--- title: "Offline Secure Storage® for Premier League Foot… | Firevault" description: "Offline Secure Storage® for Premier League football clubs. Physically disconnected storage for player contracts, medical files, ticketing and operations data,…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/oss-for-football-clubs#webpage", "url": "https://fire-vault.com/oss-for-football-clubs", "name": "Offline Secure Storage® for Premier League Foot…", "description": "Offline Secure Storage® for Premier League football clubs. Physically disconnected storage for player contracts, medical files, ticketing and operations data,…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-home.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/oss-for-football-clubs#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/oss-for-football-clubs#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Offline Secure Storage® for Premier League Foot…", "item": "https://fire-vault.com/oss-for-football-clubs" } ] }, { "@context": "https://schema.org", "@type": "Service", "name": "Offline Secure Storage for Premier League Football", "provider": { "@type": "Organization", "name": "Firevault" }, "serviceType": "Offline Secure Storage", "description": "Physically disconnected storage for football clubs, covering player records, contracts, ticketing archives and match-day operations evidence.", "url": "https://fire-vault.com/oss-for-football-clubs", "audience": [ { "@type": "Audience", "audienceType": "Premier League football clubs" }, { "@type": "Audience", "audienceType": "EFL football clubs" }, { "@type": "Audience", "audienceType": "Sports organisations" } ] } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o)[2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Overview Why nowControl areasWhat goes offlineInside the clubChoose capacityContainmentQuestions Offline Secure Storage® for Premier League football # Rule J.9 changed the game. _Put your club's records beyond reach._ Contracts, medical files, scouting data, ticketing and broadcast agreements now sit inside a rulebook that demands proof, not intention. Offline Secure Storage® holds a copy of everything the club cannot lose on dedicated hardware with no standing network path, released only to a verified named user, with every session logged as evidence. Deadlines are already running. [Choose your capacity](#capacity) [Book a scoping call](/contact) Dedicated hardware Physically disconnected Identity verified Session logged ![Football club operations room with match-day dashboards overlooking the pitch](/assets/football-club-oss-hero-By4HwEyI.jpg) Offline by default What a club takes offline ### The records behind the club. Squad**Contracts** Medical**Player files** Commercial**Sponsorship** Broadcast**Agreements** Supporters**Ticketing** Stadium**Operations** Storage**Dedicated hardware** Access**Verified named user** When closed**No standing network path** Why clubs are acting now ## If the club network were compromised this week, what could you still prove? Premier League clubs now face 22 mandatory information security control areas under Rule J.9 and Appendix 11. Our explainer sets out the requirements, the deadlines and the UK GDPR exposure that sits behind them in plain English. [Read the explainer](/news/premier-league-cyber-rulebook-appendix-11-2026) [Ask the OSS Concierge](/find-my-oss) **01** ### The league now asks for evidence. Rule J.9 and Appendix 11 expect a club to show how it protects critical systems and data, not simply state that it does. **Accountability** **02** ### Ransomware reaches the recovery copy. If the copy the club depends on sits on a reachable network, an attacker who owns the network owns the recovery plan too. **Recovery** **03** ### A match day cannot pause. Turnstiles, safety systems and broadcast obligations do not wait while a club decides how to contain an incident. **Continuity** **04** ### The data outlives the staff. Registrations, medical files and commercial agreements must remain retrievable long after the people who filed them have moved on. **Retention** Mapped to the control areas ## Where Offline Secure Storage helps a club. We map our controls to the outcomes clubs are being asked to evidence. We do not claim certification on a club's behalf, and a vault is not a substitute for the club's wider security programme. The club evidence pack ### Six areas where offline changes the answer. Use this as the shortlist before the compliance deadline. Each row states what a club has to show and what a physically disconnected copy contributes. **Recovery → Access → Evidence → Suppliers → Containment → Retention** ### Backups and recovery What clubs must show: Clubs must hold recoverable copies of critical data and prove they can restore after an incident. How OSS helps: A physically disconnected copy of the club's critical records that ransomware on the club network cannot reach, encrypt or delete. ### Access control and identity What clubs must show: Access to club systems and data must be controlled, verified and reviewed. How OSS helps: One vault, one named user. Every session begins with identity verification and ends with the drives physically disconnected again. ### Logging and audit evidence What clubs must show: Clubs must be able to show who accessed what, and when. How OSS helps: Every retrieval records the user, the device, the files and the timestamp, giving the club an evidence pack for the league and the ICO. ### Supplier and third-party risk What clubs must show: Clubs are accountable for the suppliers, agencies and platforms that hold club data. How OSS helps: Contracts, player records and commercial agreements held offline under the club's sole control, rather than spread across supplier clouds. ### Incident response and containment What clubs must show: Clubs must be able to contain an incident and keep operating on a match day. How OSS helps: Firevault Control adds a governed physical disconnect, so a compromised path is severed without waiting for somebody to reach the hardware. ### Data protection and retention What clubs must show: Player, staff and supporter data carries UK GDPR obligations and retention duties. How OSS helps: Long-retention records, medical files and academy paperwork stored offline for the retention period, with access on request only. What to disconnect first ## Not everything a club holds needs to stay online. Keep live match-day, training and commercial platforms exactly where they are. Offline Secure Storage is for the smaller category of club information that must survive an incident, prove a position or satisfy a retention duty. ### Player and squad records Contracts, registrations, medical files, scouting reports and academy paperwork that must survive any incident. **Football operations** ### Commercial and broadcast agreements Sponsorship contracts, image rights, broadcast schedules and settlement paperwork held offline until they are needed. **Commercial** ### Supporter and ticketing records Historic ticketing, membership and hospitality records that no longer need to sit on a live, internet-facing platform. **Supporter data** ### Stadium and operations technology Configuration records, plans and evidence for access control, turnstiles, safety systems and match-day operations. **Match day** Live and connected ### Keep the club running. - • Live match-day and training systems - • Current-season working documents - • Ticketing and retail platforms in active use - • Media assets being edited or published - • Day-to-day collaboration across departments Consequential and offline ### Put consequence out of reach. - ✓ Player contracts, registrations and medical files - ✓ Commercial, sponsorship and broadcast agreements - ✓ Historic supporter and ticketing records - ✓ Board, legal and regulatory correspondence - ✓ The recovery set the club cannot afford to lose Inside the club ## Different people, the same question. A club rarely buys storage. It buys the ability to answer a question from the league, an auditor, a regulator or a board, with a record rather than an assurance. ### Chief Operating Officer Evidence that the club can demonstrate the required control areas before the compliance deadline. ### IT and Security Lead A recovery set the club actually controls, plus a physical containment option for match day. ### Club Secretary Registrations, contracts and league correspondence retained and retrievable on request. ### Head of Medical and Performance Player medical and performance data held offline under strict access rules. ### Data Protection Lead Session-level access evidence for UK GDPR Article 32 and ICO enquiries. ### Commercial Director Sponsorship and broadcast agreements protected from exposure during a supplier incident. Why Firevault ## Physical protection underneath the paperwork. A club should not have to become a security vendor. Firevault changes the state of the selected data itself, so the evidence follows from the design. **01** ### Dedicated hardware Club records are held on physical storage allocated to the club rather than pooled cloud capacity. **02** ### Physical disconnection When the vault is closed there is no standing network path to the selected club data. **03** ### Identity-controlled access Access is linked to a verified named user, not a shared departmental account. **04** ### Evidence by design Each session is logged, so the club can answer league, auditor and regulator questions with a record. Containment on a match day ## Containment cannot wait for somebody to reach the cabinet. At Firevault, we have developed a control blueprint that is designed to physically sever power, taking physical control of the network in under six milliseconds. On a match day, that is the difference between a contained incident and a stadium operating blind. [Adopt CP-02 Blueprint](/control-blueprints/cp-02) [Explore Control](/control) **Under six milliseconds**Designed response time for a governed physical disconnect. **Out of band**The action does not depend on the compromised network staying usable. **Logged and authorised**Every disconnect is an authorised, recorded action. Questions clubs ask ## Before the club moves anything offline. The goal is a defensible position on the records that matter most, not simply more storage. Does this make our club compliant? No. We map our controls to the outcomes clubs are being asked to evidence. Compliance remains the club's programme, and a vault is one part of it, not a certification. Is this a backup service? Can several people at the club have access? What if we need more than 8TB? Where is the data held? How quickly can a club retrieve a file? Offline Secure Storage® for football clubs ## Start with the records the club could not rebuild and could not afford to expose. Online when the club needs it. Offline when it does not. Our team will scope the capacity, the users and the jurisdiction with you. [Choose your capacity](#capacity) [Book a scoping call](/contact)