Disk Disposal
Last updated: October 28, 2026
This page describes what happens to a disk that held customer data when it fails or is retired. It applies to every disk in our infrastructure: VM disks, volumes, backups and S3 storage.
Disks never stand alone
Every disk is part of an array. VM disks run on ZFS raidz1. Backups, volumes and S3 run on Ceph with three copies spread over different servers. A single disk taken out of an array holds only fragments of data, never a usable copy on its own.
What we do with a disk
- The disk is removed from its array. The array rebuilds its data onto the remaining disks.
- The disk is securely wiped: its whole surface is overwritten, or the drive's own secure erase command is used.
- The wiped disk goes into the datacenter's electronic waste bin.
A disk that is too damaged to be securely wiped goes into the same bin as it is. Being part of an array, it holds fragments only.
What we do not do
We do not physically destroy disks, and we do not issue certificates of destruction.
Relation to NIST SP 800-88
The secure wipe in step 2 corresponds to the Clear method of NIST SP 800-88 Rev. 1. We do not perform Purge or Destroy.
If you need data at rest that nobody can read from any disk, encrypt inside your VM with your own key (for example LUKS). Then every disk and every backup holds only encrypted data.