What is offline secure storage?

Offline secure storage (OSS) is a data protection method where data is physically disconnected from the internet when not in use. Unlike cloud storage, data stored offline has zero remote attack surface — it cannot be hacked, ransomed or accessed remotely because it is not connected to any network. Firevault provides this through hardware-encrypted vaults that are physically isolated.

How does Firevault protect against ransomware?

Firevault protects against ransomware by physically disconnecting your data from the internet. Ransomware can only encrypt data it can reach over a network. When your data is stored offline in a Firevault, ransomware attacks cannot reach it. Even if your entire network is compromised, your offline vault remains untouched and intact.

How much does Firevault cost?

Firevault Vault starts from £75 per month (inc VAT) for individuals. Business Storage starts from £360 per month (inc VAT). Enterprise Platform pricing is available on request. All plans include hardware encryption, identity verification, and physical disconnection by default.

Who is Firevault designed for?

Firevault is designed for individuals protecting passports, wills and crypto keys; professionals such as solicitors, accountants and consultants protecting client data; SMEs and businesses protecting crown jewel data; and regulated industries including healthcare, financial services and legal sectors requiring offline backup for compliance with GDPR, NIS2, DORA and FCA regulations.

Is Firevault GDPR compliant?

Yes. Firevault is designed to support GDPR compliance by keeping sensitive personal data physically isolated and offline. Physical disconnection ensures data is not exposed to network-based attacks, supports data minimisation principles, and provides an audit trail of access. Firevault is also designed to support NIS2, DORA, FCA and SRA compliance requirements.

What is a physical air gap?

A physical air gap is a security measure where a computer or storage device is completely isolated from the internet and all unsecured networks. Unlike a logical or software air gap, a physical air gap cannot be bridged remotely. Firevault uses a Layer 1 physical air gap — your data is stored on hardware that is physically disconnected from any network when not in active use.

OSS, Compliance & Risk

ISO 27001 with Offline Secure Storage

ISO 27001 requires a systematic approach to information security. Offline Secure Storage (OSS) maps directly to Annex A physical and environmental controls.

View All Compliance

We Think This Is Hard to Ignore

M&S had ISO 27001 certification when DragonForce ransomware bypassed their certified controls via a third-party compromise. At Firevault, classified information assets live on hardware with no network connection, because Annex A.11 physical security means nothing if the data is always online.

£14M

ICO fine to Capita — ISO 27001 certified at time of breach

ICO, October 2025

6M+

People affected despite Capita holding ISO 27001

ICO, October 2025

277 days

Average time to identify and contain a breach

IBM Cost of a Data Breach 2024

£4.5M

Average cost of a data breach globally

IBM Cost of a Data Breach 2024

The Gap

ISO 27001 requires physical security controls.

Annex A.11 Physical Security

Physical security perimeters and environmental controls are mandatory, not optional.

Asset Management

Critical information assets must be identified, classified, and appropriately protected.

Access Control

Logical and physical access controls must be proportional to asset sensitivity.

The Reality

Certification alone does not prevent breaches.

Capita: £14M Fine Despite Holding ISO 27001 Certification

Capita held ISO 27001 certification at the time of its breach. The ICO still fined the company £14 million, demonstrating that certification without physical protection is insufficient.

ICO, October 2025

LastPass: £1.2M Fine Despite Security Company Status

LastPass, a company whose entire business is security, was fined £1.2 million by the ICO for failures that allowed hackers to steal personal data of 1.6 million UK customers.

ICO, December 2025

M&S: Third-Party Compromise Bypassed Certified Controls

Attackers bypassed M&S security controls by compromising a third-party provider, demonstrating that ISO 27001 supply chain controls must extend to physical protection.

Reuters, 2025

How OSS Maps

Direct mapping to ISO 27001 controls.

Offline Secure Storage (OSS) provides physical infrastructure that directly satisfies multiple Annex A controls.

Physical security perimeters (A.11.1) — purpose-built secure facilities
Equipment security (A.11.2) — tamper-evident, monitored environments
Access control (A.9) — authenticated, audited access sessions
Operations security (A.12) — controlled processing environments

Take Classified Assets Off Standard Infrastructure

Step 1 of 3

Classified information assets are taken off standard infrastructure and written to physically disconnected RAID 1 drives inside a Firevault Bunker. This directly satisfies Annex A.11 physical security perimeter controls.

Featured In