---
title: "Control Unlink Module: physical disconnection | Firevault"
url: https://fire-vault.com/control-module/unlink
description: "Unlink performs a Layer 1 physical disconnection of your vault from every network path. Read how the module verifies the break and records the state change."
lang: en-GB
---

**FV-07 Unlink**Control module · Protect the asset

# Remove the connections nobody needs any more.

Unlink finds and removes the persistent connections and dependencies that leave critical data exposed: old tunnels, legacy syncs, supplier links and shared stores that outlived their purpose. What remains is there on purpose.

Book a Control demo: https://fire-vault.com/demo
See it in action

Image: Unlink module icon (https://fire-vault.com/__l5e/assets-v1/178b4095-e1fa-4da5-abe2-8206ce31efb1/unlink-icon.png)
**Unlink**Protect the asset

Module

FV-07 Unlink

Family

Protect the asset

The question it answers

Does this connection still need to exist?

Removes

Persistent links and inherited trust

Keeps

Only connections with an owner and a reason

What happens when

## Nobody remembers why it is connected. An attacker does not need to.

Systems collect connections over the years. Each one was reasonable once. Few are ever removed.

1. 2019**A VPN for a project.**
   The project ended. The tunnel did not.
2. 2021**A sync for a migration.**
   The old system is gone. The sync still runs.
3. Today**Four routes in.**
   The payments platform is reachable four ways, and only one is needed.

Every unused connection is a free route in. Unlink takes it away.

See it in action

## One critical system. Switch between inherited links and Unlink.

The same system and the same four connections, handled two ways.

Four persistent connections reach the payments platform. Only one is still needed.

Three are removed. The backup share stays, because it has an owner and a reason.

Step by step

1. Step 1**Find**
   List every persistent connection to the asset.
2. Step 2**Ask**
   Give each one an owner and a reason, or mark it for removal.
3. Step 3**Remove**
   Unneeded connections are taken out of use.
4. Step 4**Keep watch**
   New persistent links are reviewed before they become permanent.

What Unlink is

## Less to reach. Less to defend.

Unlink reduces exposure by removing what should not be there, rather than adding another layer on top.

- **Persistent links**
  Tunnels, syncs and shares that stay connected all the time.
- **Inherited trust**
  Access that exists because of history, not a decision.
- **Owner and reason**
  Every remaining connection has both.

What it changes

## Fewer ways in, and a reason for each one.

Unlink does not stop new attacks. It removes the old routes they would use.

### A smaller attack surface. A known one.

- Unused connections are removed
- Every remaining link has an owner and a reason
- New persistent links are reviewed
- A record of what was removed and why

Where it fits

## Fracture, Isolate and Unlink answer different questions.

Fracture and Isolate decide whether connections exist. Unlink does a different job, and most Plans use more than one module.

| Module | Fracture | Isolate | Unlink |
| --- | --- | --- | --- |
| The question it answers | Must this connection be physically disconnected now? | Which zones should never share a path? | Does this persistent connection still need to exist? |
| Normal state | Connected, with a crossing ready to be disconnected | Zones held apart, crossings closed by default | Only connections with an owner and a reason remain |
| When it acts | When a connection becomes dangerous | By design, before anything goes wrong | During review, and when a connection loses its purpose |
| What it ends | An incident travelling along a live path | Trust that exists only because systems share a network | Old links and inherited trust nobody chose |
| Typical Plans | CP-01, CP-02 | CP-04, CP-05, CP-14 | CP-11, CP-18, CP-01 |

Control Plans and Blueprints

## Where Unlink does the work.

Unlink reduces exposure in supply chain, exfiltration and ransomware Plans. Plans marked Proposed are awaiting technical approval.

- CP-11**Supply Chain Isolation**_Keep supplier networks separate from your own environment._: https://fire-vault.com/control-plan/supply-chain-isolation
- CP-18**Data Exfiltration Interruption**_Interrupt outbound paths at a physical boundary._: https://fire-vault.com/control-plan/data-exfiltration-interruption
- CP-01**Ransomware Containment**_Cut the paths ransomware uses to spread before encryption reaches critical systems._: https://fire-vault.com/control-plan/stop-kill-chain-ransomware
- **Control Plans**Twenty Plans, each solving one problem. All Control Plans (https://fire-vault.com/control-plans)
- **Control Blueprints**Industry solutions that combine Plans. All Control Blueprints (https://fire-vault.com/control-blueprints)
- **Fracture**Physically disconnect a connection. See Fracture (https://fire-vault.com/control-module/fracture)
- **Isolate**Hold zones apart by design. See Isolate (https://fire-vault.com/control-module/isolate)

Questions

## What network and security teams ask.

Want to see it on real hardware? We will show you.

Book a Control demo: https://fire-vault.com/demo

How is Unlink different from Fracture?

Fracture disconnects a live connection when it becomes dangerous. Unlink removes connections that no longer need to exist, before anything goes wrong.

How is Unlink different from Isolate?

Isolate sets boundaries between zones. Unlink removes individual persistent links and dependencies, wherever they are.

Will removing links break things?

Each connection is given an owner and checked before removal. Nothing is removed without agreement.

Is this a one-off clean-up?

It starts as one, then becomes a review so new persistent links do not build up again.

Your next step

## Find the connections you no longer need.

We will review the links to one critical system and show what can be removed.

Firevault home (https://fire-vault.com/)

Offline Secure Storage® and Control.

A UK cyber resilience company. Data protection and storage through Offline Secure Storage®. Network evolution and rapid protection through Control.

Firevault on LinkedIn: https://www.linkedin.com/company/firevault-limited
Firevault on Facebook: https://www.facebook.com/Firevaultltd/
Firevault on YouTube: https://www.youtube.com/@Firevault-ltd

Verify Firevault Cyber Essentials and Cyber Essentials Plus certification on the NCSC register: https://registry.blockmarktech.com/certificates/

© 2026 Firevault Limited Company No. 16320803 VAT No. 490 8551 64 Registered in England and Wales

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "https://fire-vault.com/#organization",
    "name": "Firevault",
    "legalName": "Firevault Limited",
    "url": "https://fire-vault.com",
    "logo": {
      "@type": "ImageObject",
      "url": "https://fire-vault.com/logo.png",
      "width": 200,
      "height": 60
    },
    "foundingDate": "2025-03",
    "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.",
    "address": {
      "@type": "PostalAddress",
      "addressCountry": "GB",
      "addressLocality": "United Kingdom"
    },
    "contactPoint": [
      {
        "@type": "ContactPoint",
        "contactType": "customer service",
        "email": "hello@fire-vault.com",
        "availableLanguage": "English",
        "areaServed": [
          "GB",
          "EU",
          "US",
          "AE"
        ]
      },
      {
        "@type": "ContactPoint",
        "contactType": "sales",
        "email": "sales@fire-vault.com",
        "availableLanguage": "English",
        "areaServed": [
          "GB",
          "EU",
          "US",
          "AE"
        ]
      }
    ],
    "founder": [
      {
        "@type": "Person",
        "name": "Mark Fermor",
        "jobTitle": "Founder, CTO and CMO"
      },
      {
        "@type": "Person",
        "name": "David Bailey",
        "jobTitle": "Founder and CEO"
      }
    ],
    "areaServed": [
      "United Kingdom",
      "Europe",
      "United States",
      "Middle East"
    ],
    "sameAs": [
      "https://www.linkedin.com/company/firevault",
      "https://x.com/firevaultuk"
    ],
    "slogan": "Disconnect to Protect",
    "brand": [
      {
        "@type": "Brand",
        "name": "Offline Secure Storage"
      },
      {
        "@type": "Brand",
        "name": "Control by Firevault"
      },
      {
        "@type": "Brand",
        "name": "Firebreak"
      }
    ],
    "knowsAbout": [
      "Offline Secure Storage",
      "Physically disconnected data storage",
      "Physical Air Gap Data Protection",
      "Ransomware Protection",
      "Ransomware recovery",
      "3-2-1-1-0 backup rule",
      "AI kill switch",
      "Operational technology security",
      "Critical national infrastructure resilience",
      "Data Sovereignty",
      "GDPR Compliance",
      "NIS2 Compliance",
      "DORA Compliance",
      "NCSC Cyber Assessment Framework"
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "WebSite",
    "@id": "https://fire-vault.com/#website",
    "name": "Firevault",
    "alternateName": [
      "Firevault",
      "Firevault UK",
      "Firevault Limited"
    ],
    "url": "https://fire-vault.com",
    "publisher": {
      "@id": "https://fire-vault.com/#organization"
    },
    "inLanguage": "en-GB",
    "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}"
      },
      "query-input": "required name=search_term_string"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "WebPage",
    "@id": "https://fire-vault.com/control-module/unlink#webpage",
    "url": "https://fire-vault.com/control-module/unlink",
    "name": "Control Unlink Module: physical disconnection",
    "description": "Unlink performs a Layer 1 physical disconnection of your vault from every network path. Read how the module verifies the break and records the state change.",
    "isPartOf": {
      "@id": "https://fire-vault.com/#website"
    },
    "about": {
      "@id": "https://fire-vault.com/#organization"
    },
    "primaryImageOfPage": {
      "@type": "ImageObject",
      "url": "https://fire-vault.com/__l5e/assets-v1/2bf0e913-def8-4eb1-ab6d-e12e3fd441cb/og-control-unlink.webp"
    },
    "inLanguage": "en-GB",
    "breadcrumb": {
      "@id": "https://fire-vault.com/control-module/unlink#breadcrumb"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "@id": "https://fire-vault.com/control-module/unlink#breadcrumb",
    "itemListElement": [
      {
        "@type": "ListItem",
        "position": 1,
        "name": "Home",
        "item": "https://fire-vault.com"
      },
      {
        "@type": "ListItem",
        "position": 2,
        "name": "Control Module",
        "item": "https://fire-vault.com/control-module"
      },
      {
        "@type": "ListItem",
        "position": 3,
        "name": "Control Unlink Module: physical disconnection",
        "item": "https://fire-vault.com/control-module/unlink"
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@graph": [
      {
        "@type": "Organization",
        "@id": "https://fire-vault.com/#org",
        "name": "Firevault",
        "legalName": "Firevault Limited",
        "url": "https://fire-vault.com/",
        "identifier": "16320803",
        "sameAs": [
          "https://www.linkedin.com/company/firevault-limited",
          "https://www.facebook.com/Firevaultltd/",
          "https://www.youtube.com/@Firevault-ltd"
        ]
      },
      {
        "@type": "WebPage",
        "name": "FV-Unlink: Remove the relationships that expose the asset",
        "url": "https://fire-vault.com/control-module/unlink",
        "description": "Unlink removes persistent connections, live dependencies and inherited trust relationships that quietly keep sensitive assets reachable. Where the relationship is not needed, it should not exist.",
        "publisher": {
          "@id": "https://fire-vault.com/#org"
        }
      },
      {
        "@type": "BreadcrumbList",
        "itemListElement": [
          {
            "@type": "ListItem",
            "position": 1,
            "name": "Home",
            "item": "https://fire-vault.com/"
          },
          {
            "@type": "ListItem",
            "position": 2,
            "name": "FV-Unlink",
            "item": "https://fire-vault.com/control-module/unlink"
          }
        ]
      },
      {
        "@type": "FAQPage",
        "mainEntity": [
          {
            "@type": "Question",
            "name": "How is Unlink different from Isolate?",
            "acceptedAnswer": {
              "@type": "Answer",
              "text": "Isolate draws the zones and holds their boundaries. Unlink removes the individual relationships that keep a sensitive asset reachable: persistent connections, live dependencies and inherited trust."
            }
          },
          {
            "@type": "Question",
            "name": "How do you decide what to remove?",
            "acceptedAnswer": {
              "@type": "Answer",
              "text": "By reviewing an inventory of the relationships touching the sensitive assets with their owners, and removing what is no longer warranted. Each removal needs the right authority and is scoped to the relationship under review."
            }
          },
          {
            "@type": "Question",
            "name": "What happens if a removed relationship is needed later?",
            "acceptedAnswer": {
              "@type": "Answer",
              "text": "Restoring it is a deliberate act, approved and recorded like the removal, rather than something that quietly returns."
            }
          },
          {
            "@type": "Question",
            "name": "Does Unlink reduce operational risk?",
            "acceptedAnswer": {
              "@type": "Answer",
              "text": "Adoption is designed around continuity: removals are piloted in a defined batch, and operational continuity is confirmed before the work is broadened."
            }
          }
        ]
      }
    ]
  }
]
```