FV-Relay: Time-Bound Connection Windows
Most network connections are active 24/7 but used for a fraction of that time. Relay activates paths only during authorised windows and physically severs them when the window closes, eliminating the idle exposure that attackers exploit.
Control Module
A connection that is active for 168 hours but used for 6 creates 162 hours of unnecessary attack surface. Relay reduces that to zero.
95%
Reduction in connection exposure time for governed paths
Zero
Idle connections outside authorised windows
Automated
Path activation and severance on schedule
100%
Session activity logged on tamper-proof storage
Always-on connections create always-on risk.
Idle Connection Exposure
VPN tunnels, vendor access paths, and inter-site links remain active 168 hours per week but are used for a fraction of that time. Every idle hour is an hour an attacker can exploit.
Forgotten Connections
Temporary connections established for projects, migrations, or troubleshooting are rarely decommissioned. They accumulate as undocumented attack surface.
Unmonitored Windows
Connections that are active outside business hours receive less monitoring and slower response times, creating ideal windows for attackers.
The Scenario
Scenario: Vendor Maintenance Window Governance
A manufacturing firm uses an equipment vendor for quarterly PLC firmware updates. Previously, the vendor maintained a persistent VPN connection to the OT network. With Relay, the connection activates every Tuesday from 02:00 to 06:00 during maintenance periods. The vendor authenticates, the multi-party authorisation is confirmed through the Lock module, and the physical path is activated. At 06:00, the path is automatically severed regardless of session status. All activity during the window is recorded on disconnected storage. Between windows, there is no path for an attacker to traverse even if the vendor's systems are compromised.
"Our vendor had a VPN that was active 24/7/365. They used it for 4 hours every quarter. Relay reduced our exposure from 8,760 hours per year to 16."
Connections that exist only when they are needed.
FV-Relay transforms always-on connections into policy-governed windows. Paths are physically activated only during authorised periods, require multi-party approval, and produce tamper-proof evidence of all activity. Between windows, the connection does not exist.
- Physical path activation only during authorised windows
- Multi-party approval before any connection is established
- Automatic physical severance when windows close
- Emergency extension with fresh authorisation
- Complete session recording on disconnected storage
- Dramatic reduction in connection exposure time
Relay, How It Works
Step 1 of 4Relay governs network paths through policy-defined windows. Connections are physically activated at the start of an authorised window and physically severed at the end. Between windows, the path does not exist. Schedules can be recurring, one-time, or triggered by external events.
Key Capabilities
Scheduled Windows
Define recurring or one-time connection windows with precise start and end times. The physical path activates and severs automatically on schedule.
Multi-Party Gating
Window activation requires approval from the configured number of authorised parties before the physical path is established.
Automatic Severance
When a window closes, the physical path is severed regardless of session status. No connection persists beyond its authorised window.
Emergency Extension
If work overruns, an authorised extension request can extend the window. Extensions require fresh multi-party approval and are logged separately.
Window Activity Logging
All activity during each window is recorded on physically disconnected storage, providing a complete audit trail for each session.
Compliance Evidence
Automated reports document connection exposure times, authorisation chains, and session activities for regulatory and contractual compliance.
Choose Your Protection
Which OSS Fits?
300GB
Low Use Vault, Deep Cold Storage
From £74.99/mo
inc. VAT · £0 due today
Offline Secure Storage for Time-Bound Connection Windows, low use vault, deep cold storage.
What 300GB holds
Specifications
Capacity
300GB
Access
2 windows/week
Authentication
Identity-locked
Commitment
36 months
Security & Compliance
How to Get Started
Step 1
Connection Exposure Audit
Catalogue all persistent connections and calculate actual usage time versus active time to identify the highest-exposure paths.
Step 2
Window Policy Design
Define connection windows, authorisation requirements, and emergency extension procedures for each governed path.
Step 3
Vendor Path Pilot
Deploy Relay on vendor and third-party access paths first, where the usage-to-exposure ratio is typically the most extreme.
Step 4
Full Path Governance
Extend to all governed connections with automated scheduling, compliance reporting, and integration with change management platforms.
Win Business, Earn Trust, and Build Reputation with Butterfly
Butterfly is an operational model that helps organisations structure sensitive data to close deals faster, strengthen client relationships, and demonstrate the governance maturity that wins enterprise contracts.
Built on the VPPP framework (Vault, Policy, Permissions, Purpose), Butterfly maps your sensitive data and assigns dedicated Vaults by role, relationship, and purpose, turning data stewardship into a competitive advantage.
Deal Readiness
Governed materials ready to share with confidence
Client Trust
Demonstrate stewardship that earns loyalty
Board Confidence
Clear governance that inspires stakeholders
Enterprise Scale
Structure data governance across your organisation

Who Uses Butterfly?
-
Sales Teams
Secure client proposals, pricing, and commercial intelligence
-
Service Providers
Exchange sensitive documents with clients through governed Vaults
-
Businesses
Protect strategic plans, IP, and competitive intelligence
-
Family Offices
Structure data governance across principals, staff, and advisors
Questions
Frequently Asked
Ready to take the next step?
See how Firevault can protect your most sensitive data with physically disconnected storage.