What is offline secure storage?

Offline secure storage (OSS) is a data protection method where data is physically disconnected from the internet when not in use. Unlike cloud storage, data stored offline has zero remote attack surface — it cannot be hacked, ransomed or accessed remotely because it is not connected to any network. Firevault provides this through hardware-encrypted vaults that are physically isolated.

How does Firevault protect against ransomware?

Firevault protects against ransomware by physically disconnecting your data from the internet. Ransomware can only encrypt data it can reach over a network. When your data is stored offline in a Firevault, ransomware attacks cannot reach it. Even if your entire network is compromised, your offline vault remains untouched and intact.

How much does Firevault cost?

Firevault Vault starts from £75 per month (inc VAT) for individuals. Business Storage starts from £360 per month (inc VAT). Enterprise Platform pricing is available on request. All plans include hardware encryption, identity verification, and physical disconnection by default.

Who is Firevault designed for?

Firevault is designed for individuals protecting passports, wills and crypto keys; professionals such as solicitors, accountants and consultants protecting client data; SMEs and businesses protecting crown jewel data; and regulated industries including healthcare, financial services and legal sectors requiring offline backup for compliance with GDPR, NIS2, DORA and FCA regulations.

Is Firevault GDPR compliant?

Yes. Firevault is designed to support GDPR compliance by keeping sensitive personal data physically isolated and offline. Physical disconnection ensures data is not exposed to network-based attacks, supports data minimisation principles, and provides an audit trail of access. Firevault is also designed to support NIS2, DORA, FCA and SRA compliance requirements.

What is a physical air gap?

A physical air gap is a security measure where a computer or storage device is completely isolated from the internet and all unsecured networks. Unlike a logical or software air gap, a physical air gap cannot be bridged remotely. Firevault uses a Layer 1 physical air gap — your data is stored on hardware that is physically disconnected from any network when not in active use.

Control Module

FV-Vault: Encrypted Offline Storage

Critical data — recovery copies, configurations, crown jewels — must exist beyond the reach of network-based attacks. Vault provides encrypted, physically disconnected storage that ensures your most important assets remain intact regardless of what happens on your network.

Back to Control

Control Module

You cannot protect data from network attacks by putting it on a different part of the network. Physical disconnection is the only storage protection that an attacker on your network cannot reach.

Air-gapped

Physically disconnected from all network infrastructure

AES-256

Encryption at rest with hardware key management

Zero

Network paths to stored data during isolation periods

Verified

Cryptographic integrity on every retrieval

The Problem

Network-connected storage is network-accessible to attackers.

Backup Encryption

Ransomware specifically targets backup infrastructure. Network-connected backups, including cloud backups, are encrypted alongside production data, eliminating the primary recovery mechanism.

Immutability Bypasses

Immutable storage solutions still require network connectivity for management. If an attacker reaches the management interface, immutability settings can be overridden or the storage controller compromised.

Cloud Storage Risks

Cloud storage depends on credential security. Compromised cloud credentials or a misconfigured access policy can expose backup data to exfiltration or destruction.

The Scenario

Scenario: Air-Gapped Recovery After Total Encryption

A financial services firm experiences a ransomware attack that encrypts all production systems, including the primary backup server and the cloud-replicated copies. The attackers had compromised the backup administrator's credentials three weeks earlier and used them to delete cloud snapshots and encrypt the on-premises backup appliance. With Vault, the firm's critical data — database backups, system configurations, and regulatory records — exists on physically disconnected, encrypted storage. The ransomware never reached it because there was no network path to traverse. Recovery begins within hours using the Execute module, with cryptographic verification of every restored asset.

"They encrypted our production, our backups, and our cloud replicas. The only copies they did not reach were in the Vault, because there was no network path for them to follow."

Module Overview

Data protection through physical disconnection.

FV-Vault provides encrypted, air-gapped storage that keeps critical data beyond the reach of any network-based attack. Combined with controlled transfer windows, cryptographic integrity verification, and multi-party access governance, Vault ensures that your most important assets remain available for recovery regardless of what happens on your network.

Physically disconnected storage beyond network reach
AES-256 encryption with hardware key management
Cryptographic integrity verification on every retrieval
Controlled, time-bound transfer windows
Multi-party authorisation for all access operations
Configurable retention policies for regulatory compliance

Vault — How It Works

Module 1 of 4

Vault stores encrypted data on physically disconnected infrastructure. Data is transferred during controlled windows through the Transfer module, encrypted with AES-256 using hardware key management, and verified with cryptographic hashes. Between transfer windows, no network path to the stored data exists.

View all nine modules

Featured In

Key Capabilities

Physical Disconnection

Vault storage is physically disconnected from all network infrastructure. No network path, logical or physical, exists between Vault and production systems during isolation periods.

AES-256 Encryption

All data stored in Vault is encrypted at rest using AES-256 with hardware-managed keys. Even physical access to the storage media yields nothing without the encryption keys.

Cryptographic Integrity

Every data asset stored in Vault is hashed at ingestion. On retrieval, the hash is verified to confirm the data has not been tampered with or corrupted.

Controlled Transfer Windows

Data moves into and out of Vault through time-bound, policy-controlled windows. The transfer conduit physically disconnects after each operation.

Immutable Access Logs

Every transfer, retrieval, and access attempt is logged on physically disconnected storage that cannot be modified by any network-connected user or system.

Regulatory Retention

Vault supports configurable retention policies that meet GDPR, NIS2, DORA, and industry-specific data retention requirements.

Demo to Live

Adoption Guide

Step 1

Critical Data Inventory

Identify all data assets that require air-gapped protection: recovery copies, configurations, regulatory records, and organisational crown jewels.

Step 2

Vault Architecture Design

Define storage capacity, encryption requirements, transfer schedules, retention policies, and multi-site replication needs.

Step 3

Initial Data Ingestion

Transfer critical data to Vault through controlled windows, verify cryptographic integrity, and validate retrieval procedures.

Step 4

Operational Integration

Automate transfer schedules, integrate with Execute for recovery orchestration, and establish ongoing integrity verification procedures.

Step 1

Critical Data Inventory

Identify all data assets that require air-gapped protection: recovery copies, configurations, regulatory records, and organisational crown jewels.

Step 2

Vault Architecture Design

Define storage capacity, encryption requirements, transfer schedules, retention policies, and multi-site replication needs.

Step 3

Initial Data Ingestion

Transfer critical data to Vault through controlled windows, verify cryptographic integrity, and validate retrieval procedures.

Step 4

Operational Integration

Automate transfer schedules, integrate with Execute for recovery orchestration, and establish ongoing integrity verification procedures.

Organise a Demo

Questions

Frequently Asked

Ready to take the next step?

See how Control can govern your data paths with physical enforcement no software exploit can bypass.

View the nine modules

FV-Vault: Encrypted Offline Storage

Network-connected storage is network-accessible to attackers.

Backup Encryption

Immutability Bypasses

Cloud Storage Risks

Scenario: Air-Gapped Recovery After Total Encryption

Data protection through physical disconnection.

Vault — How It Works

Key Capabilities

Physical Disconnection

AES-256 Encryption

Cryptographic Integrity

Controlled Transfer Windows

Immutable Access Logs

Regulatory Retention

Adoption Guide

Critical Data Inventory

Vault Architecture Design

Initial Data Ingestion

Operational Integration

Critical Data Inventory

Vault Architecture Design

Initial Data Ingestion

Operational Integration

Explore More

FV-Execute

FV-Transfer

Ransomware Containment

Frequently Asked

Ready to take the next step?

Your privacy matters