--- title: "Security Architecture: how the platform actually | Firevault" description: "How Firevault protects your data through physical disconnection, hardware encryption and identity verification, with a sourced reference for every statistic…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": "GB" } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/security#webpage", "url": "https://fire-vault.com/security", "name": "Security Architecture: how the platform actually", "description": "How Firevault protects your data through physical disconnection, hardware encryption and identity verification, with a sourced reference for every statistic…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/security#breadcrumb" }, "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".lead-paragraph" ] } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/security#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Security Architecture: how the platform actually", "item": "https://fire-vault.com/security" } ] } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o)[2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Trust Index # Every claim we make, verified in one place . How Firevault protects your data through physical disconnection, hardware encryption and identity verification, with a sourced reference for every statistic and claim we publish. Framework mapping lives in the Compliance Hub. - Offline by default - Identity locked access - Hardware encrypted [Get started](/vault) [Request a security brief](#trust-index) ![Security analyst reviewing an isolated workstation with disconnected cables](/assets/hero-square-analyst-CiP17E_k.jpg) Offline By default posture OSS design principle 72h UK GDPR breach window ICO / Article 33 CAF-aligned NCSC outcomes mapped Alignment, not certification 0-trust Identity + time-boxed access Every session logged 01 Security Architecture ## Built on physical disconnection. When data is offline, there is no network path for attackers to exploit. This is security by architecture, not by configuration. ### Physical Disconnection Your data resides on hardware that is physically disconnected from networks. No IP address, no attack surface, no remote exploitation. Layer 1 physical air gap No network exposure Zero standing connections ### Hardware Encryption All data is protected by Quantum Key Encryption and hardware level AES-256. Encryption keys never leave the secure enclave. Quantum Key Encryption AES-256 at hardware level Key isolation ### Identity Verification Every account is verified through Know Your Customer (KYC) and Anti-Money Laundering (AML) checks at onboarding, permanently linking the account to a confirmed identity. Access then requires Multi-Factor Authentication (MFA) at every session. Know Your Customer and AML at onboarding Multi-Factor Authentication at every session Identity-linked account ### Zero Standing Privileges No administrator has persistent access. Every session is explicitly authorised for a defined purpose and time window. No persistent access Time-limited sessions Audit trail 02 Third-Party Verified ## Certifications and assurance. #### Security Audits Regular third-party penetration testing and security assessments by accredited firms. #### Secure Facilities Data stored in carefully selected Tier 3+ Firevault Bunkers with 24/7 physical security and clear jurisdictional boundaries. #### Vetted Personnel All staff undergo background checks and security clearance as required. #### Key Management Cryptographic keys managed using hardware security modules with strict access controls. [ ![Cyber Essentials Certified](https://fire-vault.com/__l5e/assets-v1/6f8f42a2-89e1-4c20-938f-3f34d30bc90c/cyber-essentials-2026.png) ![Cyber Essentials Plus Certified](https://fire-vault.com/__l5e/assets-v1/8a77bf2c-6711-4762-b093-c4d650153bc9/cyber-essentials-plus-2026.png) ](https://registry.blockmarktech.com/certificates/) ### Cyber Essentials Certified Firevault is certified under Cyber Essentials, the UK Government backed scheme operated by the National Cyber Security Centre. Verify our certification on the official register. 03 Compliance Alignment ## Frameworks live in the Compliance Hub. This page covers how we secure your data and how every claim is verified. For how Offline Secure Storage® and Control map to NIS2, DORA, UK GDPR, ISO 27001, PCI DSS, NCSC CAF and Cyber Essentials Plus, the Compliance Hub is the single source. [Open the Compliance Hub](/compliance) 04 Verified Sources ## The Firevault Trust Index. What we say. Where we say it. Why it is true. Whether you are a legal team, investor, analyst, journalist or procurement officer, this section exists to provide clarity and credibility for every stat, fact and claim. ### What we said The exact claim or statistic we have published ### Where we said it The pages on our site where you will find it ### Where it comes from The original source with verification link ### 1 The Scale of Digital Theft Claim Where We Use It Source “Cybercrime costs £8.3 trillion annually (2025 projection).” Homepage Meet Firevault Investors [Cybersecurity Ventures 2025 Almanac\[1\]](#ref-1) “50 billion+ online files stolen per year.” Homepage Hero Eyebrow Meet Firevault Breaches Page [Cybersecurity Ventures\[1\]](#ref-1) “54% of online data is classified as sensitive.” Why Firevault Solution Pages [Thales Data Threat Report 2025\[2\]](#ref-2) “Every 2 seconds, a cyberattack threatens exposure.” Why Firevault Real Threats Section [ENISA Threat Landscape 2024\[3\]](#ref-3) ### 2 The Cost of Breach and Ransomware Claim Where We Use It Source “Average global data breach cost is £3.5 million.” Homepage Meet Firevault Brand Notes [IBM Cost of a Data Breach Report 2025\[4\]](#ref-4) “Average UK data breach cost is £3.5 million.” Homepage Stats Investors Solution Pages [IBM Cost of a Data Breach Report 2024\[4\]](#ref-4) “Average US data breach cost is £8.1 million.” Trust Index [IBM Cost of a Data Breach Report 2025\[4\]](#ref-4) “Average Middle East data breach cost is £5.7 million.” Trust Index [IBM Cost of a Data Breach Report 2025\[4\]](#ref-4) “It takes an average of 277 days to identify and contain a breach.” Why Firevault Solution Pages [IBM Cost of a Data Breach Report 2024\[4\]](#ref-4) “Ransomware attacks have risen by 105%.” Why Firevault Ransomware Risk Page [Sophos State of Ransomware 2024\[5\]](#ref-5) ### 3 Individual and Personal Fraud Claim Where We Use It Source “Average scam victim loss in the UK is £879.” Vault Page Individuals Page Customer Fraud Page [GASA/Cifas State of Scams Report 2025\[6\]](#ref-6) “Average fraud loss for millennials (29 to 44 year olds) is £1,457.” Individuals Page Trust Index [GASA/Cifas State of Scams Report 2025\[6\]](#ref-6) “Average APP fraud loss is £2,423 per case.” Customer Fraud Page Trust Index [UK Finance Annual Fraud Report 2025\[7\]](#ref-7) “Average HNWI cyber loss is £2.7 million.” HNWI Page Family Offices Page [Campden Wealth Report\[8\]](#ref-8) ### 4 Director and Executive Liability Claim Where We Use It Source “94% of breaches target executive-level information.” Directors Page Executive Leadership Page [Verizon DBIR 2024\[9\]](#ref-9) “Average breach cost when board data is compromised: £4.7 million.” Directors Page Risk Governance Page [IBM Cost of a Data Breach 2024\[4\]](#ref-4) “Maximum ICO director personal liability: £500,000.” Directors Page Regulatory Fines Page [ICO enforcement guidance\[10\]](#ref-10) “D and O insurance claims have increased 40% year-on-year due to cyber incidents.” Directors Page Risk Governance Page [Allianz Risk Barometer 2024\[11\]](#ref-11) ### 5 Sector-Specific Breach Costs Claim Where We Use It Source “Average breach cost in healthcare: £10.9 million, highest of any sector globally.” Healthcare Page [IBM Cost of a Data Breach Report 2024\[4\]](#ref-4) “Average breach cost in financial services: £4.45 million.” Banking Page Finance Role Page [IBM Cost of a Data Breach Report 2024\[4\]](#ref-4) “Average breach cost in professional services: £4.2 million.” Legal Page Professional Services Page [IBM Cost of a Data Breach Report 2024\[4\]](#ref-4) “Average breach cost in retail: £4.1 million.” Retail Page [IBM Cost of a Data Breach Report 2024\[4\]](#ref-4) “Average breach cost in energy sector: £4.7 million.” Energy Page Critical Infrastructure Page [IBM Cost of a Data Breach Report 2024\[4\]](#ref-4) “Average breach cost for UK small businesses: £165,000.” SME Page [UK Government Cyber Breaches Survey 2024\[12\]](#ref-12) ### 6 SME and Small Business Risk Claim Where We Use It Source “43% of all cyber attacks target small businesses.” SME Page Real Threats Section [Verizon DBIR 2024\[9\]](#ref-9) “60% of small businesses close within 6 months of a cyber attack.” SME Page Why Firevault [National Cyber Security Alliance\[13\]](#ref-13) “82% of ransomware attacks target businesses under 1,000 employees.” SME Page Ransomware Risk Page [Sophos State of Ransomware 2024\[14\]](#ref-14) “89% of law firms were targeted by cyber attacks in 2024.” Legal Page [SRA/National Cyber Security Centre\[15\]](#ref-15) ### 7 Compliance and Regulatory Claim Where We Use It Source “GDPR fines can reach up to €20 million or 4% of annual global turnover.” Compliance Pages DPO Role Page [GDPR Article 83\[16\]](#ref-16) “NIS2 maximum fine: £17 million+ for critical infrastructure failures.” Critical Infrastructure Page Defence Page [NIS2 Directive\[17\]](#ref-17) “UK businesses face mandatory 72 hours breach notification requirements.” Compliance Pages Directors Page [ICO guidance\[18\]](#ref-18) ### 8 Recent High-Profile Breaches Claim Where We Use It Source “M and S suffered a major cyber incident affecting customer data in 2025.” Homepage Ticker Breaches Page [BBC News\[19\]](#ref-19) “JLR (Jaguar Land Rover) experienced a ransomware attack exposing internal systems.” Homepage Ticker Breaches Page [BleepingComputer\[20\]](#ref-20) “PayPal disclosed a credential stuffing attack affecting 35,000 accounts.” Homepage Ticker Breaches Page [BleepingComputer\[21\]](#ref-21) “The Co-op reported a significant data breach in 2025.” Homepage Ticker Breaches Page [BBC News\[22\]](#ref-22) ### 9 Firevault: Verified Product Claims Claim Where We Use It Source “Firevault is the world's first offline secure storage platform. Others may claim to offer an offline vault, a vault, or offline storage, but no one else delivers offline secure storage: physically disconnected, hardware encrypted, identity-locked, and managed as a complete platform.” Homepage Meet Firevault Press and Media +1 Internal product architecture and competitive analysis “Vault by Firevault is a digital safe deposit box for individuals, SMEs and professionals.” Vault Page Create Your Vault Solution Pages Product definition “Storage by Firevault is scalable offline secure storage for businesses and service providers.” Storage Page Enterprise Solution Pages Product definition “Quantum key encryption for key exchange combined with hardware-level AES-256 encryption for data at rest.” Security Page FAQ Technical Summaries Engineering documentation “Physically disconnected and offline by default. No IP address, no standing access, no attack surface.” Why Firevault Our Difference Vault User Commitment Engineering documentation “Identity-locked with KYC, MFA, and legal successor control (Vault Buddy).” Create Your Vault Resilience and Legacy Page KYC and succession workflow “No third-party access. No remote admin. Not even Firevault can access your data.” Vault User Commitment Our Difference Firevault policy and architecture “All vaults require a 36-month minimum commitment.” Create Your Vault Pricing FAQ Customer plan structure “Stored in Firevault Bunkers, physically secured colocation facilities designed for sovereign-grade resilience.” Trust Section Meet Firevault Bunkers Page Firevault infrastructure policy “Zero data breaches since inception.” Trust Section Homepage Footer Firevault security record “2TB, 4TB and 8TB vaults are physically returned with 24/7 access. 300GB vaults (LUV) are accessed on one nominated day per week, using an issued port number, user name and password.” FAQ Vault Page Create Your Vault Product access policy “Each vault is assigned to one owner and one mobile phone account. Sharing is only permitted via Butterfly deployment mode.” FAQ Vault Page Product access policy ## References 1. \[1\] Cybersecurity Ventures 2025 Almanac, [https://cybersecurityventures.com/cybersecurity-almanac-2025/](https://cybersecurityventures.com/cybersecurity-almanac-2025/) 2. \[2\] Thales Data Threat Report 2025, [https://cpl.thalesgroup.com/data-threat-report](https://cpl.thalesgroup.com/data-threat-report) 3. \[3\] ENISA Threat Landscape 2024, [https://www.enisa.europa.eu/publications/enisa-threat-landscape-2024](https://www.enisa.europa.eu/publications/enisa-threat-landscape-2024) 4. \[4\] IBM Cost of a Data Breach Report 2025, [https://www.ibm.com/reports/data-breach](https://www.ibm.com/reports/data-breach) 5. \[5\] Sophos State of Ransomware 2024, [https://assets.sophos.com/X24WTUEQ/at/3bxxmz2zj7cbsxzmnhn7cft/sophos-state-of-ransomware-2024.pdf](https://assets.sophos.com/X24WTUEQ/at/3bxxmz2zj7cbsxzmnhn7cft/sophos-state-of-ransomware-2024.pdf) 6. \[6\] GASA/Cifas State of Scams Report 2025, [https://www.cifas.org.uk/newsroom/9.4billion\_stolenfromconsumers](https://www.cifas.org.uk/newsroom/9.4billion_stolenfromconsumers) 7. \[7\] UK Finance Annual Fraud Report 2025, [https://www.ukfinance.org.uk/policy-and-guidance/reports-and-publications/annual-fraud-report-2025](https://www.ukfinance.org.uk/policy-and-guidance/reports-and-publications/annual-fraud-report-2025) 8. \[8\] Campden Wealth Report, [https://www.campdenwealth.com/](https://www.campdenwealth.com/) 9. \[9\] Verizon DBIR 2024, [https://www.verizon.com/business/resources/reports/dbir/](https://www.verizon.com/business/resources/reports/dbir/) 10. \[10\] ICO enforcement guidance, [https://ico.org.uk/](https://ico.org.uk/) 11. \[11\] Allianz Risk Barometer 2024, [https://www.agcs.allianz.com/news-and-insights/reports/allianz-risk-barometer.html](https://www.agcs.allianz.com/news-and-insights/reports/allianz-risk-barometer.html) 12. \[12\] UK Government Cyber Breaches Survey 2024, [https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2024](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2024) 13. \[13\] National Cyber Security Alliance, [https://staysafeonline.org/](https://staysafeonline.org/) 14. \[14\] Sophos State of Ransomware 2024, [https://www.sophos.com/en-us/content/state-of-ransomware](https://www.sophos.com/en-us/content/state-of-ransomware) 15. \[15\] SRA/National Cyber Security Centre, [https://www.ncsc.gov.uk/](https://www.ncsc.gov.uk/) 16. \[16\] GDPR Article 83, [https://gdpr.eu/fines/](https://gdpr.eu/fines/) 17. \[17\] NIS2 Directive, [https://digital-strategy.ec.europa.eu/en/policies/nis2-directive](https://digital-strategy.ec.europa.eu/en/policies/nis2-directive) 18. \[18\] ICO guidance, [https://ico.org.uk/for-organisations/report-a-breach/](https://ico.org.uk/for-organisations/report-a-breach/) 19. \[19\] BBC News, [https://www.bbc.co.uk/news/articles/cwy0x8dk9y4o](https://www.bbc.co.uk/news/articles/cwy0x8dk9y4o) 20. \[20\] BleepingComputer, [https://www.bleepingcomputer.com/news/security/jaguar-land-rover-hit-by-hellcat-ransomware-data-stolen/](https://www.bleepingcomputer.com/news/security/jaguar-land-rover-hit-by-hellcat-ransomware-data-stolen/) 21. \[21\] BleepingComputer, [https://www.bleepingcomputer.com/news/security/paypal-accounts-breached-in-large-scale-credential-stuffing-attack/](https://www.bleepingcomputer.com/news/security/paypal-accounts-breached-in-large-scale-credential-stuffing-attack/) 22. \[22\] BBC News, [https://www.bbc.co.uk/news/articles/cz9r4p9lp0wo](https://www.bbc.co.uk/news/articles/cz9r4p9lp0wo) ## Related - [Why offline secure storage](/why-oss) - [Layer 1 physical air gap](/why-oss/layer-1) - [Compliance frameworks](/compliance) - [Vault commitment](/vault-commitment) - [Privacy charter](/privacy-charter) - [Knowledge centre](/learn/knowledge) - [Whitepapers](/learn/whitepapers) - [Security overview](/security) - [Contact our security team](/contact) - [About Firevault](/about) For due diligence For procurement audits For compliance and press We update this guide regularly. If you need official verification or source documents, reach out: [Contact: trust@fire-vault.com](mailto:trust@fire-vault.com) Statistics Last Verified January 2026 All claims verified against original sources. Next scheduled review: April 2026. ![Mark Fermor](/assets/mark-fermor-C-vy1NeN.jpg) ![David Bailey](/assets/david-bailey-CnLw95Ao.jpg) ![Kenny Phipps](/assets/kenny-phipps-DxIqwaIL.jpg) Online Now Concierge ## Verify our security for yourself Review our Trust Index, request a penetration test report, or book a technical deep-dive with our team. Takes about 2 minutes. No account needed. Find Out Free 2 mins No sign-up