Map method to media and classification. For example: internal re-use of low-risk laptops = Clear; devices leaving the company = Purge; highly confidential data, damaged or unsupported drives = physical destruction with a serial-level certificate.
- Record the risk decision. In your risk register or supplier assessment, note that Redkey currently has no active independent certification and how you compensate (verification, sampling, destruction for top-sensitivity data).
- Use Professional or Ultimate so every wipe produces a signed PDF report.
- Fill in the report details: asset tag, device serial number, operator name and ticket number.
- Verify. Review the result and warnings for every drive. Periodically spot-check a wiped drive with a recovery tool and record the result.
- Update the asset register with disposal status, date, method, report ID and who did it. Reconcile monthly.
- Remove device identities: delete or retire the device in Intune/MDM, Entra ID or Active Directory, and revoke certificates and VPN profiles.
- Control the stick: keep it locked, log who borrows it, and train the people allowed to use it.
- Keep reports safe and long enough to match your retention policy (store copies outside the stick).
- Review once a year: check Redkey's supported hardware, certification status and your device fleet (for example, if you buy Apple Silicon Macs).
ISO 27001 audit evidence pack (what to keep)
An auditor will usually pick a few disposed devices from your asset register and ask you to prove what happened to each one. Keep this evidence ready:
| Evidence | What it should contain | Supports control |
|---|---|---|
| Secure disposal / media sanitisation procedure | Approved tools (e.g. Redkey Professional), method per media type and classification, roles, what to do when a wipe fails | 7.14, 8.10 |
| Asset register entry | Asset tag, serial number, owner, disposal status, date, method, report ID | 5.9, 7.14 |
| Redkey PDF wipe report (one per device) | Disk model and serial, method, date/time, result, unique report ID, digital signature, operator and asset details | 7.14, 8.10 |
| Disposal log or ticket | Request, approval, who wiped it, verification done, where the device went | 7.14 |
| Destruction certificate (for failed or unsupported drives) | Serial-level list, method of destruction, date, vendor name, chain of custody | 7.14, 5.19 to 5.22 |
| Verification / spot-check record | Sample of wiped drives checked with a recovery tool and the result | 8.10 |
| Risk or supplier assessment of the tool | Why Redkey was chosen, known limits (no current ADISA certificate, unsupported hardware) and compensating controls | 6.1.3, 5.19 |
| Identity clean-up record | Device removed from Intune/MDM, Entra ID or Active Directory; certificates and VPN profiles revoked | 5.18, 8.1 |
| Training record | Staff trained to use the tool and follow the procedure | 6.3 |
| Tool custody log | Where the Redkey stick is kept and who borrowed it, when | 7.10 |
Tip: save the PDF report with the asset tag in the file name (for example LT-0142_redkey_report.pdf) so you can find it in seconds during the audit.
When you should NOT use Redkey USB
- Apple Silicon Macs (M1, M2, M3, M4 and later) and ARM Windows laptops: not supported. For Macs use Apple's "Erase All Content and Settings" (or your MDM's erase command), which removes the encryption keys on the built-in storage.
- RAID servers, SANs and specialist storage: use the vendor's sanitise tools or a certified enterprise tool or service.
- Failed, damaged or unreadable drives: you can't verify the erase. Physically destroy them.
- Top-secret or highly regulated data: if your policy says "Destroy" for this level, follow it, even if wiping would probably work.
- Customer or regulator demands a certified tool: for example a contract that names ADISA or Common Criteria certification.
- Very large fleets: wiping thousands of devices a month is easier with a centrally managed enterprise product or an ITAD partner.
- Remote employees' laptops: a remote wipe (Intune Wipe or Autopilot Reset on BitLocker-encrypted devices) can be faster than shipping laptops back, as long as your policy accepts it.
- When the device is still in use: never run it "just to test" on a working machine.
Alternatives compared
| Option | Good for | Watch out for |
|---|---|---|
| Redkey USB (Professional/Ultimate) | Small and mid-size companies, IT support teams, low cost, PDF reports | No current independent certification; no Apple Silicon/ARM; manual, one machine at a time |
| Enterprise erasure software (e.g. Blancco, BitRaser) | Large fleets, central reporting, certified products, servers | Higher cost, usually per-licence |
| Laptop maker's built-in BIOS/UEFI wipe (e.g. Dell, HP, Lenovo) | Supported business laptops, free | Varies by model; reporting is limited |
| Free open-source tools (e.g. ShredOS/nwipe) | Hard disks on a zero budget | No vendor support; overwriting isn't ideal for SSDs; weak audit evidence |
| BitLocker + Intune Wipe / Autopilot Reset | Remote Windows devices that were always encrypted | Needs proof the device was encrypted from day one; policy must accept crypto erase |
| Apple "Erase All Content and Settings" / MDM erase | Apple Silicon and T2 Macs, iPhones, iPads | Keep MDM logs or screenshots as evidence |
| Certified ITAD or shredding vendor | Damaged drives, highest sensitivity, bulk disposal | Ask for serial-level certificates and chain of custody; assess the vendor |
Final verdict: should your company use Redkey USB?
Use Redkey USB if you are a small or mid-size company (or an IT support team) that wipes Windows PCs and Intel Macs every month, you want low cost and simple operation, and you will use the Professional or Ultimate edition with proper records.
Choose something else, or combine it with other methods, if you need an independently certified tool for contracts, you wipe thousands of devices, you have Apple Silicon Macs, ARM laptops or RAID servers, or your policy requires destruction for your most sensitive data.
For ISO 27001, the honest answer is: Redkey can be part of a compliant process, but it is not compliance by itself. The procedure, the right method for each drive, verification and complete records are what keep you safe in the audit.
Related reading: 25 Conditional Access policies every tenant needs and desktop support engineer interview questions.
FAQ
What is Redkey USB used for?
To permanently erase data from computer drives (and, in the Ultimate edition, supported phones and tablets) before the device is reused, sold, returned or recycled.
Is Redkey USB safe to use?
It is safe for its purpose, but it is destructive by design: whatever you erase cannot be recovered. Back up anything you need and double-check you selected the right drive.
Is Redkey USB ISO 27001 compliant?
No tool is "ISO 27001 compliant" on its own, because ISO 27001 certifies organisations, not products. Redkey can support controls 7.14 and 8.10 if your procedure, method choice, verification and records are correct.
Will using Redkey USB affect my ISO 27001 certification?
Not if you document it as an approved tool, choose the right method for each media type, keep a wipe report for every device and handle unsupported devices another way. Missing records or wrong methods are what cause findings.
Is Redkey USB certified?
According to Redkey's own certification page (checked October 2026), it does not currently hold an active ADISA Product Claims Test certificate. It was ADISA certified in the past and says reassessment work is under way.
Does Redkey USB follow NIST 800-88?
Redkey says it supports "Clear" and "Purge" sanitisation methods used in international guidance, the same terms used in NIST SP 800-88 (Revision 2 was published in September 2025). NIST does not certify or list products, so following NIST depends on the method you choose and how you verify it.
Can Redkey wipe SSDs and NVMe drives?
Yes, Redkey lists SATA SSDs and NVMe SSDs and uses the drive's hardware erase commands where supported. Always check the result in the report, because support depends on the drive and the computer.
Does Redkey USB work on M1, M2 or M3 MacBooks?
No. Apple Silicon Macs and other ARM computers are not supported. Use Apple's built-in erase or your MDM's erase command instead.
How many times can I use one Redkey USB?
Redkey describes it as reusable with unlimited wipes on compatible computers, with no subscription or per-erasure fee, subject to its licence agreement.
Does it need the internet?
Only to activate it and download updates (from a Windows 7 or later PC). Wiping itself is done offline by booting from the stick.
Which edition should a company buy?
Professional at minimum, because Home has no PDF reports. Choose Ultimate if you also need to wipe phones and tablets or run repeated jobs with scripts.
Is formatting a drive enough for ISO 27001?
No. Formatting leaves data recoverable and gives no evidence. Auditors expect proper sanitisation or destruction, plus records.
What should I keep as evidence for the auditor?
Your disposal/sanitisation procedure, the asset register showing disposal status, the wipe report (or destruction certificate) for each serial number, verification checks and training records for the staff who do the work.
Sources and evidence
Every product fact in this article comes from these sources (checked October 2026). Product details can change, so recheck them before you buy or write them into a policy.
- Redkey USB Professional: official product page: price, PDF reports, supported drives, compatibility (no Apple Silicon/ARM, some RAID not supported), unlimited use, activation requirements.
- Redkey USB Ultimate: official product page: price, phone and tablet erasure, scripts, limits.
- Redkey certifications page: states that Redkey does not currently hold an active ADISA Product Claims Test certificate.
- Redkey: NIST data sanitisation guide for IT teams: Clear, Purge and Destroy, SSD caveats, verification.
- NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization: published September 2025.
- ISO/IEC 27001:2022: Annex A controls 7.14 (secure disposal or re-use of equipment) and 8.10 (information deletion).
- UpGuard: ISO 27001 control 7.14 explained: implementation guidance and the evidence auditors expect.
- High Table: ISO 27001 Annex A 8.10 explained: deletion methods and audit evidence.
This article is general information, not legal or certification advice. Check your own policies, contracts and auditor's expectations, and confirm current product details on Redkey's official website before buying.
0 Comments