What is offline secure storage?

Offline secure storage (OSS) is a data protection method where data is physically disconnected from the internet when not in use. Unlike cloud storage, data stored offline has zero remote attack surface — it cannot be hacked, ransomed or accessed remotely because it is not connected to any network. Firevault provides this through hardware-encrypted vaults that are physically isolated.

How does Firevault protect against ransomware?

Firevault protects against ransomware by physically disconnecting your data from the internet. Ransomware can only encrypt data it can reach over a network. When your data is stored offline in a Firevault, ransomware attacks cannot reach it. Even if your entire network is compromised, your offline vault remains untouched and intact.

How much does Firevault cost?

Firevault Vault starts from £75 per month (inc VAT) for individuals. Business Storage starts from £360 per month (inc VAT). Enterprise Platform pricing is available on request. All plans include hardware encryption, identity verification, and physical disconnection by default.

Who is Firevault designed for?

Firevault is designed for individuals protecting passports, wills and crypto keys; professionals such as solicitors, accountants and consultants protecting client data; SMEs and businesses protecting crown jewel data; and regulated industries including healthcare, financial services and legal sectors requiring offline backup for compliance with GDPR, NIS2, DORA and FCA regulations.

Is Firevault GDPR compliant?

Yes. Firevault is designed to support GDPR compliance by keeping sensitive personal data physically isolated and offline. Physical disconnection ensures data is not exposed to network-based attacks, supports data minimisation principles, and provides an audit trail of access. Firevault is also designed to support NIS2, DORA, FCA and SRA compliance requirements.

What is a physical air gap?

A physical air gap is a security measure where a computer or storage device is completely isolated from the internet and all unsecured networks. Unlike a logical or software air gap, a physical air gap cannot be bridged remotely. Firevault uses a Layer 1 physical air gap — your data is stored on hardware that is physically disconnected from any network when not in active use.

Control Module

FV-Lock: Identity-Bound Access Control

Critical infrastructure access should never depend on a single credential, a single approval, or a single person. Lock requires multiple authorised parties to approve access before any physical path is activated, ensuring oversight at every step.

Back to Control

Control Module

If a single credential can open the door, a single compromise opens the door. Multi-party authorisation ensures that no individual, whether legitimate or malicious, can access critical systems alone.

Multi-party

Every access requires approval from multiple authorised individuals

Zero

Single-credential access to critical systems

Identity-bound

Authorisation tied to verified identity, not just credentials

100%

Authorisation events logged on tamper-proof storage

The Problem

Single-factor authorisation is a single point of failure.

Single Credential Access

A single compromised password, token, or certificate grants full access to critical systems. No amount of password complexity eliminates the risk of credential theft through phishing or social engineering.

Approval Without Oversight

Traditional access management allows a single administrator to approve their own access to the most critical systems. There is no check on whether that access is appropriate or authorised.

Identity Spoofing

Attackers impersonate legitimate users through credential theft, session hijacking, and MFA bypass techniques. Without multi-party verification, spoofed identity grants full access.

The Scenario

Scenario: Preventing Unauthorised Access Through Multi-Party Control

An attacker compromises a senior network engineer's credentials through a targeted phishing campaign. They attempt to access the management interfaces for core firewalls and switches. Despite having valid, highly privileged credentials, the access request triggers a Lock authorisation workflow. A second authorised party — the security operations manager — must approve the session before the physical path to the management network is activated. The security operations manager, unaware of any scheduled maintenance, denies the request and triggers an investigation. The attacker is contained before reaching any management interface.

"The credentials they stole would have given them access to everything. But the Lock module required a second authorisation from someone else on our team. That second check stopped the attack cold."

Module Overview

Access that requires human oversight, every time.

FV-Lock ensures that critical infrastructure access always requires multiple verified individuals to approve. Combined with identity verification, time-bound sessions, and tamper-proof logging, Lock eliminates the risk of single-credential compromise leading to infrastructure access.

Multi-party authorisation for all critical system access
Identity verification beyond credentials alone
Configurable approval requirements by system criticality
Automatic session termination after approved duration
Emergency override with enhanced logging
Tamper-proof audit trail of all authorisation events

Lock — How It Works

Module 1 of 4

Lock gates physical path activation behind multi-party authorisation. Before any connection to critical infrastructure is established, the configured number of authorised parties must approve the request through verified identity. The physical path is activated only after all required approvals are received.

View all nine modules

Featured In

Key Capabilities

Multi-Party Authorisation

Access requires approval from a configurable number of authorised parties. No single individual can activate a path to critical infrastructure alone.

Identity Verification

Each authorising party is verified through strong identity mechanisms, not just credentials. Biometric, hardware token, and location verification are supported.

Role-Based Policies

Authorisation requirements vary by system criticality. Core infrastructure may require three-party approval while standard systems require two.

Time-Bound Sessions

Authorised sessions are automatically terminated after the approved duration. Extensions require fresh multi-party approval.

Emergency Override

Emergency access procedures provide accelerated authorisation with enhanced logging and mandatory post-access review.

Complete Audit Trail

Every request, approval, denial, and session is recorded on tamper-proof, physically disconnected storage.

Demo to Live

Adoption Guide

Step 1

Access Governance Audit

Identify all critical systems where single-credential access currently exists and map the authorisation requirements for each.

Step 2

Authorisation Policy Design

Define multi-party requirements, identity verification methods, backup authoriser chains, and emergency override procedures for each system tier.

Step 3

Core Infrastructure Pilot

Deploy Lock on the most critical management interfaces, testing approval workflows, emergency procedures, and session time limits.

Step 4

Full Governance Deployment

Extend to all governed systems with automated policy enforcement, mobile approval notifications, and continuous compliance evidence.

Step 1

Access Governance Audit

Identify all critical systems where single-credential access currently exists and map the authorisation requirements for each.

Step 2

Authorisation Policy Design

Define multi-party requirements, identity verification methods, backup authoriser chains, and emergency override procedures for each system tier.

Step 3

Core Infrastructure Pilot

Deploy Lock on the most critical management interfaces, testing approval workflows, emergency procedures, and session time limits.

Step 4

Full Governance Deployment

Extend to all governed systems with automated policy enforcement, mobile approval notifications, and continuous compliance evidence.

Organise a Demo

Questions

Frequently Asked

Ready to take the next step?

See how Control can govern your data paths with physical enforcement no software exploit can bypass.

View the nine modules

FV-Lock: Identity-Bound Access Control

Single-factor authorisation is a single point of failure.

Single Credential Access

Approval Without Oversight

Identity Spoofing

Scenario: Preventing Unauthorised Access Through Multi-Party Control

Access that requires human oversight, every time.

Lock — How It Works

Key Capabilities

Multi-Party Authorisation

Identity Verification

Role-Based Policies

Time-Bound Sessions

Emergency Override

Complete Audit Trail

Adoption Guide

Access Governance Audit

Authorisation Policy Design

Core Infrastructure Pilot

Full Governance Deployment

Access Governance Audit

Authorisation Policy Design

Core Infrastructure Pilot

Full Governance Deployment

Explore More

FV-Unlink

FV-Relay

Insider Threat Mitigation

Frequently Asked

Ready to take the next step?

Your privacy matters