of UK TREs check outputs fully manually.
use semi-automated checking.
reported fully automated output checking.
Source: DARE UK TRE Landscape Review, 2025.
How a file leaves TrustBoxx
Researchers never get a direct way to copy files out. Every release goes through the same five steps.
Submit from inside
The researcher submits the file through a restricted interface inside the TRE. It can only submit, nothing else.
Automated checks
SACRO disclosure-control checks run straight away and produce a risk report, flagging issues like small cell counts.
Review from outside
A named approver, working outside the TRE, sees the file and the risk report. They can approve or reject, but can't download.
Recorded decision
Every submission, approval and rejection is written to an insert-only audit log that can't be edited after the fact.
Short-lived release
Approved files are released through a link that expires within seconds, checked again at the moment of download. Released files are then purged.
Separation of duties
The researcher creates the output. The approver decides. TrustBoxx enforces the boundary. No one person can both produce and release a file.
What this protects against
- A CSV of individual records submitted as a "summary table"
- Statistics where small groups could identify individuals
- Files containing personal data that shouldn't leave
- Outputs released without a second person looking at them
- Disputes later about who approved what, and when
Built for the Five Safes
"Safe outputs" is the last of the Five Safes and the hardest to get right. TrustBoxx combines automated checking, so reviewers spend their time on the cases that need judgement, with a human decision on every release.