What is the decommissioning process?
In 2026, the decommissioning process in OCI is a rigorous, highly automated lifecycle that ensures no customer data ever "leaks" from one rental to the next. Oracle follows a defense-in-depth approach to wiping data, adhering to strict international standards like NIST 800-88.
The process happens in four distinct stages:
When you terminate a server or a storage volume:
Immediate Severance: The control plane immediately removes all API and network access to that resource.
Pointer Deletion: The metadata and file system pointers that tell the hardware "where your data is" are deleted. To the system, the disk blocks now appear as empty, unallocated space.
Once the hardware is unallocated, OCI’s backend automation begins sanitizing the physical media before it can be rented to another customer.
Standard Storage: OCI follows NIST 800-88 "Clear" standards, which involve overwriting the blocks with non-sensitive data (zeros or random patterns) to prevent "keyboard-level" data recovery.
NVMe Storage: If you are using high-performance local NVMe drives on a Bare Metal server, OCI performs a full-drive wipe upon termination. This is a firmware-level command that ensures all cells in the flash memory are cleared.
If you utilize Customer-Managed Keys (CMK), you have a powerful "kill switch" for decommissioning:
The Action: When you delete the master encryption key from your OCI Vault, the data on the disks becomes mathematically inaccessible.
The Result: This satisfies the NIST "Purge" requirement. Even with advanced laboratory reconstruction techniques, the encrypted blocks remain scrambled "noise."
When a hard drive or server reaches the end of its physical lifespan or fails, Oracle’s hardware decommissioning team takes over:
Secure Data Halls: Faulty or retired storage media are placed in secure, locked disposal bins located directly within the data hall.
On-Site Destruction: Oracle policy strictly prohibits taking data-bearing media out of the facility until it has been destroyed. The drives are degaussed (neutralizing the magnetic field) and then physically shredded or pulverized.
Certification: For specialized units (like Roving Edge devices), OCI can provide a Sanitization Certificate confirming the wipe was successful.
| Stage | Trigger | Method | Goal |
| Logical | User Termination | Metadata Deletion | Stop API/Network access |
| Sanitization | Resource Release | Overwriting / Zeroing | Prevent simple data recovery |
| Purge | Key Deletion | Cryptographic Erasure | Defeat lab-based recovery |
| Physical | Hardware Failure | Degaussing & Shredding | Final physical destruction |
If you choose to decommission your entire tenancy (cancel your account), OCI adds a cooling-off period:
30-Day Suspension: Your resources are shut down, but your data is "frozen" for 30 days. This allows for recovery in case the deletion was accidental or unauthorized.
Permanent Purge: After 30 days, the "Work Request" finalizes, and all data across all regions is permanently and irretrievably wiped from the physical infrastructure.