MatterODM by Shenan YangguangWhat a factory reset actually does
A factory reset returns a Matter device to its uncommissioned state, wiping the operational credentials, fabric keys and any locally stored scene or configuration data so the device can be commissioned into a new fabric by a new owner, which is the single most important operation in a device's afterlife. Without it, a resold sensor still believes it belongs to a stranger's home or facility, and the new owner cannot cleanly take it over. The reset is the difference between a reusable device and e-waste with someone else's keys inside.
Because a security device is trusted by its fabric, the reset must be deliberate and confirmable rather than accidental — a long press, a sequenced input or a commissioning-tool command — so a momentary button tap does not silently unpair a working alarm, but a genuine owner can always recover a unit. A factory that owns the firmware sets that threshold and tests it on the line, which is the same discipline that governs the rest of the device's safety-critical behaviour.
Fabric removal versus a full reset
Fabric removal is the act of removing a single device from a Matter fabric while leaving the fabric and its other devices intact, whereas a factory reset wipes the whole device back to its out-of-box state, and both are distinct operations a security device should support cleanly because the two jobs are not the same. A homeowner swapping one faulty sensor wants fabric removal; a brand refurbishing a returned batch wants a full reset. Confusing the two either strands a unit or needlessly disturbs the rest of the system.
The device-type and cluster behaviour that governs removal and reset is defined by the Matter specification and implemented in the firmware on a standard CSA-certified connectivity module, so the factory's job is to implement it faithfully and confirm it against the certification behaviour, not to invent a proprietary wipe that controllers will not recognise. Interoperable behaviour here is a security property, because a reset a controller cannot verify is a reset that may not have happened.
Why decommissioning is a security problem
Secure decommissioning is the process of retiring a security device so that its cryptographic identity and any locally held data cannot be recovered or reused by a subsequent owner, which matters specifically because a security sensor carries fabric trust material that an attacker could exploit if it leaked with the hardware. A discarded sensor with live keys is a small but real supply of trust that should never leave the customer's control intact. The honest design assumes the device will change hands and plans for it.
The attestation identity a device carries for Matter is separate from the fabric keys it holds after commissioning, so a proper reset clears the fabric relationship and any local data while the device's own certified, hardware-backed identity remains intact for the next commissioning — the device becomes clean, not anonymous. That separation is what lets a returned unit be safely resold rather than scrapped, and a factory that understands the distinction designs the wipe accordingly.
The returns, resale and RMA reality
The factory designs and verifies the reset behaviour on the device and proves it with an end-of-line test, while the brand owns the returns, resale and RMA process that actually triggers the reset before a unit leaves the customer's hands, because the reset only protects the next owner if someone in the field calls it. A device that supports a perfect reset but is resold without it being run is no safer than one that lacks the feature. The workflow, not just the firmware, is where decommissioning is won or lost.
For a B2B brand with managed fleets, decommissioning is a programme: units pulled from one site are reset, verified and reissued or recycled under a tracked process, and a build-and-certify factory can support that with the same test rig that proves commissioning at end-of-line, so the field and the line speak the same language. We scope that verification during product definition rather than leaving it to the brand's ops team to discover.
End-of-life and recycling discipline
At true end of life, secure decommissioning pairs with responsible recycling — the device is reset, then handled under the relevant waste-electronics and battery rules for the market, so a retired sensor leaves no live keys and no loose cell behind, which is the full-circle duty a security brand owes its customers and the regulator. The reset and the recycling are separate steps with separate owners, but they belong to one decommissioning plan.
For a brand, stating the decommissioning behaviour up front — what a reset clears, who triggers it, and how a unit is verified clean before resale — is part of an honest security story, and a factory that builds the reset into the firmware and proves it on the line is what makes that story true rather than decorative. The sensor's trust is only as safe as its worst offboarding step.
What the factory builds vs what the brand owns
The factory builds the reset and key-wipe behaviour into the firmware on a standard CSA-certified Matter connectivity module and verifies it at end-of-line; the brand owns the returns, resale and RMA workflow that calls the reset in the field and the recycling route at end of life. At Shenan Yangguang we build and certify the Matter security sensors we produce and own the schematic, the tooling, the firmware and the volume line; the decommissioning behaviour is part of that owned engineering and is proven on the same rig as commissioning.
If you are planning a security line whose devices will be returned, resold or refurbished, tell us your decommissioning and RMA requirements; we will implement and verify the reset and fabric-removal behaviour on your existing certified platform so every unit leaves a customer's hands clean. The result is one fabric, one accountable factory, and a device whose afterlife is as trustworthy as its first day.