Why we did it
Data custodians need a common way to judge whether an environment is safe. SATRE gives them one. A self-assessment lets you check our claims statement by statement.
Why it's different for us
Platform-only vendors mark operational statements "not applicable" and leave them to you. TrustBoxx is a managed service, so we take responsibility for many of those rows ourselves.
How to use it
Use the self-assessment in your data access applications, custodian reviews and risk assessments. Ask us for the evidence behind any score.
How TrustBoxx meets each pillar
1. Information governance
A named Information Governance Lead and deputy, with dedicated time and budget. Version-controlled policies and SOPs changed only by named approvers. A documented incident response process. A cost and charging procedure so every project knows its costs before it starts.
2. Computing technology and information security
A dedicated, single-tenant AWS environment per client with all research components in a private subnet. VPN access with Microsoft Entra ID and MFA. No open internet inside the TRE. Encryption with AWS KMS. Infrastructure defined as code. Activity monitoring with alerting through ELK, Sysmon and Beats, plus CloudTrail at the AWS layer.
3. Data management
Controlled ingress with each file hashed and recorded. Outputs leave only through the egress workflow: automated disclosure checks (SACRO), then approval by a named person outside the TRE, with every decision in an insert-only log. Data stays in the AWS region you choose and is destroyed at the end of the contract.
4. Supporting capabilities
Researcher and approver onboarding, service documentation, a support desk, and monthly cost reports per project.
5. Federation
TrustBoxx runs as a standalone TRE today. We are preparing the member-side requirements so a client environment can join a federation when needed: identity federation, shareable output rules, audit log export and a documented security baseline.
Where we are still working
- Certifications: Cyber Essentials is in progress. ISO 27001 and NHS DSPT are on our roadmap.
- Public involvement: SATRE expects public and patient involvement. As a platform provider, we support our clients' involvement activities and are defining our own approach.
- Federation: member-side capabilities are planned, as above.
Get the full self-assessment
The full statement-by-statement scoring is available on request now, and will be published here shortly. Request a copy.