Hathor DS - Management of disconnected storage appliances

A ransomware can't encrypt a drive that isn't plugged in.

Every backup strategy eventually collides with the same contradiction: for a backup to be usable, it must be reachable — and anything reachable from the network is reachable by whatever compromises the network. Modern ransomware understands this perfectly. It doesn't attack production first; it attacks the backups, quietly, sometimes for weeks, and only triggers once the last clean restore point is gone. Organizations then discover that they had backups, that those backups ran green every night, and that every one of them is now encrypted.

The countermeasure has been known for decades and is called an air gap: physically disconnect the copy. In practice, almost nobody does it, because doing it properly means someone plugging in and unplugging a disk on a schedule, in a server room, forever — and human discipline is not a security control.

Hathor makes the air gap operational. The platform pilots a fleet of storage appliances installed at customer sites — machines that stay disconnected by design and only come online for the window in which they receive their data, then withdraw. Connection is not a background state; it is a piloted event, ordered from a supervision console, traced, and closed. What used to depend on someone remembering becomes an operation the system executes.

Everything is driven from a single console. Each appliance is identified by its serial number and remote device, attached to a company, reachable through its broker — the relay that carries commands to a machine deliberately kept off the open network. Each appliance carries its own agents, the installers distributed to protected endpoints, each one fingerprinted with a SHA-256 hash so that what gets deployed is provably what was published. The backup layer is supervised through Acronis integration, with per-company credentials held encrypted, so operators watch job health and alerts where they already watch everything else.

The platform was designed for managed service providers as much as for their clients. It is multi-tenant to the core: every appliance, every broker, every credential is scoped to its company, and no operator ever sees a fleet that isn't theirs. Access is governed by granular, resource-level permissions on top of two-factor authentication, and every sensitive action is logged — who connected what, when, and on whose order. Real-time alerting propagates status changes to the console as they happen rather than at the next refresh.

Because a disconnected backup that no one can prove is worth as much as no backup at all, Hathor treats evidence as part of the product: the state of the fleet, the history of connections, the integrity of what was deployed.

The result: the strongest protection in the field — physical isolation — finally usable at fleet scale, without asking anyone to be perfectly disciplined at 2 a.m.