Asset disposal and repurposing follow the process and procedure outlined in our Asset Management Policy which is a part of our ISMS. An Independent Auditor has validated the existence of this policy and the related controls as part of the ISO 27001 certification audit. Upon a customer’s written request for data erasure, Core Strengths shall remove the customer’s data within thirty (30) days of the request. Unless otherwise instructed or pursuant to applicable law, Core Strengths will retain for perpetuity. Upon request, Core Strengths will provide a log or copy of the data that was deleted. Cloud-Based (AWS) Media When AWS determines that media has reached the end of its useful life or it experiences a hardware fault, AWS follows the techniques detailed in Department of Defense (DoD) 5220.22-M (“National Industrial Security Program Operating Manual”) or NIST SP 800-88 (“Guidelines for Media Sanitization”) to destroy data as part of the decommissioning process. Please refer to the AWS website for more information: https://aws.amazon.com/compliance/data-center/controls/