Companion Robot Repair Privacy Checklist: 18 Tests Before Service

Why repair is a privacy event, not just a hardware event

A companion robot can combine microphones, cameras, local storage, cloud credentials, wireless keys, learned preferences, contact lists and movement logs. A repair may expose some of those systems to a technician or diagnostic tool even when the reported fault is mechanical. The practical question is not whether a repair company promises to respect privacy in general. It is which data remains on this unit, which accounts remain connected, which people can reach them, and which access is necessary for the stated service. Treating intake as a controlled transfer creates a record that protects both owner and repairer.

This guide applies general consumer-IoT security and data-minimisation principles; it does not claim that every robot stores the same information or that every repair requires a reset. Manufacturer instructions, warranty terms and the repairer's written intake procedure take priority for model-specific steps. Do not improvise disassembly, battery work or powered tests on a robot that may move unexpectedly.

1. Record the fault without collecting unrelated private material

Write a short fault description with the date, operating state, recent update and exact symptoms. Photograph the exterior damage and serial label if doing so is safe. A focused record may prevent a technician from browsing through broad histories to reproduce the issue. Avoid sending entire conversation exports, household videos or account screenshots when one redacted image, error code or timestamp would establish the problem. Keep the original evidence privately until the service centre confirms what it needs.

2. Verify the repair channel and destination

Start from the manufacturer's official support page or the seller identified in the purchase record. Confirm the legal business name, physical destination, case number and approved carrier before sending anything. Do not trust an address or QR code delivered only through an unsolicited message. If a third-party depot will perform the work, ask who operates it and in which country the robot and copied diagnostic data will be handled. Save the answer with the repair case.

3. Compare warranty repair, paid service and independent repair

The privacy controls available may differ by route. A manufacturer depot may use proprietary diagnostics and cloud tools; an independent shop may need a passcode or may be unable to pair the device after a reset. Compare what access each route requests, what parts it can obtain, how it handles replaced boards or drives, and what warranty consequences are documented. Do not assume that the cheapest shipping label or fastest turnaround produces the narrowest data access.

4. Ask whether the fault requires user-data access

Request a written explanation of the minimum access needed. A cracked exterior panel should not automatically require a cloud password. A microphone, camera, memory or account-pairing fault may require controlled testing, but the repairer should be able to describe the test account, sample media or diagnostic mode it expects. If support asks for a primary email password, payment credential or recovery code, stop and escalate through the official channel. Those secrets should not be necessary for routine service.

5. Create a data inventory before changing anything

List the categories that may exist locally or in the linked service: recordings, transcripts, photographs, biometric templates, voice profiles, contact names, schedules, location history, Wi-Fi details, paired controllers and downloaded media. Mark each item as local, cloud, both or unknown. This inventory is not proof that every category is collected. It is a prompt to inspect the current privacy dashboard, manual and account settings before a reset makes the original state impossible to reconstruct.

6. Preserve a permitted backup, then test that it can be read

Use only the export or backup method documented by the vendor. Record the export date, software version and scope. Open a sample without uploading the archive to an unapproved service. A backup that cannot be restored or interpreted is not a reliable safety net. Encrypt sensitive archives where practical and keep the recovery information separate. Do not clone storage or bypass security controls merely because a forum post describes the technique; that can damage the product, expose other people and complicate warranty service.

7. Separate evidence from everyday personal data

If the defect concerns a recording, sensor event or harmful movement, preserve the relevant original and metadata before deletion. Copy only what is necessary, record how it was obtained and avoid editing the sole original. For routine service, remove unrelated conversations, media and learned profiles using official controls. When a serious incident may involve injury, fraud or legal proceedings, obtain appropriate professional advice before wiping the device. A broad deletion performed too early can destroy useful evidence; retaining everything can expose bystanders without need.

8. Sign out sessions and rotate credentials deliberately

Review the vendor account's active sessions, authorized phones, web dashboards and integrations. Sign out devices that the repair process does not need. Change a credential when it may have been disclosed, reused or entered into an untrusted form; do not rotate blindly if doing so will lock the robot and prevent the approved reset. Record which session was revoked and keep multi-factor recovery methods under the owner's control. Never place authentication codes or password notes inside the shipping box.

9. Remove payment methods and disable purchasing

Delete stored payment methods from the robot or companion app when the vendor permits it, and disable voice, gesture or one-click purchasing. Check subscriptions separately: removing a card from the device may not cancel a cloud plan, and cancelling a plan may delete data needed for restoration. Take a dated screenshot of the subscription status without exposing full card details. The goal is to prevent unintended charges during testing while preserving a clear route to resume the service after return.

10. Unpair home systems and third-party integrations

Disconnect smart locks, cameras, speakers, calendars, cloud drives, health platforms and home-automation routines that are not required for the repair. Revoke tokens from the third-party side where possible; hiding an integration in the robot app may leave its authorization active. If the robot controls physical equipment, place that equipment in a safe independent state before unpairing. Document any integration that must remain because it is directly involved in the reported fault.

11. Decide between privacy mode, service mode and factory reset

A documented service mode may provide diagnostics without exposing personal content. Privacy mode may disable sensors but leave stored data and accounts intact. A factory reset may remove local information yet leave cloud copies, device registration or recovery keys. Ask which state the depot requires and what a reset actually deletes for the exact model. After a reset, verify the setup screen and account dashboard rather than relying only on a confirmation message. If the robot cannot be reset, state that prominently on the intake form.

12. Remove removable storage and accessories unless requested

Take out memory cards, USB drives and unrelated accessories after powering down according to the manual. Record each retained item. Do not remove an internal battery, sealed drive or structural component unless the manufacturer explicitly instructs it and the procedure is safe. If storage must stay with the robot, ask whether technicians can access it, whether it will be copied, and what happens if the board is replaced. A replaced storage component should not disappear into an undocumented recycling stream.

13. Document sensors, covers and indicators

Photograph camera covers, microphone switches, privacy shutters and indicator lights before packing. Note whether each control is mechanical, software-based or unknown. Do not tape over vents, damage lenses or obstruct a sensor needed for the reported diagnosis. If a camera or microphone is not required, ask whether a physical cover may remain installed throughout service. On return, compare the controls with the intake record and re-test them before restoring private profiles.

14. Build a precise chain-of-custody record

List the robot model, serial number, cosmetic condition, charger, dock, cable, keys, modules and packaging sent. Photograph the sealed box, label and carrier receipt. Record collection and delivery timestamps. Use a case number rather than writing a password or sensitive fault narrative on the outside. A chain-of-custody record cannot prevent every problem, but it helps distinguish a missing accessory, substituted unit or new physical damage from the original fault.

15. Read the intake terms before authorizing work

Look for permission to erase data, install updates, replace the whole unit, use refurbished parts, subcontract service, retain diagnostic logs or dispose of unclaimed equipment. Ask how long copied data is kept and how deletion is verified. Clarify the approval threshold for paid work and return shipping. Do not interpret a generic privacy notice as a model-specific repair protocol. Save the exact version accepted and any written exception agreed by support.

16. Use a temporary test profile when the repairer allows it

A dedicated service profile can provide only the functions needed for diagnosis. Give it no contacts, payment method, private media or access to household integrations. Use a unique credential and revoke the profile when the robot returns. Confirm that the profile cannot open data belonging to the primary owner. If the platform has no separate-user model, ask for an official diagnostic path rather than creating a misleading shared account.

17. Inspect the returned robot before restoring trust

Check the serial number, exterior, accessories and repair report before connecting the robot to the main household network. Read which parts were changed, which software was installed and whether data was reset or copied. Place the unit on the separated onboarding network described in our home-network checklist. Update through the official channel, review accounts and sessions, then test privacy controls with benign sample data. Do not immediately restore a full backup to an unexplained replacement unit.

18. Close the repair case and delete temporary access

Revoke the service profile, temporary password, carrier link and technician pairing. Confirm that support has closed the case and ask when diagnostic copies will be deleted under the stated policy. Restore integrations one at a time and record the new firmware, serial number and component changes. Keep receipts and the repair report with the warranty record, but do not retain sensitive exports indefinitely simply because storage is available.

Red flags that should pause the shipment

Stop when the destination cannot be verified, the repairer requests a primary email password, there is no case number, data handling is unexplained, or a factory reset conflicts with evidence preservation. Pause if the robot has battery swelling, heat, liquid damage or unpredictable motion that the carrier has not approved. Also pause when support instructs you to defeat a safety interlock or ship a regulated battery contrary to the carrier's rules. Escalate through the official manufacturer, seller or carrier channel.

Sources and scope

This guide was checked on October 19, 2026 against NIST IR 8425, which describes cybersecurity outcomes for consumer IoT products; the U.S. Federal Trade Commission's guidance on securing internet-connected devices and protecting personal information; and the UK Information Commissioner's Office guidance on data minimisation. Those sources support principles such as limiting access, managing credentials, protecting stored information and collecting only what is needed. They do not certify any companion robot, repair centre or shipping method. Always follow the current manual, warranty and carrier requirements for the exact product.

Continue the ownership audit

Before reconnecting a repaired unit, use our home network checklist. For account closure and retained cloud data, follow the data deletion guide. If the device is being sold rather than returned from service, use the secondhand handover checklist.