OSS® (#OSS) for directors and boardsData protection and storage
Evidence you can stand behind.
Board papers, minutes, compliance evidence, legal advice and personal director records. When something goes wrong, the question is what the board knew, what it decided and what it did to protect the information behind those decisions.
Offline Secure Storage®OSS® (#OSS) for directors and boards- Protects
- The records you could not recreate
- Hardware
- Dedicated, except LUV
- When closed
- No standing network path
- Access
- Authorised, out of band, time-bound
- Hosted in
- Firevault Bunkers: Europe live, US and Middle East next
A simple board question
If a regulator asked what the board did to protect its most sensitive information, what is the answer?
Directors are increasingly assessed on the adequacy of controls rather than the sophistication of the attacker. The problem is not only a breach. It is what a director can be shown to have controlled.
- A path that does not exist cannot be used
There is no mailbox, no shared drive and no credential leading to the papers while the vault is offline.
- Policy is not a defence on its own
Boards are asked what they did, not what they instructed. A change in state is a demonstrable act.
- Separation protects the individual
Director records held apart from the corporate estate survive a compromise of that estate.
- Evidence is produced as you go
Recorded retrieval gives a chair, an auditor or an insurer something concrete to review.
- Board papers leak.
Scenario 1
- Privilege is compromised.
Scenario 2
- Evidence cannot be produced.
Scenario 3
- Personal liability follows.
Scenario 4
See the difference
The same stolen login. Two places to keep your records.
Choose a state to see what an intruder can reach.
Contracts, accounts and recovery copies share one connected estate. One stolen login, one supplier or one mistake reaches all of it.
The records you could not recreate sit on dedicated hardware with no standing network path. Access begins outside the normal network, on an authorised out-of-band request, for a time-bound session.
The principle
Select. Secure. Disconnect. Access when required.
If board and director records are physically disconnected, exposure is a decision somebody made rather than a default nobody reviewed.
- Your important data
- Your network
- Security tools
- Still reachable
- Stolen, locked or changed
What boards protect
The record of what the board decided.
First-pass inventory
- Board papers
- Privileged advice
- Regulatory evidence
- Risk registers
- Remuneration records
- Director records
First-pass inventory
Know what the board is actually responsible for.
Start with the material that would be most damaging to leak and most important to produce under scrutiny.
- Governance
- Legal
- Compliance
- Risk
- People
- Director records
- Board packs
- Minutes and resolutions
- Strategy papers
What belongs offline
Not every board record should be permanently reachable.
Everyday and connected
- Current meeting agendas
- Draft papers in circulation
- Routine correspondence
- Calendar and logistics
- Everyday collaboration
- Signed minutes and resolutions
- Privileged legal advice
- Regulatory evidence
- Risk and incident records
Who can reach it
The right director can reach the right record.
Board information has to survive appointments, resignations and investigations. Ownership, sharing and succession are separate decisions.
- Verified owner
- Fellow director
- Legal or auditor
- Succession route
- Access is linked to a verified director rather than a company secretary mailbox.
One vault per user
- Release specific documents to counsel, auditors or regulators when required.
Share a paper, not the vault
- A defined succession route means records remain available when the board changes.
Planned continuity
The products
Offline Secure Storage®, then the product that fits the volume.
One physical principle at every size. What changes is capacity and how access opens.
- Physically offline between sessions.
Vault
- Ask from your registered phone and confirm it is you.
Open a session
- Work with your files for up to 120 minutes.
File Manager
- Opens on a day you choose each week, for 12 hours.
LUV
- From 20TB, growing in 20TB steps.
Storage
Why Firevault
Physics, not promises.
Every Offline Secure Storage® instance is built on the same four physical principles.
- Physical storage
Offline Secure Storage instances are held on dedicated physical hard drives, not in S3 cloud buckets, shared storage pools or multi-tenant infrastructure. Your selected data is assigned to real hardware, with dedicated RAID 1 drives providing resilience.
- Physical ownership
Each Offline Secure Storage instance is allocated to a specific customer, with dedicated physical capacity and clearly defined ownership. Your data is not pooled, commingled or held within a shared storage estate.
- Physical control
Access begins outside the normal network path. An authorised out-of-band command, such as SMS, controls the physical Layer 1 connection to your #OSS instance. When access is not required, that network path is physically disconnected.
- Physical security
Your #OSS hardware is housed in carefully selected, professionally managed data centres with layered physical security, resilient power and environmental controls. Access is tightly controlled using three-factor authentication, including biometric identification, supported by 24/7 monitoring, restricted access zones and a complete audit trail.
Guidance
Personal accountability for security is set out in law and regulator guidance.
Company law duties and financial regulation both place responsibility for adequate systems and controls with named individuals.
- Reasonable care, skill and diligence
Companies Act 2006, s.174
- Boards evidence their decisions
NCSC Board Toolkit
- Measures judged against the risk
ICO
Your next step
Protect the records that matter most.
Start with the records you could not recreate. Keep everything else where it works best.