Skip to main content
Primo erases managed device data using the OS-native cryptographic erase mechanism on each supported platform.

​
Erasure mechanisms by platform

  • Apple (macOS, iOS, iPadOS) — Erase All Content and Settings (EACS), which destroys the per-device encryption keys held in the Secure Enclave. Apple documents EACS compliance with NIST SP 800-88 in the Apple Platform Security Guide.
  • Windows — MDM remote wipe via the RemoteWipe CSP. When the disk encryption control is enabled on the device, this destroys the BitLocker key protectors, rendering disk contents cryptographically inaccessible. On devices where the disk encryption control is not active, the wipe performs a factory reset without cryptographic erasure.
  • Android — Device Policy Controller factory reset, which destroys the file-based encryption keys held in the hardware-backed keystore (TEE / StrongBox) on Android 10+ devices.
On Apple and Android devices, and on Windows devices with the disk encryption control active, this constitutes cryptographic erase via destruction of hardware-backed encryption keys, aligned with:
  • NIST SP 800-88 Rev. 1 — Purge
  • IEEE 2883-2022 — Purge

​
Compliance framework mapping

​
Evidence available on request

  • Wipe command audit logs (command issued, device acknowledgment, timestamp)
  • Configuration baselines confirming hardware keystore requirements on Android
  • Reference to Apple Platform Security Guide for EACS / NIST 800-88 attestation
  • For Windows: configuration baseline confirming disk encryption control activation, where applicable