--- title: "Offline Secure Storage: everything you need to… | Firevault" url: https://fire-vault.com/learn/knowledge/offline-secure-storage-everything-you-need-to-know description: "Offline Secure Storage is dedicated physical storage that has no network path to it until an authorised out-of-band command creates one. This explainer sets…" lang: en-GB --- 12 chapters · 10 min read # Offline Secure Storage: everything you need to know Offline Secure Storage is dedicated physical storage that has no network path to it until an authorised out-of-band command creates one. This explainer sets out what it is, how it differs from air gaps, tape and immutable cloud storage, what the standards and insurers expect, how access actually works and how to choose the right instance. Start readingRead the short answer Recovery lens ## Start with what must remain trustworthy. - **Recovery lens**A recovery copy changes the outcome only when it survives the incident and can be reached without trusting the compromised estate. Most organisations already hold more than one copy of their data. Very few can point to a copy that an attacker inside their network has no route to. That is the gap Offline Secure Storage (https://fire-vault.com/offline-secure-storage)® was built to close. This explainer covers the whole subject in one place: the definition, the four physical principles, how it compares with air gaps, tape and immutable cloud storage, what regulators and insurers are asking for, how access works day to day, and how to choose the right instance for the volume of data you need to protect. ## Chapter 1What Offline Secure Storage is Offline Secure Storage is dedicated physical storage capacity, held on real drives in a professionally secured facility, with no live network path to it. The connection at Layer 1 is physically open. It is closed only when an authorised out-of-band command asks for it, for a defined window, and it is opened again afterwards. That single sentence carries the whole design. There is no standing connection to scan, no permanent IP address to reach, and no software policy that has to be trusted to keep an attacker away. When the path does not exist, the copy is not reachable by anything on your network, whatever privileges it has acquired. Firevault calls the underlying principle Disconnect to Protect®. Offline Secure Storage is that principle applied to the data you cannot afford to lose. ## Chapter 2The four physical principles **Physical storage.** Instances sit on dedicated physical hard drives, not in shared cloud buckets or multi-tenant storage pools. Capacity is assigned to you, with paired RAID 1 drives providing resilience. **Physical ownership.** Each instance is allocated to a named customer with clearly defined ownership. Data is not pooled or commingled with anyone else's estate. **Physical control.** Access begins outside the normal network path. An authorised out-of-band command, such as an SMS instruction, controls the Layer 1 connection. When access is not required, that path is physically disconnected. **Physical security.** The hardware is housed in Firevault Bunkers: carefully selected, professionally managed data centres with layered physical security, resilient power, environmental controls, three-factor access including biometric identification, 24/7 monitoring and a complete audit trail. ## Chapter 3How this differs from an air gap "Air gap" has become one of the least reliable words in data protection, because it now describes three very different things. **A logical air gap** uses network policy, VLANs or virtualisation to separate the backup environment. It depends on configuration, which can be changed by someone who obtains sufficient privileges. **An operational air gap** uses scheduling: a connection that exists for most of the day and is closed for part of it. The window is smaller, but the path still exists. **A physical air gap (https://fire-vault.com/how-it-works/offline-secure-storage)** removes the connection itself. There is nothing to reconfigure, because there is no configured path to reconfigure. Offline Secure Storage is the third. The distinction matters most in exactly the incident the copy exists for, because attackers who reach recovery infrastructure do so with legitimate credentials, not malware. ## Chapter 4How it compares with immutable storage Immutable storage is a proven and valuable control. It protects the state of the stored data, preventing an existing version from being altered or deleted for a retention period. What it does not do is remove the surrounding environment. The platform still has identities, management APIs, policy engines, retention settings and a network path. MITRE ATT&CK records adversaries disabling backup policies, deleting snapshots and targeting online backups connected to the victim's network under Inhibit System Recovery, T1490. Its own mitigation advice is to keep recovery copies off system. The honest summary is that immutability protects the copy, and Offline Secure Storage controls the path to it. They are complementary, not competing, and the strongest estates use both. ## Chapter 5How it compares with tape Tape achieves genuine offline status once a cartridge leaves the drive, and that is why it has survived. The costs sit elsewhere: handling, transport, media degradation, drive dependency, the skills to operate it, and recovery times measured in hours or days rather than minutes. Offline Secure Storage keeps the offline property while removing the media handling. The data sits on live-capable drives that are simply not connected, so a restore begins at disk speed as soon as the access window opens. There is nothing to collect, transport, mount or replace. ## Chapter 6What the standards and insurers expect The direction of travel across guidance is consistent, and it is towards isolation rather than more copies. The UK National Cyber Security Centre's guidance on ransomware-resistant backups begins with the ability to isolate the backup solution, and warns explicitly that unnecessary connectivity lets an attacker pivot from a compromised device towards backups. The long-standing 3-2-1 rule has been extended in practice to 3-2-1-1-0: three copies, on two media types, one off site, one offline or immutable, with zero errors on a tested restore. Cyber insurers increasingly ask about that fourth element directly, because it is the one that determines whether a claim becomes a recovery or a ransom payment. Sector regimes reach the same place from different directions. NIS 2, DORA, GDPR Article 32, HIPAA, PCI DSS and NERC CIP all require demonstrable resilience and integrity of retained data rather than an assurance that a policy exists. ## Chapter 7How access actually works The most common question is a fair one: if it is disconnected, how do I get to it? **Request.** An authorised, named user issues an out-of-band command from outside the data network. **Verification.** The request is authenticated against the named user list. The control path is separate from the data path, so it cannot be reached from your estate. **Connection.** The Layer 1 path is physically closed and an encrypted session is established for a defined, time-limited window. **Use.** Data is written or restored at disk speed over that session, using standard tooling. **Disconnection.** The window closes and the path is physically opened again. A full record of who connected, when and for how long is retained. For most organisations this is a scheduled rhythm rather than an event: a backup window, a monthly restore test, and an unplanned access request handled by a named authority. ## Chapter 8What people put in it The pattern across sectors is consistent. Organisations do not move their whole estate offline. They identify the data that the business cannot be rebuilt without, and they protect that. In practice that means the last known good backup set, financial and payroll records, intellectual property (https://fire-vault.com/oss-for-intellectual-property) and design data, legal and contractual archives, regulatory evidence and audit trails, identity system backups, and the configuration needed to rebuild the environment itself. That last one is the most commonly forgotten and the most painful to lose. ## Chapter 9Choosing the right instance The range is capacity-led, not persona-led, and every instance is physically disconnected by default. **LUV, 300GB fixed.** Access on one nominated day each week within a 12-hour window. Built for a defined, high-value set rather than a whole estate. **Vault, 2TB, 4TB or 8TB.** Access on demand, 24/7, disconnected whenever the window is closed. **Storage, from 20TB in fixed 20TB increments.** Designed around organisational requirements rather than a fixed product shape. **Enterprise, from 300TB.** Dedicated capacity designed around the estate and the jurisdiction it must sit in. Jurisdiction is your choice. Firevault Bunkers are live across Europe, including the United Kingdom, with the United States and the Middle East next. If you are not sure which fits, the OSS Concierge (https://fire-vault.com/find-my-oss) walks through volume, access rhythm and jurisdiction and returns a recommendation. ## Chapter 10Frequently asked questions **Is this just cloud storage with extra steps?** No. Cloud storage is permanently reachable by design, on shared infrastructure. Offline Secure Storage is dedicated hardware with no network path to it until an out-of-band command creates one. **Can ransomware reach it?** Not through the network while the path is open at Layer 1. There is no connection to traverse, no address to resolve and no management API exposed to your network. **What if I need data urgently?** Vault, Storage and Enterprise instances allow access on demand, and restores run at disk speed once the window opens. LUV trades that flexibility for a weekly window, which is why it suits archival sets. **Is the data encrypted?** Yes. Data sits encrypted on dedicated drives, and access sessions are encrypted and time-limited. **Does it replace my existing backups?** No, and it should not. It is the isolated copy that sits behind them, so that a compromise of the connected estate does not reach the copy that matters. **How is it billed?** Pricing is VAT inclusive, with the first payment taken at checkout and a 36-month commitment. Growth means moving up the range to a larger instance on a new commitment, because capacities are fixed by design. ## Chapter 11What leaders and boards should take from this Backup and recovery are not the same subject, and confusing them is the most common failure in board reporting. Backup is a copy, measured in coverage and success rates. Recovery is the ability to rebuild the organisation from that copy, in a defined time, while the environment that produced it is compromised or untrusted. It is measured in tested restores, and it is rarely reported at all. So the honest board question is not "do we back up?" It is "is there a copy that a compromised administrator account cannot reach, and have we restored from it recently?" A defensible answer has four components, and none of them require technical knowledge to demand: a defined data set the business cannot be reconstituted without, an isolated copy with no network path from the operating estate, a named authority with a control path separate from the data path, and a dated, timed restore test. The questions to put to management follow directly. Which data would we be unable to trade without, and where is the copy an attacker inside our network cannot reach? When did we last restore from it, and how long did it take? Who can authorise access, and how is that request made? Could we rebuild our identity system from it? What does our insurer ask about offline copies, and what did we answer? The evidence to expect back is short and readable without technical training: a one-page schedule of the protected data set and its owner, written confirmation of where the isolated copy is held and under which jurisdiction, the named-authority list and access procedure, dated restore test results with elapsed times, and the audit record of access windows. For the governance-led treatment, see Cyber Security for Boards (https://fire-vault.com/learn/guides/cyber-security-for-boards). ## Chapter 12Where to go next For the full product detail, see Offline Secure Storage® (https://fire-vault.com/oss). To find your instance, use the OSS Concierge (https://fire-vault.com/find-my-oss). For the comparison with immutability in depth, read Myth Buster: "Ransomware cannot hack immutable storage" (https://fire-vault.com/learn/knowledge/myth-buster-ransomware-cannot-hack-immutable-storage). There are also role versions of this explainer, written for the decisions each seat actually owns: everything finance leaders should know (https://fire-vault.com/learn/knowledge/offline-secure-storage-for-finance-leaders), everything technology leaders should know (https://fire-vault.com/learn/knowledge/offline-secure-storage-for-technology-leaders) and everything security and compliance leaders should know (https://fire-vault.com/learn/knowledge/offline-secure-storage-for-security-and-compliance-leaders). The short version is this. Every other control asks you to trust that the path to your data is being defended. Offline Secure Storage removes the path, and then asks to be checked. Where Firevault fits ## A recovery copy an attacker cannot reach Offline Secure Storage® keeps a clean copy of your data on hardware that is physically disconnected, so backup and recovery do not depend on systems an intruder can touch. 1. **1****Hardware** Your copy sits on dedicated encrypted hardware 2. **2****Disconnect** Offline by default, connected only when you say so 3. **3****Recovery** A known-clean copy to rebuild from, on your timetable 4. **4****Location** Held in a secure Firevault Bunker Get started: https://fire-vault.com/get-started Talk to the team: https://fire-vault.com/demo About the author Image: Portrait of Mark Fermor, CTO, CMO and Founder at Firevault (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) ### Mark Fermor Mark Fermor on LinkedIn (https://www.linkedin.com/in/mfermor) CTO, CMO & Founder Founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. Keep reading ## You may also find these useful Explainer ### Everything finance leaders should know about Offline Secure Storage A CFO-level explainer on Offline Secure Storage: how to build the loss model before the control decision, what cyber insurance genuinely transfers, how to treat the cost of a physically isolated copy, and the financial records that need to survive a compromised estate. https://fire-vault.com/learn/knowledge/offline-secure-storage-for-finance-leaders Explainer ### Everything technology leaders should know about Offline Secure Storage A CIO, CTO and IT director explainer on Offline Secure Storage: why recovery fails on dependencies rather than tooling, how physical Layer 1 isolation differs from logical air gaps and immutability, how access and restore actually work, and how to design a recovery architecture that survives a privileged compromise. https://fire-vault.com/learn/knowledge/offline-secure-storage-for-technology-leaders Explainer ### Everything security and compliance leaders should know about Offline Secure Storage A CISO, risk and compliance explainer on Offline Secure Storage: blast radius after a privileged compromise, residual risk stated honestly, mapping to NCSC guidance, NIS 2, DORA, GDPR Article 32, ISO 27001 and PCI DSS, and the evidence that survives audit and regulatory challenge. https://fire-vault.com/learn/knowledge/offline-secure-storage-for-security-and-compliance-leaders Image: Vault product emblem: white OSS ring on magenta with a two-drive Vault unit (https://fire-vault.com/__l5e/assets-v1/b9413e6e-5b45-442d-ab80-67cf0c578ba6/oss-approved-vault.png) Business ### Size your Vault. 2TB, 4TB or 8TB of dedicated hardware, from £360 a month inc VAT. Choose your Vault: https://fire-vault.com/vault Image: Storage product emblem: white OSS ring on blue with a storage rack (https://fire-vault.com/__l5e/assets-v1/25b7681b-efb5-4606-b1ac-5a35e9ec458f/oss-approved-storage.png) Larger estates ### Request a Storage design. From 20TB, designed with our solutions team. Talk to our solutions team: https://fire-vault.com/contact Image: LUV product emblem: white OSS ring on amber with a clock for the weekly access day (https://fire-vault.com/__l5e/assets-v1/887b6f88-b46b-43da-b455-c25230c50113/oss-approved-luv.png) Personal ### LUV, 300GB. Identity documents, wills and family archives, opened one day a week. Explore LUV: https://fire-vault.com/luv Get started ## Structured data ```json [ { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/learn/knowledge/offline-secure-storage-everything-you-need-to-know#webpage", "url": "https://fire-vault.com/learn/knowledge/offline-secure-storage-everything-you-need-to-know", "name": "Offline Secure Storage: everything you need to…", "description": "Offline Secure Storage is dedicated physical storage that has no network path to it until an authorised out-of-band command creates one. This explainer sets…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/0ba29a7f-7f45-4fca-9e96-b30c61118758/offline-secure-storage-explainer-vault-access.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/learn/knowledge/offline-secure-storage-everything-you-need-to-know#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/learn/knowledge/offline-secure-storage-everything-you-need-to-know#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Offline Secure Storage: everything you need to know", "item": "https://fire-vault.com/learn/knowledge/offline-secure-storage-everything-you-need-to-know" } ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Offline Secure Storage: everything you need to know", "description": "Offline Secure Storage is dedicated physical storage that has no network path to it until an authorised out-of-band command creates one. This explainer sets out what it is, how it differs from air gaps, tape and immutable cloud storage, what the standards and insurers expect, how access actually works and how to choose the right instance.", "url": "https://fire-vault.com/learn/knowledge/offline-secure-storage-everything-you-need-to-know", "image": "/__l5e/assets-v1/0ba29a7f-7f45-4fca-9e96-b30c61118758/offline-secure-storage-explainer-vault-access.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@id": "https://fire-vault.com/#organization" }, "datePublished": "2026-09-08T00:00:00.000Z", "dateModified": "2026-09-08T00:00:00.000Z", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/learn/knowledge/offline-secure-storage-everything-you-need-to-know" }, "inLanguage": "en-GB", "articleSection": "Explainer", "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } } ] ```