A method for maintaining transaction security in a distributed system, wherein the distributed system comprises an online system, an offline system, and a removable storage device, the online system comprising at least three online sub-systems in communication via a communications network, and that each stores an online ledger comprising cryptographically-linked entries indicating earlier data transactions, the offline system comprising one or more offline sub-systems that are unable to communicate data between themselves, and the or each of which is unconnected to the network and the online system, the offline sub-system storing an offline ledger that is a full or partial copy of the online ledger, and the removable storage device having a data store configured to store a copy of the online ledger and to interface with at least one online sub-system and with the offline sub-system independently, such that the removable storage device only interfaces with one of the online sub-system and offline sub-system at any one time, the method comprising the steps of: accessing, at the offline sub-system, the copy of the online ledger stored by the removable storage device when the device is connected to the offline sub-system and unconnected to the network and the online system; checking, by the offline sub-system, that a most recent data transaction in the copy of the online ledger is a valid transaction for synchronizing the ledger with the offline sub-system, wherein a valid transaction is a most recent transaction that is generated at one of the at least one online sub-systems that indicates that the removeable storage device will be connecting to the offline sub-system, and in response: determining, by the offline sub-system, that the copy of the online ledger stored by the removable storage device and the offline ledger are versions of the same ledger; and in response to determining that the copy of the online ledger and the offline ledger are versions of the same ledger; updating, by the offline sub-system, the offline ledger with reference to the online ledger thereby achieving synchronisation between the offline ledger and the online ledger; wherein updating the offline ledger with reference to the online ledger comprises replicating all entries that are identified in the copy of the online ledger on the removable storage device on the offline ledger so that the offline and the copy of the online ledger are identical. accessing, at the offline sub-system, the copy of the online ledger stored by the removable storage device when the device is connected to the offline sub-system and unconnected to the network and the online system; checking, by the offline sub-system, that a most recent data transaction in the copy of the online ledger is a valid transaction for synchronizing the ledger with the offline sub-system, wherein a valid transaction is a most recent transaction that is generated at one of the at least one online sub-systems that indicates that the removeable storage device will be connecting to the offline sub-system, and in response: determining, by the offline sub-system, that the copy of the online ledger stored by the removable storage device and the offline ledger are versions of the same ledger; and in response to determining that the copy of the online ledger and the offline ledger are versions of the same ledger; updating, by the offline sub-system, the offline ledger with reference to the online ledger thereby achieving synchronisation between the offline ledger and the online ledger; wherein updating the offline ledger with reference to the online ledger comprises replicating all entries that are identified in the copy of the online ledger on the removable storage device on the offline ledger so that the offline and the copy of the online ledger are identical. determining, by the offline sub-system, that the copy of the online ledger stored by the removable storage device and the offline ledger are versions of the same ledger; and in response to determining that the copy of the online ledger and the offline ledger are versions of the same ledger; updating, by the offline sub-system, the offline ledger with reference to the online ledger thereby achieving synchronisation between the offline ledger and the online ledger; wherein updating the offline ledger with reference to the online ledger comprises replicating all entries that are identified in the copy of the online ledger on the removable storage device on the offline ledger so that the offline and the copy of the online ledger are identical.