> For the complete documentation index, see [llms.txt](https://documentation.dnanexus.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.dnanexus.com/faqs/trusted-research-environments.md). # Trusted Research Environment FAQs Answers to common questions about discovering, requesting access to, and working in DNAnexus Trusted Research Environments. {% hint style="info" %} Apollo and Trusted Research Environments licenses are required to use Trusted Research Environments on the DNAnexus Platform. [Contact DNAnexus Sales](mailto:sales@dnanexus.com) for more information. {% endhint %} ## What is a Trusted Research Environment? A Trusted Research Environment (TRE) is a secure, configuration-driven framework on the DNAnexus Platform. It allows data providers to control access to sensitive data while authorized researchers analyze approved data in a governed workspace. ## Who can discover a TRE? A TRE can be restricted to users and organizations that a TRE Admin authorizes, or it can be public and discoverable by all platform users. You must be an Authorized User to view a restricted TRE and submit a data access request. You can find available environments in **Data Resources** > **Resource Center**. For details, see [Discover Research Environments and Explore Data](/user/trusted-research-environments/discovering-tres.md). ## How do I request access to TRE data? Open the TRE from the Resource Center and click **+ New Access Request**. Select a cohort when cohort selection is available, choose the data collections you need, add any collaborators, and submit the request for review. For the full procedure, see [Submit a Data Access Request](/user/trusted-research-environments/submitting-access-request.md). ## What happens after my request is approved? The Request Owner or a Collaborator can create a project from the approved request. The platform then dispenses the approved data into that project. Dispensal can include bulk files and filtered tabular data, depending on the TRE inventory and the request selections. See [Create Projects and Access Dispensed Data](/user/trusted-research-environments/creating-projects.md). ## Can I delete dispensed data from a TRE project? No. Objects placed in a TRE project by the dispensal process cannot be deleted individually. The data is removed only when the entire project is destroyed. ## Can I download data from a TRE project? It depends on the TRE-enforced policies. A TRE Admin can configure **Download Access** to allow or restrict downloads from projects created through the TRE. The policy is inherited by those projects and cannot be overridden by project members. Review the enforced policies during project creation or in the project settings. ## Can a TRE restrict downloads for individual data fields? Yes. Each field in the Data Collections JSON can set `downloadRestricted` to `true` or `false`. A field with `downloadRestricted` set to `true` cannot be downloaded, even when the project-level Download Access policy allows downloads. A field set to `false` follows the project's Download Access policy. See [Prepare a Resource Inventory for a File-Only TRE](/admin/trusted-research-environments/preparing-resource-inventory-for-file-only-tre.md#configure-per-field-download-restrictions). ## Can I preview files when downloads are restricted? File preview is controlled by a separate **File Preview** policy. A TRE can allow or restrict previewing and downloading file content up to 100 KB independently of the broader **Download Access** policy. ## Can I invite anyone to a TRE project? No. Project invitations are limited to the Request Owner, Collaborators on the associated approved data access request, and selected support users. Collaborators must already be Authorized Users of the TRE. ## Can I move data between TRE and non-TRE projects? No. Cloning between TRE and non-TRE projects is not allowed. Moving data between TRE projects is allowed only when both projects are associated with the same data access request. ## What is the TRE working project used for? The platform creates a TRE working project and TRE robot user for internal dispensal operations. Only the TRE robot user has direct access to the working project. When participant pseudonymization is enabled, the platform also provisions a dedicated TRE watermark project managed alongside the working project. Organization administrators for the TRE billing organization can add themselves when troubleshooting is required. {% hint style="warning" %} Do not add inventory assets to the working project or watermark project, and do not modify or delete their contents or permissions. Manual changes can disrupt dispensal and support workflows. {% endhint %} ## What is the TRE working organization? The working organization contains the TRE admins and the TRE robot user. It supports internal TRE operations, including file download policy management and, when pseudonymization is enabled, watermarking authority. The exact organization name and ID depend on the TRE. {% hint style="warning" %} Do not modify the working organization directly. Use the supported TRE controls to manage TRE admins and related access. {% endhint %} ## What is the TRE robot user? The TRE robot user is a system service account that performs data dispensal on the platform's behalf. It distributes data from the provider's inventory into researcher projects according to approved data access requests. Because it can access both provider and researcher projects, no human user needs direct access to the sensitive source data. ## Where can I learn more about TRE roles? See [TRE Roles and Permissions](/user/trusted-research-environments/roles-and-permissions.md) for an overview of Org Admin, TRE Admin, Reviewer, Authorized User, Request Owner, and Collaborator responsibilities. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://documentation.dnanexus.com/faqs/trusted-research-environments.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.