What is offline secure storage?

Offline secure storage (OSS) is a data protection method where data is physically disconnected from the internet when not in use. Unlike cloud storage, data stored offline has zero remote attack surface — it cannot be hacked, ransomed or accessed remotely because it is not connected to any network. Firevault provides this through hardware-encrypted vaults that are physically isolated.

How does Firevault protect against ransomware?

Firevault protects against ransomware by physically disconnecting your data from the internet. Ransomware can only encrypt data it can reach over a network. When your data is stored offline in a Firevault, ransomware attacks cannot reach it. Even if your entire network is compromised, your offline vault remains untouched and intact.

How much does Firevault cost?

Firevault Vault starts from £75 per month (inc VAT) for individuals. Business Storage starts from £360 per month (inc VAT). Enterprise Platform pricing is available on request. All plans include hardware encryption, identity verification, and physical disconnection by default.

Who is Firevault designed for?

Firevault is designed for individuals protecting passports, wills and crypto keys; professionals such as solicitors, accountants and consultants protecting client data; SMEs and businesses protecting crown jewel data; and regulated industries including healthcare, financial services and legal sectors requiring offline backup for compliance with GDPR, NIS2, DORA and FCA regulations.

Is Firevault GDPR compliant?

Yes. Firevault is designed to support GDPR compliance by keeping sensitive personal data physically isolated and offline. Physical disconnection ensures data is not exposed to network-based attacks, supports data minimisation principles, and provides an audit trail of access. Firevault is also designed to support NIS2, DORA, FCA and SRA compliance requirements.

What is a physical air gap?

A physical air gap is a security measure where a computer or storage device is completely isolated from the internet and all unsecured networks. Unlike a logical or software air gap, a physical air gap cannot be bridged remotely. Firevault uses a Layer 1 physical air gap — your data is stored on hardware that is physically disconnected from any network when not in active use.

Control Module

FV-Relay: Time-Bound Connection Windows

Most network connections are active 24/7 but used for a fraction of that time. Relay activates paths only during authorised windows and physically severs them when the window closes, eliminating the idle exposure that attackers exploit.

Back to Control

Control Module

A connection that is active for 168 hours but used for 6 creates 162 hours of unnecessary attack surface. Relay reduces that to zero.

95%

Reduction in connection exposure time for governed paths

Zero

Idle connections outside authorised windows

Automated

Path activation and severance on schedule

100%

Session activity logged on tamper-proof storage

The Problem

Always-on connections create always-on risk.

Idle Connection Exposure

VPN tunnels, vendor access paths, and inter-site links remain active 168 hours per week but are used for a fraction of that time. Every idle hour is an hour an attacker can exploit.

Forgotten Connections

Temporary connections established for projects, migrations, or troubleshooting are rarely decommissioned. They accumulate as undocumented attack surface.

Unmonitored Windows

Connections that are active outside business hours receive less monitoring and slower response times, creating ideal windows for attackers.

The Scenario

Scenario: Vendor Maintenance Window Governance

A manufacturing firm uses an equipment vendor for quarterly PLC firmware updates. Previously, the vendor maintained a persistent VPN connection to the OT network. With Relay, the connection activates every Tuesday from 02:00 to 06:00 during maintenance periods. The vendor authenticates, the multi-party authorisation is confirmed through the Lock module, and the physical path is activated. At 06:00, the path is automatically severed regardless of session status. All activity during the window is recorded on disconnected storage. Between windows, there is no path for an attacker to traverse even if the vendor's systems are compromised.

"Our vendor had a VPN that was active 24/7/365. They used it for 4 hours every quarter. Relay reduced our exposure from 8,760 hours per year to 16."

Module Overview

Connections that exist only when they are needed.

FV-Relay transforms always-on connections into policy-governed windows. Paths are physically activated only during authorised periods, require multi-party approval, and produce tamper-proof evidence of all activity. Between windows, the connection does not exist.

Physical path activation only during authorised windows
Multi-party approval before any connection is established
Automatic physical severance when windows close
Emergency extension with fresh authorisation
Complete session recording on disconnected storage
Dramatic reduction in connection exposure time

Relay — How It Works

Module 1 of 4

Relay governs network paths through policy-defined windows. Connections are physically activated at the start of an authorised window and physically severed at the end. Between windows, the path does not exist. Schedules can be recurring, one-time, or triggered by external events.

View all nine modules

Featured In

Key Capabilities

Scheduled Windows

Define recurring or one-time connection windows with precise start and end times. The physical path activates and severs automatically on schedule.

Multi-Party Gating

Window activation requires approval from the configured number of authorised parties before the physical path is established.

Automatic Severance

When a window closes, the physical path is severed regardless of session status. No connection persists beyond its authorised window.

Emergency Extension

If work overruns, an authorised extension request can extend the window. Extensions require fresh multi-party approval and are logged separately.

Window Activity Logging

All activity during each window is recorded on physically disconnected storage, providing a complete audit trail for each session.

Compliance Evidence

Automated reports document connection exposure times, authorisation chains, and session activities for regulatory and contractual compliance.

Demo to Live

Adoption Guide

Step 1

Connection Exposure Audit

Catalogue all persistent connections and calculate actual usage time versus active time to identify the highest-exposure paths.

Step 2

Window Policy Design

Define connection windows, authorisation requirements, and emergency extension procedures for each governed path.

Step 3

Vendor Path Pilot

Deploy Relay on vendor and third-party access paths first, where the usage-to-exposure ratio is typically the most extreme.

Step 4

Full Path Governance

Extend to all governed connections with automated scheduling, compliance reporting, and integration with change management platforms.

Step 1

Connection Exposure Audit

Catalogue all persistent connections and calculate actual usage time versus active time to identify the highest-exposure paths.

Step 2

Window Policy Design

Define connection windows, authorisation requirements, and emergency extension procedures for each governed path.

Step 3

Vendor Path Pilot

Deploy Relay on vendor and third-party access paths first, where the usage-to-exposure ratio is typically the most extreme.

Step 4

Full Path Governance

Extend to all governed connections with automated scheduling, compliance reporting, and integration with change management platforms.

Organise a Demo

Questions

Frequently Asked

Ready to take the next step?

See how Control can govern your data paths with physical enforcement no software exploit can bypass.

View the nine modules

FV-Relay: Time-Bound Connection Windows

Always-on connections create always-on risk.

Idle Connection Exposure

Forgotten Connections

Unmonitored Windows

Scenario: Vendor Maintenance Window Governance

Connections that exist only when they are needed.

Relay — How It Works

Key Capabilities

Scheduled Windows

Multi-Party Gating

Automatic Severance

Emergency Extension

Window Activity Logging

Compliance Evidence

Adoption Guide

Connection Exposure Audit

Window Policy Design

Vendor Path Pilot

Full Path Governance

Connection Exposure Audit

Window Policy Design

Vendor Path Pilot

Full Path Governance

Explore More

FV-Fracture

FV-Lock

Supply Chain Risk

Frequently Asked

Ready to take the next step?

Your privacy matters