How to read the verdicts
Stores data means the device keeps sensitive or personal information in normal use: documents, images, accounts, passwords, recordings, or logs. Handle it like a computer before it leaves your control. Depends means some models or configurations store data and others don’t; the result tells you exactly what to check, and if you can’t confirm, treat it as data-bearing. No user data means the device holds no files, logins, or personal information in normal use; it may keep trivial data such as a monitor’s factory identification or a headset’s pairing list, and the result says so.
Where data lives matters as much as whether it exists. Many devices store it on flash memory soldered to the board, so there is no drive to pull; others link to a cloud account that a factory reset doesn’t touch. Each result says where the data sits and what to do before the device is reused, returned, or recycled. When a device needs sanitizing, the Method Picker gives the NIST SP 800-88 method for its media, and the Certificate Checker grades the certificate you get back.
How to read the risk meter
The verdict answers “does it hold data?” The risk meter answers a different question: if that data got out, how much harm would it typically do? It rates the kind of data the equipment type can hold, not the odds that a particular unit leaks.
- High Regulated or highly sensitive records (health, financial, student, or criminal-justice data, identity documents), recordings of people, bulk business files, or credentials and keys that unlock other systems. Exposure is the kind most likely to bring breach-notification duties, regulators, or fraud. 49 of the 190 types are rated high.
- Medium Narrower data that can still be misused, such as admin and network passwords, network settings, account links, contacts, location history, health readings, voice or viewing history, or limited recordings. Rarely a reportable breach on its own, but it can open the door to systems that are.
- Low Settings, pairing lists, identifiers, usage logs, or at most a saved home Wi-Fi password and an app-account link (typical of connected kitchen and household appliances), plus every type rated “No user data”.
For a Depends device, the rating applies when the unit does hold data. A product line can be rated lower than its type when it has no storage at all. A low rating is never a reason to skip the data step. Use it to decide what to pull first and how much care and documentation each device needs; any device that held data should still be signed out, reset, wiped or destroyed, and recorded by serial number. Your contracts, regulators, and internal policy set the actual requirement, and a specific unit can hold more than its type usually does.
Equipment by setting
Pick a setting at the top of the tool to see every type it usually has, sorted by risk. Settings overlap: a clinic also has the printers, phones, and network gear of any office, so the healthcare list includes IT equipment as well as medical devices, and the home list covers household, consumer, and home-office electronics.
- Healthcare: 118 equipment types (44 high, 44 medium, 30 low risk). High-risk types to start with: Clinical comms badges, phones & nurse call, Clinical lab & point-of-care analyzers, Dental imaging & intraoral scanners, ECG/EKG carts, Holter & stress systems, Infusion pumps & smart pumps, Medical imaging (X-ray, CT, MRI), Medication & supply dispensing cabinets, Patient monitors & telemetry.
- Banking & finance: 78 equipment types (31 high, 27 medium, 20 low risk). High-risk types to start with: ATMs & teller cash recyclers, Check scanners & teller capture, Hardware security modules (HSMs), ID & driver's-license scanners, Mainframes & midrange systems, Backup tapes (LTO, DLT, DAT), Badge readers and access-control panels, Cellular failover & out-of-band routers.
- Retail & hospitality: 120 equipment types (34 high, 48 medium, 38 low risk). High-risk types to start with: ATMs & teller cash recyclers, Check scanners & teller capture, POS terminals & payment card readers, Handheld mobile computers, Hardware security modules (HSMs), ID & driver's-license scanners, Self-checkout & self-service kiosks, Mainframes & midrange systems.
- Education: 118 equipment types (30 high, 50 medium, 38 low risk). High-risk types to start with: POS terminals & payment card readers, Lab & analytical instruments, ID & driver's-license scanners, Self-checkout & self-service kiosks, Backup tapes (LTO, DLT, DAT), Badge readers and access-control panels, Cellular failover & out-of-band routers, Employee time clocks (incl. biometric).
- Government & public safety: 103 equipment types (35 high, 43 medium, 25 low risk). High-risk types to start with: In-car video & plate readers (ALPR), Police body-worn cameras & docks, Transit fare validators & ticket machines, Lab & analytical instruments, Handheld mobile computers, Hardware security modules (HSMs), ID & driver's-license scanners, Self-checkout & self-service kiosks.
- Manufacturing & industrial: 95 equipment types (28 high, 39 medium, 28 low risk). High-risk types to start with: Lab & analytical instruments, Handheld mobile computers, Backup tapes (LTO, DLT, DAT), Badge readers and access-control panels, Cellular failover & out-of-band routers, Employee time clocks (incl. biometric), Fax machines, Firewalls, UTM and VPN appliances.
- Logistics & transport: 87 equipment types (30 high, 33 medium, 24 low risk). High-risk types to start with: Transit fare validators & ticket machines, Handheld mobile computers, Self-checkout & self-service kiosks, Mainframes & midrange systems, Backup tapes (LTO, DLT, DAT), Badge readers and access-control panels, Cellular failover & out-of-band routers, Employee time clocks (incl. biometric).
- Offices & professional services: 103 equipment types (27 high, 46 medium, 30 low risk). High-risk types to start with: Check scanners & teller capture, Backup tapes (LTO, DLT, DAT), Badge readers and access-control panels, Cellular failover & out-of-band routers, Employee time clocks (incl. biometric), Fax machines, Firewalls, UTM and VPN appliances, Load balancers & network appliances.
- Data centers, IT & MSPs: 73 equipment types (28 high, 26 medium, 19 low risk). High-risk types to start with: Hardware security modules (HSMs), Mainframes & midrange systems, Backup tapes (LTO, DLT, DAT), Badge readers and access-control panels, Cellular failover & out-of-band routers, Employee time clocks (incl. biometric), Fax machines, Firewalls, UTM and VPN appliances.
- Home & home office: 110 equipment types (16 high, 50 medium, 44 low risk). High-risk types to start with: Home medical devices (CPAP, CGM, BP), Medical alert systems (PERS), Car infotainment & connected-car systems, Chromebooks & ChromeOS devices, Desktops, workstations & mini PCs, External hard drives & portable SSDs, Fire-alarm & intrusion alarm panels, Internal hard drives & SSDs.
Quick reference: what stores data
All 190 equipment types in the lookup, with their verdicts and risk ratings. Search above for a specific make or model family (1681 are listed).
Computing & mobile
| Equipment | Verdict | Risk | What it can hold |
|---|---|---|---|
| Laptops & notebooks | Stores data | High | documents, photos, email and downloaded files; saved passwords, browser history and cookies; cached email, chat and cloud-sync copies (OneDrive, iCloud, Google Drive, Dropbox) |
| Desktops, workstations & mini PCs | Stores data | High | documents, photos, email and downloaded files; saved passwords, browser history and cookies; local copies of business databases, accounting files and line-of-business app data |
| Thin clients & zero clients | Stores data | Medium | operating system image and device configuration; saved connection settings for Citrix, VMware/Omnissa, Microsoft RDP/AVD sessions; cached or saved usernames and passwords |
| Servers (rack, tower & blade) | Stores data | High | business databases, file shares, email and virtual machines; customer, employee, financial and health records; backups and snapshots |
| Chromebooks & ChromeOS devices | Stores data | High | downloaded files, photos and screenshots not synced to the cloud; signed-in Google account profiles and cached browser data; saved Wi-Fi networks |
| Tablets (iPad, Android, Windows) | Stores data | High | photos, videos and documents; email, messages and contacts; saved passwords and signed-in app accounts |
| Smartphones | Stores data | High | contacts, call history, text and chat messages; photos, videos and voicemail; email and signed-in app accounts |
| Feature phones (basic & flip phones) | Stores data | Medium | contacts and speed-dial entries; text (SMS/MMS) messages; call logs and voicemail settings |
| External hard drives & portable SSDs | Stores data | High | full backups of computers (Time Machine, Windows backup images); copied documents, photos and videos; exported databases, email archives and financial records |
| USB flash drives | Stores data | High | copied documents, spreadsheets and presentations; photos and videos; exported records and backups |
| Memory cards (SD, microSD, CF) | Stores data | High | photos and videos (cameras, phones, drones, dashcams, security cameras); documents and app data moved from phones or tablets; voice recordings |
| Optical discs (CD, DVD, Blu-ray) | Stores data | High | backups and archived files; scanned records, medical images and legal discovery sets; photos and home videos |
| Backup tapes (LTO, DLT, DAT) | Stores data | High | full and incremental backups of servers, databases and email; archived business, financial, legal and health records; file-system images and virtual machine backups |
| Docking stations & port replicators | No user data | Low | firmware only; the dock's own built-in network MAC address (not personal data) |
| E-readers & e-ink tablets | Stores data | Medium | signed-in store account (can be used to buy books); books, PDFs and personal documents loaded or emailed to the device; highlights, notes and handwritten notebooks |
| Internal hard drives & SSDs | Stores data | High | anything the host PC, server, NAS, DVR or copier stored: documents, email, databases, images; operating-system files with cached credentials, browser history and logs; deleted files and data in remapped/over-provisioned SSD blocks that normal deletion does not reach |
| Graphing & programmable calculators | Depends | Low | user programs and apps; notes, text and documents (e.g. TI-Nspire .tns files, TI-84 programs can hold any typed text); stored lists, matrices, variables and pictures |
| Hardware security modules (HSMs) | Stores data | High | cryptographic keys (root CA keys, code-signing, TLS, database and disk-encryption master keys); HSM partitions, key objects and Security World / domain data; administrator, crypto-officer and partition credentials |
| Security keys, smart cards & OTP tokens | Stores data | High | passkeys / FIDO2 resident credentials (site name, username and private key); PIV / PKI certificates and private keys; OTP / TOTP seeds and one-time-password secrets |
| Server components (RAID, BMC, NIC, DPU) | Depends | Medium | RAID cache contents (fragments of recently written data) preserved in flash or battery-backed memory; boot drives with a full OS image (M.2 boot cards such as Dell BOSS, HPE NS204i); BMC/iDRAC/iLO user accounts, passwords, certificates, licenses and event logs |
| GPUs & AI accelerator cards | No user data | Low | no user data in normal use: GPU memory (HBM/GDDR) is volatile and clears at power-off; firmware (VBIOS) and a small InfoROM with settings such as ECC mode and lifetime ECC error counters / retired pages; serial number and board identifiers |
| Tape libraries & autoloaders | Stores data | Medium | tape cartridges left in slots, drives or the mail slot (the biggest risk); library-managed encryption keys (some libraries store keys internally, e.g., Spectra BlueScale holds up to 30 keys); user accounts, passwords, SNMP/email settings and network configuration |
| Mainframes & midrange systems | Stores data | High | business data and databases on internal disks or attached storage; Crypto Express HSM master keys (each domain acts as its own HSM); Support Element / HMC drives with configuration (IOCDS, LPAR profiles), user IDs and logs |
Office & print
| Equipment | Verdict | Risk | What it can hold |
|---|---|---|---|
| Multifunction printers & copiers (MFPs) | Stores data | High | copies of scanned, copied, faxed and printed document images (job data that can remain after the job ends); stored, held and secure-print jobs, scan-to-box/document server files; received and sent faxes and fax logs |
| Office laser printers (single-function) | Depends | Medium | Wi-Fi network names and passwords, network settings and admin password; stored, held, PIN/secure print jobs and job logs (models with a disk or eMMC); email alert addresses, SNMP and directory settings, certificates |
| Inkjet printers & home all-in-ones | Depends | Medium | Wi-Fi network name and password, Wi-Fi Direct password; faxes held in memory, fax journal, caller ID and call history (fax models); speed-dial / address book entries |
| Wide-format printers & plotters | Depends | Medium | stored print jobs and job previews (CAD drawings, plans, posters); scanned images on models with a built-in scanner; job accounting logs with user and file names |
| Document scanners | Depends | Medium | Wi-Fi credentials, scanner name and network settings; scan-to-email, SMB/FTP and cloud destinations with saved logins (network models); LDAP/address books and user profiles on touchscreen models |
| Fax machines | Stores data | High | received faxes held in memory (memory receive, out-of-paper storage, fax forwarding); queued or delayed outgoing faxes; fax journal / activity report with numbers and names |
| Label printers & label makers | Depends | Low | stored label formats/templates and graphics that can include names, addresses, prices or patient/specimen details; recent label text on handheld label makers; Wi-Fi/network settings and certificates (industrial models support enterprise Wi-Fi) |
| Receipt printers (POS thermal) | Depends | Low | stored logo/header graphics (business name, address); network settings, Wi-Fi credentials and certificates on networked models; admin/web-config password |
| POS terminals & payment card readers | Stores data | High | cryptographic keys (PIN, data and terminal master keys); merchant ID, terminal ID and processor settings; unsettled batches and pending offline (store-and-forward) payments |
| Desk IP / VoIP phones | Stores data | Medium | SIP account usernames and passwords; call history (missed, received, placed); local contacts, directory cache and speed dials |
| Conference phones & video room systems | Depends | Medium | Teams Rooms, Zoom Rooms, Webex or GoTo room-account credentials and tokens; room calendar and meeting details; call history, directory and SIP/H.323 credentials |
| Projectors | Depends | Low | Wi-Fi network names and passwords; network menu and remote-control passwords; email alert addresses and mail server settings, SNMP settings, certificates |
| Interactive displays & whiteboards | Depends | Medium | signed-in Google, Microsoft or vendor accounts and cloud-drive connections; saved whiteboard files, screenshots and screen recordings; downloaded files, browser history and saved passwords |
| Digital signage players & screens | Stores data | Medium | content files (images, video, menus, schedules); CMS registration and cloud account tokens; Wi-Fi and network credentials, certificates |
| Employee time clocks (incl. biometric) | Stores data | High | employee names, badge/ID numbers and PINs; punch records and schedules; fingerprint or face templates (biometric data regulated by laws such as Illinois BIPA) |
| Paper shredders | No user data | Low | no data stored in the machine; shredded paper in the bin, sheets jammed in the cutters, and pages left in an auto-feed tray |
| Typewriters, calculators & desk gadgets | Depends | Low | text typed on a typewriter, readable on used single-strike film or correctable ribbons; a short correction memory on electronic typewriters; documents stored in memory or on floppy disks in word-processing typewriters |
Network & infrastructure
| Equipment | Verdict | Risk | What it can hold |
|---|---|---|---|
| Routers & mesh Wi-Fi | Stores data | Medium | admin usernames and passwords; Wi-Fi network names and passwords; ISP login (PPPoE) credentials |
| Modems, fiber ONTs & ISP gateways | Depends | Medium | on gateways with built-in Wi-Fi/router: Wi-Fi passwords, admin password, port forwards and connected-device lists; event logs and device MAC/serial identifiers; ISP provisioning data tied to your account |
| Managed and smart switches | Stores data | Medium | admin accounts and password hashes; SNMP community strings and SNMPv3 credentials; RADIUS/TACACS+ shared secrets and 802.1X settings |
| Unmanaged switches | No user data | Low | none in normal use: no configuration, accounts or logs (learned MAC addresses are held only in volatile memory and clear at power-off) |
| Firewalls, UTM and VPN appliances | Stores data | High | admin accounts, local VPN user accounts and password hashes; VPN pre-shared keys, certificates and private keys; LDAP/RADIUS bind credentials and API keys |
| Wireless access points & controllers | Stores data | Medium | Wi-Fi passwords (WPA2/WPA3 pre-shared keys); RADIUS shared secrets and 802.1X certificates; admin credentials and controller/cloud pairing information |
| Network-attached storage (NAS) | Stores data | High | every file stored on it: documents, photos, PC and server backups, databases, camera recordings; user accounts, passwords and shared-folder permissions; cloud sync and backup credentials (e.g. Microsoft 365, Google, S3 keys) |
| SAN, storage arrays and disk shelves | Stores data | High | all data written to the array: databases, virtual machine disks, file shares, email stores, backups; array admin accounts, replication and key-management credentials; cached write data in controller memory/NVRAM |
| UPS units & network cards | Depends | Low | basic units: none (only battery status and power-event counters); with a network management card: admin and user accounts and passwords; SNMP community strings, SNMPv3 and RADIUS settings |
| Power distribution units (PDUs) | Depends | Low | basic PDUs: none; metered/switched/intelligent PDUs: admin and user accounts, SNMP and LDAP/RADIUS credentials; network, email and syslog settings |
| KVM switches, IP KVMs and console servers | Depends | Medium | basic desktop KVMs: nothing beyond monitor EDID data and hotkey settings; IP KVMs and console servers: local user accounts and passwords, LDAP/RADIUS/TACACS+ credentials; SSL certificates and SSH keys |
| IP security cameras | Stores data | Medium | video recordings and snapshots on a microSD card or onboard storage; admin credentials and Wi-Fi passwords; recorder, VMS and cloud account pairing; FTP/email/SMB upload credentials |
| NVRs and DVRs (video recorders) | Stores data | High | recorded video and snapshots from every connected camera; user accounts and passwords for the recorder and its cameras; remote-viewing (P2P/cloud) account bindings and email/FTP credentials |
| Badge readers and access-control panels | Stores data | High | cardholder database: names, badge numbers, PINs and access schedules; door event logs showing who went where and when; credential encryption keys and OSDP secure-channel keys |
| Load balancers & network appliances | Stores data | High | SSL/TLS private keys and certificates for your websites and apps; admin accounts and LDAP/RADIUS/API credentials; application and network configuration |
| Media converters, patch panels & optics | No user data | Low | none: transceivers carry a small EEPROM with factory vendor, part and serial data; stand-alone media converters only have DIP-switch settings; patch panels are passive |
| IP-PBX systems & voice gateways | Stores data | Medium | voicemail messages and greetings; call recordings; call detail records (who called whom, when, how long) |
| Fibre Channel SAN switches & directors | Stores data | Medium | zoning (which servers can see which storage, by WWN); admin accounts, passwords, RADIUS/TACACS/LDAP secrets and SNMP strings; certificates and SSH keys |
| Cellular failover & out-of-band routers | Stores data | High | SIM card (carrier account and phone number); APN, carrier and VPN settings, keys and certificates; admin passwords and remote-management (cloud) enrollment |
Consumer, smart home & peripherals
| Equipment | Verdict | Risk | What it can hold |
|---|---|---|---|
| Smart TVs | Stores data | Medium | streaming app logins (Netflix, YouTube, Prime Video, etc.) and the TV platform account (Samsung, LG, Roku, Google, Amazon); Wi-Fi network name and password; viewing history and automatic content recognition (ACR) data, plus voice-search history on voice-enabled models |
| Basic (non-smart) TVs | No user data | Low | channel list, input names and picture/sound settings only (not personal); a parental-control PIN, if one was set |
| Computer monitors (standard) | No user data | Low | EDID display identification written at the factory (manufacturer, model, serial number, manufacture date, supported resolutions)—not personal data; on-screen menu settings such as brightness, color mode and input |
| Smart monitors (built-in TV apps) | Stores data | Medium | streaming app logins and the Samsung or LG account; Wi-Fi network name and password; Microsoft 365 web sign-in and remote-PC connection details on Samsung models that offer them |
| TV & streaming remotes | No user data | Low | pairing information for the TV or streaming device it controls; button or device-code programming on universal remotes |
| Streaming devices (sticks & boxes) | Stores data | Medium | streaming app logins and the platform account (Roku, Amazon, Apple, Google); Wi-Fi network name and password; viewing history and voice-search requests (mostly held in the account) |
| Smart speakers & Wi-Fi speakers | Stores data | Medium | voice recordings and request history (kept in the Amazon, Google or Apple account); Wi-Fi network name and password; linked music-service, calendar and smart-home accounts |
| Smart displays | Stores data | Medium | voice recordings and request history (in the account); video-call history, contacts and camera access on models with cameras; photo albums shown as a slideshow (synced from Amazon Photos, Google Photos or Facebook) |
| Video game consoles | Stores data | Medium | gamer accounts (PlayStation Network, Microsoft/Xbox, Nintendo Account) and saved sign-ins; saved payment methods and purchase history through the account; game saves, screenshots and video captures |
| Smartwatches, fitness trackers & wearables | Stores data | Medium | health and fitness data (heart rate, sleep, workouts, ECG/SpO2 readings, cycle tracking where used); GPS routes and location history; payment cards for contactless pay (Apple Pay, Google Wallet, Garmin Pay, Fitbit Pay) |
| Home security cameras & video doorbells | Stores data | Medium | recorded video clips and snapshots (in the cloud account, on a microSD card, or on a local base station or NVR); Wi-Fi network name and password; account link, shared users and access history |
| Smart thermostats | Stores data | Medium | Wi-Fi network name and password; heating/cooling schedules and home/away (occupancy) history that reveal when the home is empty; account link and home location used for weather |
| Smart home hubs, locks, plugs & bulbs | Stores data | Medium | Wi-Fi network name and password; door access codes, user lists and lock/unlock history; device lists, automations, routines and scenes that reveal your daily schedule |
| VR & mixed-reality headsets | Stores data | Medium | Meta account or Apple Account sign-in, purchases and payment methods; saved Wi-Fi passwords; room/boundary scans of your home and hand- or eye-tracking settings |
| Digital cameras, camcorders & action cams | Stores data | Medium | photos and videos on the memory card, and on built-in memory in some camcorders, compacts and action cams; GPS location tags in photo and video metadata; Wi-Fi and Bluetooth connection settings, including paired phones and network passwords |
| Consumer camera drones | Stores data | Medium | photos and videos on the microSD card and the drone's internal storage; flight logs with GPS positions and home points; account link and activation details (email, serial number) |
| Keyboards & mice | No user data | Low | Bluetooth or USB-receiver pairing; on gaming/programmable models: DPI, lighting, button and macro profiles in onboard memory |
| Headphones, earbuds & headsets | No user data | Low | a list of paired Bluetooth devices (phone or computer names); sound, EQ and noise-cancelling settings; an account/Find My link on some models (e.g., AirPods pair with one Apple Account at a time) |
| Bluetooth speakers & soundbars | No user data | Low | a list of paired Bluetooth devices; sound and EQ settings |
| USB webcams | No user data | Low | firmware and image settings (zoom, exposure, white balance) on some models; no photos, video or audio are stored on the webcam itself |
| Chargers, cables, power banks & adapters | No user data | Low | none—chargers, cables, adapters and power banks don't store user data |
| Cordless & landline phones | Stores data | Medium | phonebook / contact names and numbers (often stored separately on each handset); caller ID log and redial list; recorded voicemail messages and the owner's greeting (digital answering machines, usually in the base) |
| Bluetooth item trackers & GPS tags | Stores data | Medium | a cryptographic pairing to the owner's account (Apple Find My Lock, Tile/Life360, Samsung SmartThings Find, Google Find Hub); the owner's location history and lost-mode contact details (held in the linked account); on cellular GPS tags: location history, geofences and the account or subscription |
| Garage door & gate openers (smart) | Stores data | Medium | home Wi-Fi network name and password; link to the owner's cloud account (remote open/close, sharing with family members or delivery services); open/close event history with timestamps (cloud, sometimes on the device) |
| Smart sprinkler, water & pool controllers | Depends | Low | home Wi-Fi network name and password; link to the owner's account, including the property address or map location used for weather-based watering; watering or pool/spa schedules and run history |
| Smart pet feeders & GPS collars | Stores data | Medium | home Wi-Fi network name and password and the owner's account link; pet profiles, including names, photos and weights logged by litter boxes or feeders; camera feeders: video clips and snapshots of the home (cloud or microSD) |
| Smart scales, sleep trackers & smart beds | Depends | Medium | weight and body-composition history for one or more user profiles (stored on the scale until synced); sleep, heart-rate, breathing and snoring data (under-mattress sensors, smart beds); home Wi-Fi network name and password and the owner's account link |
| AV receivers, amps & network streamers | Depends | Medium | Wi-Fi network name and password; streaming-service sign-ins (Spotify Connect, TIDAL, Pandora, Amazon Music and similar); link to a HEOS / MusicCast / BluOS / WiiM app account |
| Blu-ray, DVD & CD players, turntables | Depends | Medium | streaming-app sign-ins (Netflix, YouTube, Prime Video and similar) on networked Blu-ray players; Wi-Fi network name and password; Bluetooth pairing list |
| Cable & satellite TV boxes and DVRs | Stores data | Medium | recorded shows on a local DVR hard drive; viewing history, favorites, series recordings and recommendations; link to the provider account; parental-control and purchase PINs |
| VCRs, DVD recorders & tapes (legacy AV) | Depends | Medium | home videos and recorded TV on VHS, VHS-C, MiniDV and Hi8 tapes; recordings on a DVD recorder's hard drive and on recordable DVDs; voice and music recordings on audio cassettes, microcassettes and MiniDiscs |
| Digital pianos, synths & DJ gear | Depends | Low | songs and performances recorded to internal memory; user presets, registrations/setups and user samples; files on a USB flash drive or SD card left in the slot |
| Game controllers, wheels & accessories | Depends | Low | Bluetooth or wireless pairing with a console, PC or phone; button-mapping and sensitivity profiles on 'pro' controllers such as Xbox Elite Series 2 and DualSense Edge; exceptions: an amiibo stores a nickname, user data and game data; a PlayStation Portal is signed in to a PSN account |
Healthcare & medical
| Equipment | Verdict | Risk | What it can hold |
|---|---|---|---|
| Patient monitors & telemetry | Stores data | High | patient name, MRN/ID, date of birth and bed/location from admission (ADT); vital-sign trends, waveforms, alarms and events (days of full-disclosure waveforms on central stations); network and Wi-Fi settings, certificates and HL7/EMR interface configuration |
| Ultrasound systems (cart & handheld) | Stores data | High | patient name, ID, date of birth, accession number and exam indications; stored images, cine clips, measurements and reports; DICOM/PACS, worklist and network settings; user logins |
| Medical imaging (X-ray, CT, MRI) | Stores data | High | patient demographics, MRN and exam/accession data; diagnostic images and series kept locally or awaiting transfer; DICOM modality worklist, PACS destinations and network credentials |
| Infusion pumps & smart pumps | Stores data | High | infusion history and event logs (drug, dose, rate, times; patient and clinician IDs on EMR-integrated pumps); drug library (formulary and dosing limits); Wi-Fi SSID and pre-shared key or enterprise credentials, certificates and server addresses |
| ECG/EKG carts, Holter & stress systems | Stores data | High | patient name, ID, age/date of birth and order information; stored 12-lead ECGs, interpretations and Holter recordings; connection settings for the ECG management system (e.g., MUSE, IntelliSpace ECG) and Wi-Fi |
| Defibrillators & AEDs | Stores data | Medium | rescue/event records: ECG waveforms, shocks delivered, CPR quality data and times (some models also record audio); on monitor/defibrillators: patient name/ID, vital-sign trends and 12-lead ECGs; Wi-Fi or cellular settings on connected AEDs that report readiness to an online program portal |
| Clinical lab & point-of-care analyzers | Stores data | High | patient IDs and test results with dates and times; operator IDs and certification/lockout lists; QC and calibration records |
| Medication & supply dispensing cabinets | Stores data | High | patient names, MRNs, room/bed and active medication orders (profiles); dispense, waste, return and override transaction history; user IDs, passwords and fingerprint (biometric) templates |
| Medication carts & computers on wheels | Depends | Medium | user PIN codes and badge (proximity card) IDs; access/audit logs of who opened the cart and when; whatever the mounted computer, thin client, laptop or tablet stores |
| Home medical devices (CPAP, CGM, BP) | Stores data | High | therapy and usage data (CPAP hours, leak, events; pressure prescription); glucose readings, insulin doses, blood-pressure and pulse readings with dates and times; hearing-aid fitting settings and usage data-logging |
| Dental imaging & intraoral scanners | Depends | High | patient name, ID/date of birth and chart links; dental X-rays, CBCT volumes, intraoral photos and 3D scans; imaging-software credentials, network shares and vendor cloud account links |
| Clinical comms badges, phones & nurse call | Stores data | High | secure messages, alarm and alert notifications that can include patient names and rooms; call logs, contacts and staff directory; user logins and Wi-Fi credentials/certificates (e.g., WPA2 pre-shared keys) |
Retail, banking & hospitality
| Equipment | Verdict | Risk | What it can hold |
|---|---|---|---|
| Self-checkout & self-service kiosks | Stores data | High | transaction and sales logs, electronic journals and receipts; store/back-office network credentials, Wi-Fi passwords and certificates; app or kiosk-software configuration, cached menus/customer orders and loyalty lookups |
| ATMs & teller cash recyclers | Stores data | High | electronic journal of transactions (card numbers are usually masked, but times, amounts and account references are logged); operator, service and master passwords and host communication settings; encryption keys in the encrypting PIN pad (EPP) |
| ID & driver's-license scanners | Stores data | High | names, dates of birth, home addresses and driver's-license / ID numbers parsed from the barcode or MRZ; images of the front and back of IDs and passports, cropped ID photos and live face photos; visit/scan history with dates and times, ban or flag lists |
| Handheld mobile computers | Stores data | High | app data: orders, inventory, deliveries, customer names/addresses and signatures captured in line-of-business apps; Wi-Fi (WPA2-Enterprise) credentials, VPN and MDM certificates; user logins, email and cached corporate accounts |
| Barcode scanners | Depends | Low | batched barcode data (inventory counts, item codes, shipment or patient wristband IDs) held until uploaded; Bluetooth pairing records and, on Wi-Fi models, network settings; scanner configuration |
| Check scanners & teller capture | Depends | High | front and back images of checks, including MICR account and routing numbers; deposit batches and capture logs (usually on the host PC or capture app); network settings and credentials on Ethernet or network-appliance models |
| Electronic signature pads | Depends | Medium | display images, prompts and slideshow images stored in on-board flash; signatures and PIN/keypad entries are normally sent to the host and not kept on the pad |
| Hotel key-card lock systems | Stores data | Medium | guest names, room assignments and stay dates on the lock-management server/front-desk workstation and PMS interface; lock audit trails: which key card or staff key opened which door and when (e.g. VingCard locks keep a 2000-event audit trail); site encryption keys and system codes used to make valid key cards |
| Currency counters & smart safes | Depends | Medium | user PINs/IDs and audit trails of who opened or deposited (smart safes and audit safe locks); deposit, shift and transaction reports; check images and bank-note serial number images on check-capable discriminators (e.g. JetScan iFX i100) |
| Postage meters & mailing systems | Stores data | Medium | recipient and sender address books (SendPro and similar shipping-capable models); cost-center/department account names and postage usage reports; postage funds, postage-account and carrier account links |
| Electronic cash registers | Stores data | Medium | electronic journal of every sale (items, amounts, times); sales totals and reports by department, clerk and period; clerk names/numbers and PLU/price lists |
Industrial, lab & facilities
| Equipment | Verdict | Risk | What it can hold |
|---|---|---|---|
| PLCs, HMIs & industrial PCs | Stores data | Medium | control programs and ladder logic (process know-how / intellectual property); HMI screen projects, recipes, setpoints and data/alarm logs; network settings (IP addresses, gateways, routes) for the plant network |
| Lab & analytical instruments | Stores data | High | raw run data and results (chromatograms, spectra, sequencing runs); sample names and IDs, which can include patient or study-participant identifiers and genomic data; methods, SOP parameters and proprietary assay/formulation details |
| 3D printers | Stores data | Medium | print files and queued jobs (sliced G-code or vendor job files derived from your CAD models — design IP); print history and logs; camera snapshots and time-lapse videos on camera-equipped models |
| CNC machines & laser cutters | Stores data | Medium | part programs (G-code), macros and job files — customer drawings and process IP; tool tables, work offsets and machine settings; laser design files, saved jobs and material settings |
| Building automation & HVAC controllers | Stores data | Medium | user accounts and passwords for operators and integrators; system configuration/station database, schedules and floor-plan graphics; trend, alarm and audit history (can reveal occupancy patterns) |
| Fire-alarm & intrusion alarm panels | Stores data | High | user codes/PINs, user names and access levels; installer/dealer programming codes; event and alarm history (who armed/disarmed and when) |
| EV chargers (home & commercial) | Depends | Medium | Wi-Fi password and network settings; charging session history (times, energy used); link to the owner's app/cloud account |
| Two-way radios & push-to-talk devices | Depends | Medium | codeplug: frequencies, talkgroups, system and unit IDs, contact and scan lists; encryption keys (P25/DMR secure radios); radio read/write passwords |
| Test & measurement and network testers | Depends | Medium | saved waveforms, measurement results and screenshots; instrument setups; cable/network test results with job, site and customer names |
| Solar inverters, home batteries & gateways | Depends | Medium | home or business Wi-Fi password and network settings; energy production and consumption history (can reveal occupancy patterns); link to the owner's monitoring account and installer account |
| Data loggers & monitoring gateways | Depends | Low | measurement history (temperature, humidity, CO2, power) — often regulated records for vaccines, food or GxP; alert contact lists (names, phone numbers, email addresses); Wi-Fi passwords, SNMP/SMTP credentials and network settings |
Vehicles, appliances & more
| Equipment | Verdict | Risk | What it can hold |
|---|---|---|---|
| Robot vacuums & robot mops | Stores data | Medium | floor-plan maps of the home or office, including room names and no-go zones; Wi-Fi network name and password; link to the owner's app/cloud account, cleaning schedules and history |
| Smart appliances (fridges, washers, ovens) | Depends | Medium | Wi-Fi network name and password; manufacturer account link (SmartThings, LG ThinQ, SmartHQ, Whirlpool, Home Connect); on touchscreen models: signed-in accounts, calendars, notes, photos, shopping lists and music/streaming logins |
| Car infotainment & connected-car systems | Stores data | High | phone contacts and call logs synced from paired phones (text messages on some systems); list of paired Bluetooth phones and devices; navigation history plus home, work and saved addresses |
| Fleet telematics units & ELDs | Stores data | Medium | GPS location history and trips; driver identities and hours-of-service (HOS) logs; engine and diagnostic data (speed, odometer, fault codes, harsh-driving events) |
| Dash cams | Stores data | Medium | video and audio of the road and, on dual-facing models, the cabin and its occupants; GPS location, time and speed stamped on footage; event/incident clips and parking-mode recordings |
| GPS navigators & satellite communicators | Stores data | Medium | home and work addresses and saved favorites; recent destinations and travel/trip history; tracks and waypoints (handhelds) |
| Baby & pet monitors | Depends | Medium | live and recorded video/audio of a child's room or the home interior; sleep, breathing and (Owlet) heart-rate/oxygen readings; Wi-Fi network name and password |
| Mobile hotspots, cell modems & SIMs | Stores data | Medium | Wi-Fi network name/password and admin password; list of connected devices and data-usage history; SMS messages (models with a message inbox) |
| Connected fitness equipment | Stores data | Medium | user profiles, names, photos/avatars and workout history; streaming-service account login; heart-rate and body metrics (weight, age, height) |
| Digital photo frames | Stores data | Medium | family and personal photos and videos; frame email address and list of approved senders; app/cloud account link and member list |
| Connected toys & kids' watches | Depends | Medium | a child's name, age, photo and voice recordings; contacts list, voice/text/photo messages and call log (kids' cellular watches); the child's location history, saved places and geofences |
| E-bikes & electric scooters | Depends | Low | binding to the owner's app account (digital key, unlock/lock, anti-theft alarm); ride history and routes, and GPS location (models with a GPS or cellular module, or Apple Find My); the owner's PIN or lock code and paired phone |
| Portable media players & voice recorders | Stores data | Medium | recordings of meetings, interviews, dictation and calls, which may include patient, client or legal details; music, audiobooks, podcasts and photos; on iPod touch and some players: Apple Account, contacts, calendars, notes and Wi-Fi passwords |
| Weather stations & air-quality monitors | Depends | Low | home or business Wi-Fi network name and password; link to the owner's account and any API or upload keys (e.g. Weather Underground station key); the station's exact location, which is often published on public weather maps |
Education, public safety & government
| Equipment | Verdict | Risk | What it can hold |
|---|---|---|---|
| Police body-worn cameras & docks | Stores data | High | recorded video and audio of incidents, suspects, victims and bystanders (evidence); GPS/location embedded in recordings; officer and device assignment details |
| In-car video & plate readers (ALPR) | Stores data | High | patrol video and audio (front, cabin/rear-seat cameras); license-plate reads with photos, time and location; hotlists of wanted plates (criminal justice information) |
| Parking pay stations & smart meters | Stores data | Medium | payment card data (card number and track data in memory while processing; may be held encrypted while offline); license plate numbers and space numbers entered by drivers; transaction, audit and collection logs |
| Library self-checkout & RFID kiosks | Stores data | Medium | patron barcodes/card numbers and names shown during checkout; transaction and error logs that can contain patron identifiers; SIP2 / ILS service-account credentials and server addresses |
| Smart lockers & package lockers | Depends | Medium | resident/employee/student names, unit numbers, phone numbers and emails; pickup codes and delivery/pickup logs; photos or signatures captured at pickup (some systems) |
| Visitor management & room schedulers | Stores data | High | visitor names, photos, signatures and signed NDAs/waivers; ID scans (name, date of birth, ID photo) and watch-list check results; host/employee directory |
| IP intercoms & telephone entry systems | Depends | Medium | resident/tenant directory: names, unit numbers, phone numbers; keypad entry codes and RFID/PIN credentials; entry/transaction logs and time-stamped photos or video of visitors |
| Document cameras & classroom audio | Depends | Low | captured images and recorded video/audio of lessons (and students); files on SD cards or USB drives left in the unit; network/Wi-Fi settings on networked models |
| Emergency call boxes & mass notification | Depends | Low | SIP extension, username and password; programmed emergency dial numbers; Wi-Fi/802.1X credentials or certificates |
Logistics, warehouse & transport
| Equipment | Verdict | Risk | What it can hold |
|---|---|---|---|
| RFID readers, encoders & portals | Depends | Low | reader configuration: IP/network settings, Wi-Fi and 802.1X settings; admin user accounts and passwords; MQTT/cloud endpoints, API keys and certificates |
| Warehouse robots & AMRs | Stores data | Medium | facility maps and floor plans (site layout, zones, restricted areas); user accounts and passwords for the robot web interface; Wi-Fi network names, passwords and certificates |
| Voice-picking headsets & terminals | Depends | Low | operator IDs and operator voice templates (speech-recognition training); in-progress task, order and pick records not yet sent to the host; lookup tables and output data records |
| Shipping scales & dimensioners | Depends | Low | package images (JPEG) and dimension/weight records (CSV/XML); scanned barcodes, tracking and order numbers; transaction logs on legal-for-trade terminals |
| Forklift telematics & access systems | Stores data | Medium | operator access lists (badge numbers, keypad PINs/codes, certifications); activity and utilization records by operator; impact events and pre-shift checklist answers |
| Aviation EFBs & avionics | Stores data | Medium | flight and engine data logs (position, speeds, engine parameters); track logs, flight plans and user waypoints; pilot profiles and settings |
| Marine chartplotters, sonar & AIS | Stores data | Medium | waypoints, routes and tracks (where you fish, anchor and travel); custom sonar/depth maps; vessel identity: MMSI, name and call sign |
| Transit fare validators & ticket machines | Stores data | High | fare transaction records (card IDs, times, stops/routes); payment card data in process and payment logs; fare tables and card deny/hot lists |
| Commercial drones & drone docks | Stores data | Medium | photos, video, thermal and mapping imagery; flight logs with GPS tracks and mission/route files; controller account logins, passwords and pairing data |
Household, kitchen & personal care
| Equipment | Verdict | Risk | What it can hold |
|---|---|---|---|
| Coffee makers & espresso machines | Depends | Low | home Wi-Fi network name and password (Wi-Fi models); link to the owner's app account (Keurig, Nespresso, De'Longhi Coffee Link, Breville, JURA, Fellow); saved drink recipes and named user profiles |
| Microwave ovens | Depends | Low | home Wi-Fi network name and password (Wi-Fi models); link to an Amazon Alexa account or the maker's app account (SmartHQ, SmartThings, LG ThinQ); on commercial units: programmed menu pads (cooking times, not personal data) |
| Toasters, toaster ovens & smart ovens | Depends | Low | home Wi-Fi network name and password (Wi-Fi models); link to the owner's app account and meal-kit or recipe subscription (Tovala, Brava, June, Anova, Breville); on camera ovens: images or video of food taken inside the oven, held in the app/cloud |
| Air fryers | Depends | Low | home Wi-Fi network name and password (smart models); link to the owner's app account (VeSync, Philips HomeID, Instant Connect and others), including voice-assistant links; saved recipes, presets and cook history (mostly in the app/cloud) |
| Multicookers, slow & rice cookers | Depends | Low | home Wi-Fi network name and password (Wi-Fi models); link to the owner's app account (Instant Connect, Wemo/Crock-Pot app) and voice-assistant links; saved recipes and cook history (mostly in the app/cloud) |
| Blenders, mixers & food processors | Depends | Low | link to the owner's recipe account (Thermomix Cookidoo) and home Wi-Fi password (Thermomix TM6/TM7); Bluetooth pairing and custom blending programs sent from an app (Vitamix Ascent with Perfect Blend); on plain blenders and mixers: nothing |
| Electric kettles | Depends | Low | home Wi-Fi network name and password (Wi-Fi models); link to the owner's app account (Govee, VeSync, Fellow) or Amazon Alexa account; clock, schedule and temperature presets |
| Sous vide cookers & smart thermometers | Depends | Low | home Wi-Fi network name and password (Wi-Fi circulators, MEATER Block/Pro XL, ThermoWorks Signals); link to the owner's app or cloud account (Anova, Breville+, MEATER Cloud, ThermoWorks); Bluetooth pairings, cook history and alarms (mostly in the app/cloud) |
| Grills & smokers (Wi-Fi and plain) | Depends | Low | home Wi-Fi network name and password (Wi-Fi controllers); link to the owner's app account (Traeger, Weber Connect, Pit Boss, Camp Chef, recteq, Masterbuilt); cook history, saved recipes and probe alarms (mostly in the app/cloud) |
| Commercial kitchen equipment (connected) | Depends | Medium | HACCP temperature logs and cook records; stored cooking programs and recipe libraries (often proprietary); network settings (IP, Wi-Fi) and cloud registration (Rational ConnectedCooking, Welbilt KitchenConnect, Alto-Shaam ChefLinc, Unox) |
| Mini fridges, ice makers & water coolers | Depends | Low | home Wi-Fi network name and password and an app account link (Wi-Fi models such as GE Profile Opal 2.0); on everything else: only temperature and mode settings |
| Electric toothbrushes & water flossers | Depends | Low | brushing session history (date, duration, pressure, coverage) on app-connected handles until synced; app account (name, email) and oral-care goals or questionnaire answers; Bluetooth pairing with your phone |
| Electric shavers, trimmers & IPL devices | Depends | Low | shaving session history (date, duration, frequency) on app-connected shavers until synced; app account, registered product and serial number, optional skin selfies in the app; Bluetooth pairing with your phone |
| Hair dryers, straighteners & stylers | Depends | Low | hair profile and styling preferences in the companion app (app-connected stylers only); Bluetooth pairing with your phone |
| Home thermometers & pulse oximeters | Depends | Medium | temperature or SpO2 / pulse readings with dates and times; family member profiles (names, ages) in the app; overnight oxygen recordings on wearable oximeters |
| Medical alert systems (PERS) | Stores data | High | subscriber's name, home address and medical notes held by the monitoring center; emergency contacts (care circle) and lockbox code; GPS location and alert / fall history on mobile units |
| Massage guns, massage chairs & recovery | Depends | Low | app account (name, email) and recovery routines; session history synced from Bluetooth massage guns and compression systems; fitness data imported from wearables into the app |
| Heating pads & electric blankets | Depends | Low | Wi-Fi network name and password (Wi-Fi models); link to the maker's app account and voice-assistant (Alexa / Google) links |
| Power wheelchairs, scooters & stairlifts | Depends | Medium | usage, mileage, seating/positioning history and battery data on connected chairs; GPS location (only if location services are enabled); owner name, contact details and chair serial number in the maker's account |
| Personal safety alarms & SOS wearables | Depends | Medium | emergency contacts and app account; precise location sent during alerts; medical information shared with responders (some apps) |
| Alarm clocks & clock radios | Depends | Medium | Wi-Fi network name and password (connected clocks); link to an Amazon, Google or maker account; voice recordings and request history (voice-assistant clocks, stored in the account) |
| Lamps, bulbs & smart lighting | Depends | Low | Wi-Fi network name and password (Wi-Fi bulbs, switches and strips); link to the maker's app account and cloud; device certificates or keys in firmware |
| Fans, heaters, purifiers & room AC | Depends | Low | Wi-Fi network name and password (app-connected models); link to the maker's app account (MyDyson, VeSync, Coway, Midea, Frigidaire, etc.); schedules and settings |
| Smoke & carbon monoxide alarms | Depends | Low | Wi-Fi network name and password (Wi-Fi alarms and base stations); link to an app account (Google Home/Nest, Kidde, Onelink, X-Sense); room/location names and home address in the account |
| Vacuums & floor cleaners (non-robot) | Depends | Low | Wi-Fi network name and password (app-connected floor washers and sticks); link to the maker's app account; cleaning history and usage statistics (app models) |
| Sewing, embroidery & cutting machines | Depends | Low | saved stitch combinations and embroidery designs in machine memory; Wi-Fi network name and password (wireless models); machine name and app registration (Artspira, mySewnet, My Stitch Monitor) |
| Robot lawn mowers | Stores data | Medium | map of your yard and boundary/no-go zones (GPS/RTK or vision-based); home location (GPS position); PIN code and theft-protection settings |
| Lawn mowers, trimmers & leaf blowers | Depends | Low | none on ordinary gas, corded and battery tools (battery packs may log charge cycles and temperature, which is not personal data); on app-connected mowers and tools (EGO Connect, STIHL Smart Connector / STIHL connected, RYOBI app): Bluetooth pairing, product registration, operating hours and usage logs, and on EGO connected mowers a record of where and how long you mowed |
| Power tools & tool batteries | Depends | Low | owner/company inventory record and tool ID in a tracking app (ONE-KEY, Tool Connect); tool lock status and custom tool settings; usage and torque logs on some app-connected tools |
| Water heaters, softeners & leak shutoffs | Depends | Low | Wi-Fi network name and password (connected models); link to the maker's app account and home address/location; water-use and leak history, temperature and energy-use history |
| Surge protectors, power strips & cords | Depends | Low | none on plain strips and cords; Wi-Fi network name and password (smart strips); link to the maker's app account, outlet names and schedules (smart strips) |
| Irons, steamers & other small appliances | Depends | Low | nothing on ordinary models: settings and a timer at most; Wi-Fi network name and password and an app-account link on the rare app-connected model |
Questions people ask
Do computer monitors store data?
A standard monitor doesn’t store your files, logins, or anything that appeared on screen. It keeps a small block of factory identification data (EDID: maker, model, serial number, supported resolutions) and its own menu settings. The exceptions are “smart” monitors that run apps or streaming services on their own, which store accounts and Wi-Fi passwords like a smart TV. A standard monitor needs no data step before recycling.
Do routers and network switches store sensitive data?
Yes. Managed switches, routers, firewalls, and wireless controllers keep their configuration in flash or NVRAM, and that configuration typically includes administrator credentials, SNMP community strings, VPN keys and certificates, and network maps, plus logs. NIST SP 800-88 Rev. 2 treats network devices as media that need sanitization. Use the vendor’s secure factory reset or zeroize command, and destroy the device if it can’t be verified. Unmanaged switches are the exception: they hold no configuration or user data.
Does a UPS or a PDU store data?
A basic UPS or power strip doesn’t. Models with a network management card (APC NMC, Eaton Network-M2, Tripp Lite WEBCARD) or a managed or switched PDU store user accounts, passwords, SNMP and email settings, and event logs. If it has an Ethernet port or a network card, reset it to factory defaults before it leaves.
Do keyboards, mice, remotes, or headphones store personal data?
Not in normal use. They keep only pairing information or onboard profiles (lighting, button mapping, macros). The one caution: a gaming keyboard or mouse macro can record typed text, so clear stored macros if anyone might have recorded a password into one. Universal remotes set up through a Wi-Fi hub are different: the hub stores Wi-Fi and account details.
Do medical devices store patient data?
Most networked or computerized ones do. Patient monitors, ultrasound and imaging systems, infusion pumps, ECG carts, analyzers, and dispensing cabinets can hold protected health information (names, record numbers, readings, images, drug libraries, and logs) on internal drives or flash, sometimes long after the patient has left. HHS expects PHI to be removed from devices before they are reused or disposed of. Clear patient data with the manufacturer’s documented procedure or have biomed or the vendor decommission the device, and destroy or sanitize any drive with a serialized certificate.
Do cars and fleet vehicles store personal data?
Yes. Infotainment systems keep paired phones, contacts, call and text history, navigation history, and garage-door codes, and telematics units, ELDs, and dash cams add locations, driving events, and video. The FTC advises deleting this data and unlinking connected-car accounts before selling or returning a vehicle. Do a factory or master reset of the infotainment system, remove the vehicle from the maker’s app, and have fleet devices deactivated and reset by the telematics provider.
Do everyday appliances like coffee makers, toothbrushes, or alarm clocks store data?
Ordinary ones don’t: a drip coffee maker, a plain toaster, a basic alarm clock, or a manual toothbrush charger holds nothing personal. The app- and Wi-Fi-connected versions are different. A smart coffee maker, oven, air fryer, or kettle keeps your Wi-Fi password and a link to your app account; a connected toothbrush keeps recent brushing sessions on the handle until it syncs; a smart alarm clock with a voice assistant is tied to an Amazon or Google account and its voice history. If it pairs with a phone app, joins Wi-Fi, or answers to a voice assistant, remove it from the app and factory reset it before it leaves. Search the lookup for the specific model.
What does the risk meter mean?
The verdict says whether a device stores data; the risk meter says how much harm exposing that data would typically cause. High means the equipment can hold regulated or highly sensitive records (health, financial, student, or criminal-justice data, identity documents), recordings of people, bulk business files, or credentials and keys that unlock other systems. Medium means narrower data that can still be misused, such as admin and network passwords, network settings, account links, contacts, location history, health readings, or voice and viewing history. Low means settings, pairing lists, identifiers, usage logs, or at most a saved home Wi-Fi password, which rarely matter on their own (change the Wi-Fi password if a connected appliance goes missing). For a “Depends” device, the rating applies when the unit does hold data.
Does a low risk rating mean I can skip the data step?
No. The rating helps you decide what to handle first and how much care and documentation it needs; it is not permission to skip anything. Any device that held data should be signed out, reset, wiped or destroyed, and recorded by serial number, whatever its rating. A specific unit can also hold more than its type usually does, and your contracts, regulators, and internal policy set the actual requirement.
What should I do if my device isn’t in the list?
Use the three questions under “Not listed?”. If the device connects to a network or an account, has a screen or keypad you sign in to, or saves files, scans, recordings, or photos, treat it as data-bearing until the spec sheet says otherwise. When in doubt, handle it like a computer: sign out, factory reset, and sanitize or destroy the storage with a serialized certificate.
Sources: manufacturer documentation and support pages for each device type (cited in every result), NIST SP 800-88 Rev. 2, the FTC’s guidance on digital copiers and on disposing of computers and phones, and NSA network infrastructure guidance. Current as of October 2026. Verdicts describe typical configurations; a specific unit can differ, so when the stakes are high, check the spec sheet or treat the device as data-bearing. This tool is general information, not a guarantee about any individual device.