--- title: "Control Relay Module: controlled data relay | Firevault" url: https://fire-vault.com/control-module/relay description: "Relay moves an approved payload across a controlled network hop between protected zones, without exposing either endpoint to the internet." lang: en-GB --- **FV-03 Relay**Control module · Control the path # A path that exists only for the work. Then it does not. Relay turns access from a permanent state into a planned event. A connection opens for an approved purpose, for a defined window, and closes when the window ends, enforced at Layer 1, with no manual clean-up to remember. Book a Control demo: https://fire-vault.com/demo See it in action Image: Relay module icon (https://fire-vault.com/__l5e/assets-v1/bc644d30-1db5-42e6-b88a-647a62245447/relay-icon.png) **Relay**Control the path Module FV-03 Relay Family Control the path The question it answers Should this path exist right now? Enforced by Firebreak® at Layer 1 Commanded Through Execute, out of band What happens when ## A vendor needed access once. The path is still there two years later. Remote access is opened for a reason, then forgotten. Every path left open is one someone else can find. 1. March**A support path is opened.** A supplier needs to patch an operations system. A remote connection is set up for the job. 2. April**The job is done.** Nobody closes the path. It might be needed again. 3. Two years on**Someone else finds it.** A stolen supplier credential uses the same path, which has been open the whole time. Clean-up that depends on memory does not happen. Relay closes the path on time. See it in action ## One day, one vendor. Switch between standing access and a Relay window. The same maintenance job, two ways. Choose a state to see how long the path exists. The vendor path is open around the clock, for a job that takes two hours. The path opens at 14:00 for the approved job and closes at 16:00. The rest of the day there is no path to find. Step by step 1. Step 1**Request** A named person asks for access to a named system, for a stated purpose. 2. Step 2**Approve** The system owner approves the session and its window. 3. Step 3**Open and work** The path opens at the agreed time and the work is carried out. 4. Step 4**Close and record** The path closes when the window ends. The session is on record. What Relay is ## Access as an event, not a permanent state. Relay ties every connection to a purpose, an owner and a window, so access ends when the work does. - **Defined windows** Every session has a start and an end, and the end is enforced, not requested. - **Purpose-bound** Each path is opened for a named job and owner, not as a generic tunnel. - **Self-closing** When the window ends, the path closes. Nothing is left behind for later. What it changes ## Supplier and maintenance access, on the clock. Relay does not change what the work is. It changes how long the path for it exists. ### No standing paths. No forgotten access. - Vendor and maintenance access only inside approved windows - Paths close on time, without relying on someone remembering - Every session tied to a person, a purpose and a window - A record of who had access, to what, and for how long Where it fits ## Fracture, Isolate and Relay answer different questions. The three FIRE modules work on connections. Each one is chosen for a different moment, and most Plans use more than one. | Module | Fracture | Isolate | Relay | | --- | --- | --- | --- | | The question it answers | Must this connection be physically disconnected now? | Which zones should never share a path, and where is the one permitted crossing? | Should this path exist right now, for this work, and when does it close? | | Normal state | Connected, with a crossing ready to be disconnected | Zones held apart, crossings closed by default | Closed, opened only inside an approved window | | When it acts | When a connection becomes dangerous | By design, before anything goes wrong | On a schedule or approved request | | What it ends | An incident travelling along a live path | Trust that exists only because systems share a network | Standing access left open after the work is done | | Typical Plans | CP-01, CP-02 | CP-04, CP-05, CP-14 | CP-03, CP-13, CP-17 | Control Plans and Blueprints ## Where Relay does the work. Relay is the module behind third-party, maintenance and change window Plans. Plans marked Proposed are awaiting technical approval. - CP-03**Third-Party Access Control**_Supplier and vendor paths that exist only for approved work, in a defined window._: https://fire-vault.com/control-plan/control-third-party-access - CP-13**Maintenance Window Control**_Connections that exist only for a scheduled maintenance window._: https://fire-vault.com/control-plan/maintenance-window-control - CP-17**Change Window Enforcement**_Approved changes made through a timed physical connection._: https://fire-vault.com/control-plan/change-window-enforcement - CP-11**Supply Chain Isolation**_Keep supplier networks separate from your own environment._: https://fire-vault.com/control-plan/supply-chain-isolation - **Control Plans**Twenty Plans, each solving one problem. All Control Plans (https://fire-vault.com/control-plans) - **Control Blueprints**Industry solutions that combine Plans. All Control Blueprints (https://fire-vault.com/control-blueprints) - **Firebreak®**The Layer 1 hardware that enforces the change. See Firebreak® (https://fire-vault.com/firebreak) - **The nine modules**How Relay sits alongside the others. All modules (https://fire-vault.com/control-modules) Questions ## What network and security teams ask. Want to see a window open and close on real hardware? We will show you. Book a Control demo: https://fire-vault.com/demo How is Relay different from a VPN with time limits? A VPN session ends, but the network path it used is still there. Relay closes the path itself at Layer 1 when the window ends. What happens if the work overruns? An extension is a new approval, not an assumption. The owner decides whether the window is extended. How is Relay different from Fracture and Isolate? Isolate keeps zones apart by design. Fracture disconnects a connection when it becomes dangerous. Relay opens a closed path briefly, for approved work. Who can approve a Relay session? Approvers are agreed per path during scoping, and can require more than one person where the risk warrants it. Is every session recorded? Yes. Requests, approvals, opening and closing are recorded for each session. Your next step ## See a window open and close in front of you. We will take one of your supplier or maintenance paths and show it working as a Relay window. Firevault home (https://fire-vault.com/) Offline Secure Storage® and Control. A UK cyber resilience company. Data protection and storage through Offline Secure Storage®. Network evolution and rapid protection through Control. Firevault on LinkedIn: https://www.linkedin.com/company/firevault-limited Firevault on Facebook: https://www.facebook.com/Firevaultltd/ Firevault on YouTube: https://www.youtube.com/@Firevault-ltd Verify Firevault Cyber Essentials and Cyber Essentials Plus certification on the NCSC register: https://registry.blockmarktech.com/certificates/ © 2026 Firevault Limited Company No. 16320803 VAT No. 490 8551 64 Registered in England and Wales ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-module/relay#webpage", "url": "https://fire-vault.com/control-module/relay", "name": "Control Relay Module: controlled data relay", "description": "Relay moves an approved payload across a controlled network hop between protected zones, without exposing either endpoint to the internet.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/4a65db20-473e-4f34-bdf4-7ffe9326b759/og-control-relay.webp" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-module/relay#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-module/relay#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Module", "item": "https://fire-vault.com/control-module" }, { "@type": "ListItem", "position": 3, "name": "Control Relay Module: controlled data relay", "item": "https://fire-vault.com/control-module/relay" } ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://fire-vault.com/#org", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com/", "identifier": "16320803", "sameAs": [ "https://www.linkedin.com/company/firevault-limited", "https://www.facebook.com/Firevaultltd/", "https://www.youtube.com/@Firevault-ltd" ] }, { "@type": "WebPage", "name": "FV-Relay: A path that exists only for the work", "url": "https://fire-vault.com/control-module/relay", "description": "Relay turns access from a permanent state into a temporary, purposeful event. A connection exists for the work that needs it, under the conditions that suit it, for the window it requires, and then it does not.", "publisher": { "@id": "https://fire-vault.com/#org" } }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com/" }, { "@type": "ListItem", "position": 2, "name": "FV-Relay", "item": "https://fire-vault.com/control-module/relay" } ] }, { "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is Relay a replacement for a VPN?", "acceptedAnswer": { "@type": "Answer", "text": "For standing access, it can be. Instead of a persistent VPN, the owner approves a Relay session bound to a named partner, a named system and a defined window, and the path closes automatically when the window expires." } }, { "@type": "Question", "name": "What happens if the work overruns the window?", "acceptedAnswer": { "@type": "Answer", "text": "The end of every session is enforced automatically, so the path closes when the window expires. Continuing the work means a new, approved window, recorded like the first." } }, { "@type": "Question", "name": "Can Relay be used for break-glass access?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Operator emergency access is one of Relay’s conduits: time-bound break-glass access for incident response, with multi-party approval and full audit." } }, { "@type": "Question", "name": "How does Relay relate to Firebreak?", "acceptedAnswer": { "@type": "Answer", "text": "Firebreak severs the path. Relay is the controlled opening of a normally severed conduit, for the time the work needs, no longer, and it closes on its own." } } ] } ] } ] ```