What is offline secure storage?

Offline secure storage (OSS) is a data protection method where data is physically disconnected from the internet when not in use. Unlike cloud storage, data stored offline has zero remote attack surface — it cannot be hacked, ransomed or accessed remotely because it is not connected to any network. Firevault provides this through hardware-encrypted vaults that are physically isolated.

How does Firevault protect against ransomware?

Firevault protects against ransomware by physically disconnecting your data from the internet. Ransomware can only encrypt data it can reach over a network. When your data is stored offline in a Firevault, ransomware attacks cannot reach it. Even if your entire network is compromised, your offline vault remains untouched and intact.

How much does Firevault cost?

Firevault Vault starts from £75 per month (inc VAT) for individuals. Business Storage starts from £360 per month (inc VAT). Enterprise Platform pricing is available on request. All plans include hardware encryption, identity verification, and physical disconnection by default.

Who is Firevault designed for?

Firevault is designed for individuals protecting passports, wills and crypto keys; professionals such as solicitors, accountants and consultants protecting client data; SMEs and businesses protecting crown jewel data; and regulated industries including healthcare, financial services and legal sectors requiring offline backup for compliance with GDPR, NIS2, DORA and FCA regulations.

Is Firevault GDPR compliant?

Yes. Firevault is designed to support GDPR compliance by keeping sensitive personal data physically isolated and offline. Physical disconnection ensures data is not exposed to network-based attacks, supports data minimisation principles, and provides an audit trail of access. Firevault is also designed to support NIS2, DORA, FCA and SRA compliance requirements.

What is a physical air gap?

A physical air gap is a security measure where a computer or storage device is completely isolated from the internet and all unsecured networks. Unlike a logical or software air gap, a physical air gap cannot be bridged remotely. Firevault uses a Layer 1 physical air gap — your data is stored on hardware that is physically disconnected from any network when not in active use.

DORA

Digital Operational Resilience for Financial Services

DORA requires financial entities to ensure digital operational resilience through ICT risk management, incident handling, and third-party risk governance. Firevault Control provides the physical enforcement layer that demonstrates resilience beyond software controls.

Back to Control

DORA

DORA requires financial entities to not merely survive ICT disruptions, but to demonstrate they have the resilience measures in place to continue operating through them.

Ch. II

ICT risk management framework coverage

100%

Third-party ICT path governance

Ch. V

Third-party risk management evidence

Full

Automated regulatory evidence generation

The Resilience Challenge

Financial services face stringent resilience requirements.

ICT Risk Management

DORA Chapter II requires comprehensive ICT risk management frameworks with demonstrable technical controls that go beyond policy documentation.

Third-Party Concentration

Financial entities increasingly depend on third-party ICT providers, creating concentration risks that DORA Chapter V specifically addresses.

Recovery Testing

DORA requires regular resilience testing including threat-led penetration testing. Organisations must demonstrate that recovery capabilities work under realistic conditions.

The Scenario

Scenario: DORA Resilience Assessment

A financial entity undergoes its first DORA resilience assessment. The regulator examines third-party ICT risk management and discovers that 14 vendor connections maintain persistent network access to production payment systems. The entity cannot demonstrate that these connections are actively governed or that access can be revoked in a defined timeframe. The regulator also finds that backup systems share network infrastructure with production, meaning a ransomware attack could compromise both simultaneously. With Firevault Control, all vendor connections are physically governed with time-limited access windows. Backup systems are air-gapped. The entity demonstrates continuous evidence of ICT risk management and third-party governance that exceeds DORA requirements.

"The regulator asked us how quickly we could sever a compromised vendor connection. Honestly, it would have taken us days to identify all the paths, update firewall rules, and verify the changes. With physical path governance, the answer is seconds."

Framework Mapping

Physical operational resilience for DORA compliance.

Financial entities achieve DORA compliance through physical ICT risk management measures. Third-party ICT connections are governed with time-limited, authorised access. Critical systems are physically separated. Recovery capabilities are air-gapped and guaranteed. Regulatory evidence is generated continuously.

Physical ICT risk management exceeding Chapter II requirements
Third-party governance satisfying Chapter V requirements
Rapid incident containment for Chapter III timelines
Air-gapped recovery for business continuity assurance
Continuous regulatory evidence for FCA and PRA
Resilience testing support for TLPT requirements

Fracture — ICT Incident Containment

Module 1 of 4

Physically severs compromised ICT connections to contain incidents within seconds, supporting DORA Chapter III incident management and reporting requirements.

View all nine modules

Featured In

Key Capabilities

Financial Data Sovereignty

All financial system data and configurations remain within the agreed jurisdiction in secured Firevault Bunkers, supporting data localisation requirements.

Third-Party Access Governance

Every vendor and third-party ICT access session is multi-party authorised, time-limited, and fully logged for regulatory review.

Regulatory Evidence

Automated logging generates continuous evidence for DORA, FCA, PRA, and EBA requirements across all ICT risk management domains.

Resilience Testing Support

Physical isolation capabilities support threat-led penetration testing (TLPT) by providing demonstrable containment boundaries for test scenarios.

Audit Trail

Tamper-proof logs record every ICT system access, third-party connection, and incident response action for regulatory audit.

Recovery Assurance

Air-gapped recovery capabilities demonstrate operational resilience that withstands even total network compromise scenarios.

Demo to Live

Adoption Guide

Step 1

DORA Gap Assessment

Map your current ICT risk management measures against DORA chapter requirements to identify where physical enforcement strengthens compliance.

Step 2

Resilience Architecture Design

Design physical ICT system boundaries and third-party governance models that satisfy DORA requirements across all applicable chapters.

Step 3

Resilience Validation

Deploy Control and conduct threat-led testing to validate physical containment capabilities before your regulatory assessment.

Step 4

Full DORA Deployment

Organisation-wide deployment with continuous regulatory evidence, third-party governance, and air-gapped recovery assurance.

Step 1

DORA Gap Assessment

Map your current ICT risk management measures against DORA chapter requirements to identify where physical enforcement strengthens compliance.

Step 2

Resilience Architecture Design

Design physical ICT system boundaries and third-party governance models that satisfy DORA requirements across all applicable chapters.

Step 3

Resilience Validation

Deploy Control and conduct threat-led testing to validate physical containment capabilities before your regulatory assessment.

Step 4

Full DORA Deployment

Organisation-wide deployment with continuous regulatory evidence, third-party governance, and air-gapped recovery assurance.

Organise a Demo

Questions

Frequently Asked

Ready to take the next step?

See how Control can govern your data paths with physical enforcement no software exploit can bypass.

View the nine modules

Digital Operational Resilience for Financial Services

Financial services face stringent resilience requirements.

ICT Risk Management

Third-Party Concentration

Recovery Testing

Scenario: DORA Resilience Assessment

Physical operational resilience for DORA compliance.

Fracture — ICT Incident Containment

Key Capabilities

Financial Data Sovereignty

Third-Party Access Governance

Regulatory Evidence

Resilience Testing Support

Audit Trail

Recovery Assurance

Adoption Guide

DORA Gap Assessment

Resilience Architecture Design

Resilience Validation

Full DORA Deployment

DORA Gap Assessment

Resilience Architecture Design

Resilience Validation

Full DORA Deployment

Explore More

Control for Banking

NIS2 Framework

ISO 27001 Framework

Frequently Asked

Ready to take the next step?

Your privacy matters