Cold wallet — a wallet whose private keys never touch an internet-connected device. Usually a hardware device: Ledger officially supports Gram and Jettons (managed through MyTonWallet); SafePal and Tangem also support TON.
Transactions are signed inside the device, so even an infected computer cannot steal funds. The seed phrase backup remains your responsibility — losing it loses the wallet.