Quickstart

This guide walks you from a fresh AVERASE account to a signed, publicly verifiable certificate of erasure — download the bootable ISO, write it to USB, boot the target machine, erase its drives, and pick up the certificate in the web app.

1. Create or join an account

Sign-up is invitation-only. If your organization already uses AVERASE, ask an account admin to invite you from the Accounts page — you'll receive an email ("{inviter} invited you to {account}") with an accept link. Signing up without a valid invite token is refused with "Sign-ups are by invitation only. Ask an account admin to invite you."

Once signed in, you can belong to several accounts and switch between them from the sidebar. Everything in this guide — downloads, inventory, wipes, certificates — is scoped to the account you're currently in.

2. Subscribe

ISO downloads require an active subscription on the account. Without one, the download card on /downloads shows View plans instead of Download and sends you to the pricing page. A lapsed subscription doesn't just block new downloads — it also denies existing sticks at boot and check-in (see license tokens), so keep it current while you're wiping.

3. Download the engine ISO

Go to /downloads. This page is restricted to account admins — members are redirected with "Only account admins are allowed to do that."

You'll see two product cards: AVERASE (the erasure engine) and AVERASE Hotswap (the bulk-erasure station). Each shows its version and exact image size. Click Download on the engine card.

Behind that click, AVERASE mints a fresh license token — an Ed25519 device token valid for 366 days — and redirects you to a signed download link. As the ISO streams down, your token is spliced into a dedicated 4 KiB slot inside the image, so the file you receive (named averase-<dl>.iso) is already provisioned for your account. No post-download configuration is needed.

Two limits to know:

• The signed link expires after 5 minutes. An expired link shows "That download link expired. Click Download to get a fresh one."
• Downloads are rate-limited to 5 per account per hour ("Download limit reached — please try again in an hour.").
• Downloads cannot be resumed — if the transfer breaks, start it again.

Each download mints its own token, and every token appears in the ISO control column on the same page, where admins can suspend or revoke it later.

4. Write the ISO to USB

Write the image with any dd-style (raw) writer:

• Rufus — choose DD mode when prompted
• balenaEtcher
• dd on macOS/Linux:

# Replace /dev/sdX with your USB stick — this destroys its contents
sudo dd if=averase-<dl>.iso of=/dev/sdX bs=4M status=progress conv=fsync

Ventoy is supported — you can copy the ISO onto a Ventoy stick alongside other images; the engine finds its embedded token wherever the ISO filesystem is mounted.

5. Boot the target machine

Insert the stick into the machine whose drives you want to erase and use the firmware's one-time boot menu to boot from USB. The engine is a diskless live system — it runs entirely from RAM and touches no drive until you tell it to.

It boots straight into a kiosk, locked: no drive listing, no tests, no wipe screen. While locked, only Wi-Fi, the Worker status popup, retry, reboot, and power-off work. Nothing about the machine's hardware leaves the device while it's locked.

6. Connect to a network and wait for verification

If the machine has no wired connection, the Wi-Fi popup opens automatically. Pick a network, enter the password, and connect (a wired connection shows "Wired connection active").

Once online, the engine verifies its embedded license token against AVERASE. On success the sidebar's Worker indicator turns green (Connected), the UI unlocks, and the Worker popup shows Verified — {account} along with your remaining wipe quota (or unlimited). Verification is unmetered — booting never consumes quota — and it must succeed on every boot.

7. Review the hardware fingerprint

The unlocked kiosk opens on the Device fingerprint dashboard: system identity, motherboard/BIOS, CPU, memory, graphics, storage identifiers, battery health, and displays, with an Advanced toggle for the deep detail (per-DIMM modules, EDID, network interfaces, USB devices, and more).

The same report is sent to AVERASE once per boot, so the machine appears in your /inventory automatically. Each internal drive shows its health verdict and whether it is an eligible Wipe target — excluded drives state their reason (boot medium, removable device, network/SAN transport).

8. Optionally run hardware tests

Open Tests in the sidebar and click ▶ Start Audit to run all nine hardware tests top-to-bottom — Keyboard, Display, USB Ports, Battery, WiFi Adapter, Bluetooth, Webcam, Audio, Touchscreen — or run any test individually. Results sync to the machine's inventory record as you go. Absent hardware fails by design: a machine with no Wi-Fi adapter cannot be sold as having one. See hardware tests for what each test does.

9. Select drives and erase

Open Erase in the sidebar (the Drives page). Under the warning banner — "⚠ Selected devices will be irreversibly erased. There is no undo." — check the drives to wipe and pick a method per drive:

• NIST 800-88 R2 Purge (the default): firmware-level sanitize / crypto erase that reaches over-provisioned and remapped cells. This is the certifiable path for media leaving your control.
• NIST 800-88 R2 Clear: a single logical overwrite of all user-addressable blocks. On solid-state media, Clear is capped at review — the result is held rather than certified.

The engine picks the strongest technique your drive supports automatically (crypto erase before block erase before overwrite); you never choose one by hand. Opal self-encrypting drives that are locked take an optional PSID — the 32-character code printed on the drive label.

Click the red ⌫ ERASE {n} device(s) button and confirm. Before any write, the engine checks in with AVERASE one more time (fail-closed — a denied or offline stick blocks here too, with a "Wipe blocked" message), re-validates each drive's identity, and then wipes all selected drives in parallel. Navigation locks until every job finishes; each job shows live progress and ends with its verification verdict. The Summary page shows each drive's result and disposition — sanitized, review, or DESTROY — and reminds you: "Certificates are issued by AVERASE cloud — download them from your account."

10. Find the wipe and download the certificate

Back in the web app, open /wipes. Every drive from the run appears as its own row — status Pass or Fail, method, duration, technician, and a Certificate column. Once generation finishes (it runs automatically for successful, verified wipes), the column shows a link like CW-000123; click it to download the signed PDF. Wipes that completed but were held for review, or that failed, show why no certificate was issued.

See certificates for exactly when a certificate is or isn't issued.

11. Verify the certificate

Anyone — including your downstream buyer or auditor — can check a certificate against AVERASE's records without an account:

curl https://averase.com/certificates/cert_abc123/verify

The response says whether the certificate is valid and echoes the signed facts (drive serial, model, method, completion time). A tampered or unknown certificate returns "valid": false. Full details on the certificate verification endpoint.

What's next?

• Platform architecture — how the pieces fit together
• License tokens — suspending, revoking, and quota
• The erasure engine — every screen and method in depth
• Webhooks — push wipe and certificate events to your systems