Trusted Research Environment FAQs

Answers to common questions about discovering, requesting access to, and working in DNAnexus Trusted Research Environments.

Apollo and Trusted Research Environments licenses are required to use Trusted Research Environments on the DNAnexus Platform. Contact DNAnexus Sales for more information.

What is a Trusted Research Environment?

A Trusted Research Environment (TRE) is a secure, configuration-driven framework on the DNAnexus Platform. It allows data providers to control access to sensitive data while authorized researchers analyze approved data in a governed workspace.

Who can discover a TRE?

A TRE can be restricted to users and organizations that a TRE Admin authorizes, or it can be public and discoverable by all platform users. You must be an Authorized User to view a restricted TRE and submit a data access request.

You can find available environments in Data Resources > Resource Center. For details, see Discover Research Environments and Explore Data.

How do I request access to TRE data?

Open the TRE from the Resource Center and click + New Access Request. Select a cohort when cohort selection is available, choose the data collections you need, add any collaborators, and submit the request for review. For the full procedure, see Submit a Data Access Request.

What happens after my request is approved?

The Request Owner or a Collaborator can create a project from the approved request. The platform then dispenses the approved data into that project. Dispensal can include bulk files and filtered tabular data, depending on the TRE inventory and the request selections. See Create Projects and Access Dispensed Data.

Can I delete dispensed data from a TRE project?

No. Objects placed in a TRE project by the dispensal process cannot be deleted individually. The data is removed only when the entire project is destroyed.

Can I download data from a TRE project?

It depends on the TRE-enforced policies. A TRE Admin can configure Download Access to allow or restrict downloads from projects created through the TRE. The policy is inherited by those projects and cannot be overridden by project members. Review the enforced policies during project creation or in the project settings.

Can a TRE restrict downloads for individual data fields?

Yes. Each field in the Data Collections JSON can set downloadRestricted to true or false. A field with downloadRestricted set to true cannot be downloaded, even when the project-level Download Access policy allows downloads. A field set to false follows the project's Download Access policy. See Prepare a Resource Inventory for a File-Only TRE.

Can I preview files when downloads are restricted?

File preview is controlled by a separate File Preview policy. A TRE can allow or restrict previewing and downloading file content up to 100 KB independently of the broader Download Access policy.

Can I invite anyone to a TRE project?

No. Project invitations are limited to the Request Owner, Collaborators on the associated approved data access request, and selected support users. Collaborators must already be Authorized Users of the TRE.

Can I move data between TRE and non-TRE projects?

No. Cloning between TRE and non-TRE projects is not allowed. Moving data between TRE projects is allowed only when both projects are associated with the same data access request.

What is the TRE working project used for?

The platform creates a TRE working project and TRE robot user for internal dispensal operations. Only the TRE robot user has direct access to the working project.

Organization administrators for the TRE billing organization can add themselves when troubleshooting is required.

Do not add inventory assets to the working project or modify its contents or permissions. Manual changes can disrupt dispensal and support workflows.

What is the TRE working organization?

The working organization contains the TRE admins and the TRE robot user. It supports internal TRE operations, including file download policy management. The exact organization name and ID depend on the TRE.

Do not modify the working organization directly. Use the supported TRE controls to manage TRE admins and related access.

What is the TRE robot user?

The TRE robot user is a system service account that performs data dispensal on the platform's behalf. It distributes data from the provider's inventory into researcher projects according to approved data access requests. Because it can access both provider and researcher projects, no human user needs direct access to the sensitive source data.

Where can I learn more about TRE roles?

See TRE Roles and Permissions for an overview of Org Admin, TRE Admin, Reviewer, Authorized User, Request Owner, and Collaborator responsibilities.