Five layers of control
Data is protected on the way in, while it is used, and on the way out.
Isolation
Each client gets a dedicated AWS environment and VPC. Workspaces, servers and data sit in a private subnet. Only the load balancer and NAT gateway are public-facing.
Access
Researchers connect through a VPN with Microsoft Entra ID and multi-factor authentication, then open a browser session to their workspace. No direct network access to servers.
Containment
No open internet inside the TRE, only a small approved allow-list. Clipboard, file downloads and local drive mapping are blocked for researchers. Software comes only from an internal approved repository.
Controlled outputs
Files leave only through the egress workflow: automated disclosure checks, then sign-off by a named approver outside the TRE. Approvers can't download files; researchers can't approve their own.
Visibility
Workstation activity (Sysmon and Beats agents) goes to a dedicated ELK server with alerting. AWS activity is recorded in CloudTrail and CloudWatch. Egress decisions go to an insert-only log.
Encryption
Storage is encrypted at rest with keys managed in AWS KMS. Connections are encrypted in transit through the VPN and TLS.
Shared responsibility
TrustBoxx is a managed service. Techvito runs the platform; you decide who gets access and what is allowed to leave.
| Area | Techvito | Client |
|---|---|---|
| Cloud infrastructure, network and encryption | Responsible | — |
| Patching, monitoring, backups, incident response | Responsible | Informed |
| Approving researchers and their access | Provisions | Decides |
| Data loaded into the TRE (lawful basis, approvals) | Runs controlled ingress | Responsible |
| Releasing outputs | Enforces the workflow, runs disclosure checks | Named approver decides |
| Researcher training and conduct | Onboarding session | Responsible |
| Reviewing audit logs | Monitors and alerts | Access to activity dashboards |
Data protection
- Role: the client is the data controller (Data Fiduciary under India's DPDP Act 2023). Techvito acts as data processor.
- Location: data is stored and processed only in the AWS region you choose, for example London for UK data or Mumbai for Indian data.
- AI: Private AI runs through AWS Bedrock inside your environment. Your prompts and data are not used to train models.
- End of contract: the environment is destroyed, including storage and backups, and destruction is confirmed in writing.
See our data processing terms and sub-processors list.
Standards and certifications
We'd rather be precise than impressive. This is where we stand today.
| Standard | Status |
|---|---|
| SATRE 2.0 (UK TRE standard) | Self-assessed — see our self-assessment |
| Five Safes framework | Supported — safe settings, safe outputs and safe people controls built in |
| Cyber Essentials | In progress |
| ISO/IEC 27001 | Not yet — on our roadmap |
| NHS DSPT | Not yet — on our roadmap |
| AWS infrastructure | AWS datacentres hold their own certifications, including ISO 27001 and SOC 2 |
Governance
- A named, accountable Information Governance Lead at Techvito, with a named deputy.
- Policies and procedures are version-controlled. Only named approvers can change them, and every change is logged.
- A documented incident response process with a fixed escalation path. Affected clients are notified within the timeframe in their contract.
Security questionnaires
We're happy to complete your security questionnaire or walk your technical lead through the architecture directly. Get in touch.