What is offline secure storage?

Offline secure storage (OSS) is a data protection method where data is physically disconnected from the internet when not in use. Unlike cloud storage, data stored offline has zero remote attack surface — it cannot be hacked, ransomed or accessed remotely because it is not connected to any network. Firevault provides this through hardware-encrypted vaults that are physically isolated.

How does Firevault protect against ransomware?

Firevault protects against ransomware by physically disconnecting your data from the internet. Ransomware can only encrypt data it can reach over a network. When your data is stored offline in a Firevault, ransomware attacks cannot reach it. Even if your entire network is compromised, your offline vault remains untouched and intact.

How much does Firevault cost?

Firevault Vault starts from £75 per month (inc VAT) for individuals. Business Storage starts from £360 per month (inc VAT). Enterprise Platform pricing is available on request. All plans include hardware encryption, identity verification, and physical disconnection by default.

Who is Firevault designed for?

Firevault is designed for individuals protecting passports, wills and crypto keys; professionals such as solicitors, accountants and consultants protecting client data; SMEs and businesses protecting crown jewel data; and regulated industries including healthcare, financial services and legal sectors requiring offline backup for compliance with GDPR, NIS2, DORA and FCA regulations.

Is Firevault GDPR compliant?

Yes. Firevault is designed to support GDPR compliance by keeping sensitive personal data physically isolated and offline. Physical disconnection ensures data is not exposed to network-based attacks, supports data minimisation principles, and provides an audit trail of access. Firevault is also designed to support NIS2, DORA, FCA and SRA compliance requirements.

What is a physical air gap?

A physical air gap is a security measure where a computer or storage device is completely isolated from the internet and all unsecured networks. Unlike a logical or software air gap, a physical air gap cannot be bridged remotely. Firevault uses a Layer 1 physical air gap — your data is stored on hardware that is physically disconnected from any network when not in active use.

IEC 62443

Physical Enforcement of Industrial Automation Security

IEC 62443 defines zone and conduit requirements for industrial control system security. Firevault Control provides the physical enforcement layer that ensures zones are truly separated and conduits are genuinely controlled.

Back to Control

IEC 62443

IEC 62443 requires zones and conduits. If those zones are defined by firewall rules rather than physical separation, every firewall misconfiguration is a potential zone boundary failure.

SL 4

Security Level achievable with physical enforcement

100%

Zone boundary physical enforcement

Control modules mapping to IEC 62443 requirements

Full

Automated compliance evidence generation

The Compliance Gap

Software-only zone enforcement falls short.

Logical vs Physical Zones

IEC 62443 defines zones and conduits, but most implementations rely on firewalls and VLANs that can be bypassed through misconfiguration or compromise.

Purdue Model Erosion

The Purdue model's hierarchical separation erodes as organisations connect Level 3 systems to cloud services and remote access platforms.

Evidence Gaps

Demonstrating continuous zone enforcement to auditors is difficult when boundaries are defined in software configurations that change frequently.

The Scenario

Scenario: Zone Boundary Failure During Audit

During an IEC 62443 certification audit, the assessor discovers that a firewall rule change made three months earlier had inadvertently created a path between Level 2 (control system) and Level 4 (enterprise) zones. The change was part of a routine maintenance update and had passed through the change management process without flagging the zone boundary violation. For three months, the control system zone was directly reachable from the enterprise network. With Firevault Control, zone boundaries are physical. No software change, configuration error, or routine maintenance can create a path between zones without explicit, multi-party authorised physical activation.

"We passed our IEC 62443 assessment in January. By April, a routine firewall change had created a path from our enterprise zone directly into the control system zone. Nobody noticed for three months. The zone boundary existed only as long as the firewall rules were correct."

Framework Mapping

Physical compliance with IEC 62443.

Industrial organisations achieve demonstrable IEC 62443 compliance through physical zone enforcement rather than software-defined boundaries. Zone boundaries cannot be bypassed through misconfiguration. Conduits are governed, time-limited, and fully audited. Compliance evidence is generated continuously and preserved in tamper-proof archives.

Physical zone boundaries that cannot be misconfigured
Governed, time-limited conduits with full audit capture
Continuous compliance evidence between assessments
Direct mapping to Purdue model levels
Tamper-proof audit logs for assessor review
Air-gapped evidence preservation

Fracture — Zone Boundary Enforcement

Module 1 of 4

Provides physical enforcement of IEC 62443 zone boundaries. Zones are separated at the physical connectivity level, ensuring that no software misconfiguration can create an unauthorised conduit between zones.

View all nine modules

Featured In

Key Capabilities

Physical Zone Enforcement

Zone boundaries are physical, not logical. No software change can create an unauthorised path between zones regardless of privilege level.

Conduit Control

Every conduit between zones requires multi-party authorisation, operates within defined time windows, and generates full audit evidence.

Continuous Evidence

Automated logging generates continuous IEC 62443 compliance evidence, eliminating the gap between point-in-time assessments.

Purdue Model Alignment

Control modules map directly to Purdue model levels, providing clear, auditable alignment between your architecture and the standard.

Audit-Ready Logs

Tamper-proof logs record every zone boundary state change, conduit activation, and access authorisation for assessor review.

Evidence Preservation

Air-gapped compliance evidence archives ensure audit records persist independently of any network-connected systems.

Demo to Live

Adoption Guide

Step 1

Zone and Conduit Assessment

Map your current IEC 62443 zone architecture and identify where logical boundaries should be replaced with physical enforcement.

Step 2

Physical Zone Design

Design physically enforced zone boundaries with Control modules at each conduit, aligned to your target Security Level.

Step 3

Compliance Validation

Deploy in a representative zone boundary with full evidence generation to validate compliance claims before your next assessment.

Step 4

Full Zone Enforcement

Physical enforcement across all zone boundaries with continuous compliance evidence and tamper-proof audit archives.

Step 1

Zone and Conduit Assessment

Map your current IEC 62443 zone architecture and identify where logical boundaries should be replaced with physical enforcement.

Step 2

Physical Zone Design

Design physically enforced zone boundaries with Control modules at each conduit, aligned to your target Security Level.

Step 3

Compliance Validation

Deploy in a representative zone boundary with full evidence generation to validate compliance claims before your next assessment.

Step 4

Full Zone Enforcement

Physical enforcement across all zone boundaries with continuous compliance evidence and tamper-proof audit archives.

Organise a Demo

Questions

Frequently Asked

Ready to take the next step?

See how Control can govern your data paths with physical enforcement no software exploit can bypass.

View the nine modules

Physical Enforcement of Industrial Automation Security

Software-only zone enforcement falls short.

Logical vs Physical Zones

Purdue Model Erosion

Evidence Gaps

Scenario: Zone Boundary Failure During Audit

Physical compliance with IEC 62443.

Fracture — Zone Boundary Enforcement

Key Capabilities

Physical Zone Enforcement

Conduit Control

Continuous Evidence

Purdue Model Alignment

Audit-Ready Logs

Evidence Preservation

Adoption Guide

Zone and Conduit Assessment

Physical Zone Design

Compliance Validation

Full Zone Enforcement

Zone and Conduit Assessment

Physical Zone Design

Compliance Validation

Full Zone Enforcement

Explore More

Control for OT Environments

Control for Oil and Gas

NIST CSF Framework

Frequently Asked

Ready to take the next step?

Your privacy matters