Managed Trusted Research Environment — Service Definition

How TrustBoxx works

We bring the researcher to the data, not the data to the researcher. Every environment is its own isolated AWS deployment, run by us.

Data inControlled ingress, hashed and recorded on acceptance

Secure accessVPN + MFA, then a browser session into a private workspace

ResearchR, Python, Jupyter, VS Code and Private AI inside the walls

Submit outputAutomated disclosure checks run before review

Approved releaseA named approver outside the TRE signs off; every decision is logged

Features

Controls are part of the architecture, not a policy document.

Single-tenant isolation

Each client gets a dedicated AWS environment and VPC. All research workloads run in a private subnet with encrypted storage (AWS KMS).

Egress approval workflow

Researchers submit outputs from inside the TRE. A separate approver reviews them from outside. Release links are short-lived and the audit log is insert-only.

Automated disclosure checks

SACRO disclosure-control checks generate a risk report when an output is submitted, so reviewers focus on the cases that need a human decision.

No open internet, no clipboard

No internet access inside the TRE beyond a small approved allow-list. Clipboard, downloads and local drive mapping are blocked for researchers.

Private AI

An LLM assistant inside the environment (LibreChat with AWS Bedrock). Prompts and data stay in your AWS account and are not used to train models.

Full audit trail

Workstation activity (Sysmon, Beats) goes to a dedicated ELK server; AWS activity to CloudTrail and CloudWatch. Suspicious behaviour raises alerts.

Internal Git and packages

Gitea for version control and Nexus for approved software packages, both inside the boundary. Code can't be pushed to external repositories.

Research-ready workspace

R, RStudio, Python, Jupyter and VS Code pre-installed. Client-licensed tools installed on request after review.

MFA everywhere

Researchers connect through a TrustBoxx-provided VPN with Microsoft Entra ID and MFA, or via an allow-list to your own VPN.

Benefits

Live in days, not months

A new environment is deployed from infrastructure-as-code in about two days. No need to staff a DevOps team to run open-source TRE software.

Share data you otherwise couldn't

Give researchers and collaborators access to sensitive datasets without handing over copies. The data stays inside; only approved results leave.

Evidence for your governance

Every login, action and release decision is logged. Use it for data access committees, custodian audits and the Five Safes.

Predictable, transparent costs

One platform fee per environment plus transparent cloud usage, with a cost estimate for every project and monthly cost reports.

We carry the operations

Monitoring, patching, backups, incident response and the egress review rota are run by Techvito, not your researchers.

Data residency you choose

Deployed in the AWS region you need, for example London (eu-west-2) for UK data.

Pricing

Every environment is sized to your project, so we quote each one individually.

Pricing on request

Tell us about your data, your team and your timeline. We'll send a written quote with a full cost breakdown before any work starts.

Request a Quote

How our pricing works

One-time setup

Environment build, identity provider and MFA integration, acceptance testing and researcher onboarding.

Managed platform fee

A fixed monthly fee per environment, not per workspace, covering operations, monitoring, patching, backups and the egress workflow. Billed in advance.

Cloud usage

Compute, storage and AI usage in your dedicated AWS environment, passed through transparently and reported monthly per project.

Any extra resource is quoted and approved before it is provisioned. Each project gets a cost estimate before work starts and a monthly cost report.

Service definition

The detail buyers, data custodians and security reviewers ask for.

Service scope User support Onboarding and offboarding Using the service Asset protection Data import and export Data in transit Identity and authentication Audit Standards Security governance Operational security

Service scope

Cloud deployment model: Single-tenant, dedicated deployment on AWS, managed by Techvito.
Service constraints: One client organisation per environment. Workspaces are Windows-based. GPU workspaces and container support are on the roadmap and not yet generally available.
System requirements: A modern web browser and either the TrustBoxx-provided VPN client or an allow-listed connection from your own VPN.

User support

Email or ticketing support: Email and Ticketing support provided
Support hours: UK business hours, Monday to Friday. Response times are set out in the service agreement.
Support levels: Managed service includes monitoring, patching, backups, incident response and minor configuration changes, plus 4 support hours a month. Extra support is billed at the published day rate.
Onsite support: Not offered as standard.

Onboarding and offboarding

Getting started: We deploy your environment, connect your identity provider, load your data through the controlled ingress process and run an onboarding session for researchers and approvers.
Service documentation: Documents are available at docs.trustboxx.com.
End-of-contract data extraction: Approved outputs are released through the egress workflow before the end date. Source data is returned to the data owner as agreed in the data agreement.
End-of-contract process: The environment is destroyed, including storage and backups, and destruction is confirmed in writing. Audit records are archived for the retention period agreed with you.

Using the service

Web browser interface: Researchers reach their workspace through a browser session (Apache Guacamole) after connecting to the VPN.
Application to install: A VPN client, unless you use your own VPN.
Designed for mobile devices: The workspace is designed for desktop use.
Customisation available: Software packages, allow-listed domains, approver roles and client-licensed tools are configured per environment.

Asset protection

Data storage and processing location: The AWS region you choose, for example United Kingdom (London).
User control over location: The region is set per environment at deployment.
Datacentre security standards: AWS datacentres; see AWS compliance documentation.
Protecting data at rest: Encrypted EBS and S3 storage with keys managed in AWS KMS.
Data sanitisation: All storage, snapshots and backups are deleted when the environment is destroyed, with written confirmation.

Data import and export

Data import approach: Data enters through a controlled ingress path. Each file is hashed and its acceptance recorded before it reaches the workspace.
Data export approach: Only through the egress workflow. Automated disclosure checks run on submission; a named approver outside the TRE approves or rejects; approved files are available through a short-lived download link; released bytes are then purged.
Export formats: Any file type that passes review, typically CSV, PDF, images and reports.

Data-in-transit protection

Between buyer and supplier networks: TLS, accessed through an encrypted VPN tunnel.
Within the supplier network: All research components run in a private subnet. Only the load balancer and NAT gateway sit in the public subnet.

Identity and authentication

User authentication: Microsoft Entra ID single sign-on with multi-factor authentication.
Management access: Restricted to named Techvito operators, with MFA. Researchers have no access to management interfaces or audit dashboards.
Separation of duties: Researchers, ingress administrators and egress approvers are separate roles. Approvers cannot download files.

Audit information for users

User activity audit: The workstation activity is collected by Sysmon and Beats agents into a dedicated ELK server, viewable by authorised client administrators.
Supplier activity audit: AWS API activity is recorded in CloudTrail.
Egress decisions: Every submission, approval and rejection is recorded in an insert-only audit log.
Retention: Agreed per client in the service agreement.

Standards and certifications

SATRE: Self-assessedSATRE 2.0 self-assessment, available on request.
Cyber Essentials: In progress
ISO/IEC 27001: Not yetOn our roadmap.
NHS DSPT: Not yetOn our roadmap.

Security governance

Named person responsible: The Founder of Techvito is the accountable Information Governance Lead.
Policies and processes: Information governance policies and SOPs are version-controlled, with changes approved only by named approvers and recorded in a change log.

Operational security

Configuration and change management: Infrastructure is defined as code. Changes are reviewed before they are applied.
Vulnerability management: Regular patching of workspace and supporting servers, with software allowed in only through the internal package repository.
Protective monitoring: Host telemetry in ELK with alerting on suspicious activity, plus CloudTrail and CloudWatch at the AWS layer.
Incident management: A documented incident response process with a fixed escalation path. Affected clients and data custodians are notified within the timeframe in their contract.

See TrustBoxx with realistic data

We'll walk you through the researcher view, the egress approval flow and the audit trail on a synthetic dataset.

Request a Demo