Your crisis documents, there when your own systems are not
Your crisis documents, there when your own systems are not

TY BCP Vault

Your crisis plan is up to date. It sits on your OneDrive, or on the local share. But when an outage or a cyber incident takes your systems down, that plan is often locked inside them. So are the contact lists, the recovery steps and the list of who decides what.

The TY BCP Vault keeps them somewhere else: an online vault, run by Tymans Group in the EU, that your people reach from any browser, even when your own network, e-mail and sign-in are down.

Available to clients from mid-January 2027.

What goes in

The documents that change slowly: your crisis plan, contact lists, recovery procedures, supplier contracts.

The recent data your critical processes need to keep going in a minimal way. Some obligations don't stop during an outage: payments and receipts, client communication, payroll, some safety procedures. That data doesn't need to be from the last hour, just recent enough.

You decide which processes are critical, and how often each one is updated: weekly, monthly, whatever suits the process.

The vault is not a backup. It is part of your continuity plan, next to your backups and your IT recovery.

Reachable on the bad day

The vault has its own accounts and its own second factor. Signing in doesn't depend on your e-mail, your Microsoft or Google account or your company devices.

Two-factor sign-in applies to everyone, always: a password plus an authenticator code, with backup codes. There is no password reset by e-mail. Any browser works, anywhere, with nothing to install.

You decide who sees what

You define the roles, named after what your people do. Each has full or read-only access, and areas it doesn't see at all.

A new account stays switched off until one of your own owners activates it. Your owners can switch an account off at once, for a leaver or a compromised account, without waiting for us.

Requests to add, change or remove people go through our support portal, and are recorded. On the shared vault, each client sees only its own area.

Protected and recoverable

Encrypted storage, and a virus scan on every upload.

Hosted in the EU: the vault in one city, its backups in another one, in a different region.

Nightly backups with a 90-day compliance lock. Nobody can delete or shorten them before the lock ends, not even TY.

We already tested a restore on the production vault: files, settings and two-factor sign-in came back intact and we test it again regularly.

Honest about access

The vault is under TY technical management. This means that our administrators can technically read the content. We need that for the backups, and to restore access as a last resort. If someone at TY opens your folder through the vault, it shows in the audit log, which is exported every hour and locked for a year. Someone with administrator rights on the server itself can technically read the disk outside the vault software, so that access is limited to TY's administrators.

So encrypt what is truly confidential yourself before you upload it, for example as a password-protected archive. Only you hold the key. We can't open that file, not even if you lose the key.

What you are probably thinking

"We have a backup."

A backup brings your data back after the recovery, and that can take days or months. The vault is what you use during that period: who calls whom, who decides, how you keep serving your customers.

"Data alone won't help if the systems that use it are down."

Right: the vault doesn't replace your IT recovery. It keeps the essentials going in the meantime: suppliers paid, incoming payments matched, customers informed, salaries paid. For each critical process, you keep what it needs to run without IT: the procedure and recent data.

"We'll work from home."

Your laptop still starts. But sign-in runs through your central account management, and that is down. So e-mail and shared drives don't work at home either. A browser usually still works, and with it the vault.

"It's on a USB stick."

Which version, and who has it when you're not there? Paper is a good addition, but the plan itself has to be current and reachable.

"A link to our systems is a new risk."

There is no link: the vault never connects to your systems. Your own people upload to it in the browser, with two-factor sign-in, and every file is scanned and logged.

"We'll build it ourselves."

You could. But your IT people are needed to run and improve your services: that is their core business, and yours. And during an incident, they work on the recovery, not on keeping a vault going.

What you get

Every vault includes:

Your own folder

On our shared vault, separated from every other client.

Backups and support

Nightly locked backups, a tested restore, and support on business days.

Storage

From 1 GB up, sized to what you keep in it.

The contract

It follows your sector, with a data processing agreement for everyone.

For financial-sector firms

The vault also comes as a follow-on to a BCM Analysis, through Advisory. For financial entities, the contract includes DORA terms and an exit plan.

On the roadmap

  • A dedicated vault: a server of your own, with its own encryption key and backups.
  • An auditable procedure for administrator access to the server: who may, when, with whose approval, and every access logged.
  • An out-of-hours agreement for access emergencies, such as a locked-out owner.
  • Monthly reports to your owners: who has access to what, dormant accounts, outdated folders, and every action TY took on your data.
  • Industry templates on top of the continuity template.
  • Guided onboarding with an intake form.
  • Automated delivery of files from your own systems, only if you want it.
  • Faster access changes: requests your owners approve in the portal, applied automatically.

How it starts

Step 1

Intake: your owners, your roles, and what goes in the vault.

Step 2

Set-up by TY: your folder, roles and accounts, and a continuity template: a "read me first" and ten areas, each with Current, To validate and Archive.

Step 3

First login: each person sets up two-factor sign-in and keeps the backup codes.

Step 4

Your owners activate the accounts and fill the vault.

We built it from our own DR and BCM work in finance: 48 data-centre failover tests led, zero critical incidents; 11 regulatory inspections and audits as accountable lead, zero critical findings.

See it for yourself

We can show you the vault in a demonstration with a fictional client, or talk through what your firm would keep in it.

Use the form below and choose "TY BCP Vault".

 

All fields are mandatory

Turnstile *

This site and all contents is © 2026 Tymans Group BV