Is Relay a replacement for a VPN?

For standing access, it can be. Instead of a persistent VPN, the owner approves a Relay session bound to a named partner, a named system and a defined window, and the path closes automatically when the window expires.

What happens if the work overruns the window?

The end of every session is enforced automatically, so the path closes when the window expires. Continuing the work means a new, approved window, recorded like the first.

Can Relay be used for break-glass access?

Yes. Operator emergency access is one of Relay’s conduits: time-bound break-glass access for incident response, with multi-party approval and full audit.

How does Relay relate to Firebreak?

Firebreak severs the path. Relay is the controlled opening of a normally severed conduit, for the time the work needs, no longer, and it closes on its own.

FV-03 RelayControl module · Control the path

A path that exists only for the work. Then it does not.

Relay turns access from a permanent state into a planned event. A connection opens for an approved purpose, for a defined window, and closes when the window ends, enforced at Layer 1, with no manual clean-up to remember.

Book a Control demo See it in action

RelayControl the path

Module: FV-03 Relay
Family: Control the path
The question it answers: Should this path exist right now?
Enforced by: Firebreak® at Layer 1
Commanded: Through Execute, out of band

What happens when

A vendor needed access once. The path is still there two years later.

Remote access is opened for a reason, then forgotten. Every path left open is one someone else can find.

MarchA support path is opened.
A supplier needs to patch an operations system. A remote connection is set up for the job.
AprilThe job is done.
Nobody closes the path. It might be needed again.
Two years onSomeone else finds it.
A stolen supplier credential uses the same path, which has been open the whole time.

Clean-up that depends on memory does not happen. Relay closes the path on time.

See it in action

One day, one vendor. Switch between standing access and a Relay window.

The same maintenance job, two ways. Choose a state to see how long the path exists.

Standing accessWith Relay

The vendor path is open around the clock, for a job that takes two hours.

The path opens at 14:00 for the approved job and closes at 16:00. The rest of the day there is no path to find.

Step by step

Step 1Request
A named person asks for access to a named system, for a stated purpose.
Step 2Approve
The system owner approves the session and its window.
Step 3Open and work
The path opens at the agreed time and the work is carried out.
Step 4Close and record
The path closes when the window ends. The session is on record.

What Relay is

Access as an event, not a permanent state.

Relay ties every connection to a purpose, an owner and a window, so access ends when the work does.

Defined windows
Every session has a start and an end, and the end is enforced, not requested.
Purpose-bound
Each path is opened for a named job and owner, not as a generic tunnel.
Self-closing
When the window ends, the path closes. Nothing is left behind for later.

What it changes

Supplier and maintenance access, on the clock.

Relay does not change what the work is. It changes how long the path for it exists.

Relay record

Open · Vendor to OperationsApproved by system ownerOpen
Close · Vendor to OperationsWindow ended 16:00Closed
Request · Remote siteAwaiting approvalPending
Close · Change windowWindow ended 02:00Closed

No standing paths. No forgotten access.

Vendor and maintenance access only inside approved windows
Paths close on time, without relying on someone remembering
Every session tied to a person, a purpose and a window
A record of who had access, to what, and for how long

Where it fits

Fracture, Isolate and Relay answer different questions.

The three FIRE modules work on connections. Each one is chosen for a different moment, and most Plans use more than one.

Module	Fracture	Isolate	Relay
The question it answers	Must this connection be physically disconnected now?	Which zones should never share a path, and where is the one permitted crossing?	Should this path exist right now, for this work, and when does it close?
Normal state	Connected, with a crossing ready to be disconnected	Zones held apart, crossings closed by default	Closed, opened only inside an approved window
When it acts	When a connection becomes dangerous	By design, before anything goes wrong	On a schedule or approved request
What it ends	An incident travelling along a live path	Trust that exists only because systems share a network	Standing access left open after the work is done
Typical Plans	CP-01, CP-02	CP-04, CP-05, CP-14	CP-03, CP-13, CP-17

Control Plans and Blueprints

Where Relay does the work.

Relay is the module behind third-party, maintenance and change window Plans. Plans marked Proposed are awaiting technical approval.

Control PlansTwenty Plans, each solving one problem.All Control Plans
Control BlueprintsIndustry solutions that combine Plans.All Control Blueprints
Firebreak®The Layer 1 hardware that enforces the change.See Firebreak®
The nine modulesHow Relay sits alongside the others.All modules

Questions

What network and security teams ask.

Want to see a window open and close on real hardware? We will show you.

Book a Control demo

How is Relay different from a VPN with time limits?

A VPN session ends, but the network path it used is still there. Relay closes the path itself at Layer 1 when the window ends.

What happens if the work overruns?

An extension is a new approval, not an assumption. The owner decides whether the window is extended.

How is Relay different from Fracture and Isolate?

Isolate keeps zones apart by design. Fracture disconnects a connection when it becomes dangerous. Relay opens a closed path briefly, for approved work.

Who can approve a Relay session?

Approvers are agreed per path during scoping, and can require more than one person where the risk warrants it.

Is every session recorded?

Yes. Requests, approvals, opening and closing are recorded for each session.

Your next step

See a window open and close in front of you.

We will take one of your supplier or maintenance paths and show it working as a Relay window.

Book a Control demo