The DARE UK Sensitive Data Research Infrastructure Landscape Review 2025: What it found, and where the Aridhia DRE fits

DARE UK published its Sensitive Data Research Infrastructure Landscape Review 2025 in June 2026, a survey of 63 organisations that provide or support Trusted Research Environments in the UK. The full report is on Zenodo at https://zenodo.org/records/20748136. The respondents together support roughly 6,700 active research projects, most are universities or public sector bodies, and about three-quarters run a TRE service. The data is self-reported and unverified and Aridhia is named in the report as an example of a specialist TRE platform provider (p33), so we have read it closely. This post summarises the findings and sets out where the Aridhia DRE meets the expectations the report describes.

Standards and accreditation

ISO 27001 is held by 61% of respondents and the NHS Data Security and Protection Toolkit by 71%. Awareness of SATRE, the Standardised Architecture for Trusted Research Environments funded by DARE UK, is high at 84%, and 45% have evaluated their TRE against the specification (p45). The FAIR data principles are almost universal in awareness at 95%, with 68% reporting active implementation.

What standards and accreditations does the Aridhia DRE hold?

The DRE holds ISO 27001 and ISO 27701 certification and is also HITRUST certified. We have published a paper scoring the DRE against all four sections of the 2026 SATRE specification, and we were the first commercial TRE provider to score our platform publicly against SATRE. FAIR is delivered natively by the DRE's FAIR Data Services component. FAIR Data Services provides the metadata catalogue where data owners publish dataset descriptions and data use conditions, and where researchers search the catalogue and submit data access requests. Approved datasets are provisioned into workspaces with their metadata and schema intact, and the platform enforces data use conditions, including geographic restrictions that prevent a dataset being used in a workspace outside its permitted region. This is the discoverability and governed access that the report finds most providers are still working toward.

Output checking and disclosure control

4% of service providers use technical controls that stop researchers downloading data directly, requiring outputs to pass through an airlock. Independent disclosure control, carried out by the TRE rather than the research team, is in place at 88% of providers, review is still overwhelmingly manual at 69%, and no respondent reported fully automated checking. Of those using semi-automated or hybrid approaches, only four reported using SACRO, the DARE UK funded methodology for semi-automated checking of research outputs (p27).

How does the Aridhia DRE handle output checking and disclosure control?

Output control in the DRE centres on the outbound Airlock, an audited, approvals-based process where anything a researcher wants to take out of a workspace is held until an independent reviewer approves it. The DRE also supports the ACRO library and the SACRO app directly in the workspace. Researchers run ACRO inside their R or Python analysis, which applies disclosure checks as outputs are produced and assigns each a risk score. The SACRO app runs as a web app in the same workspace, so the reviewer can see those scores, review any mitigations the researcher applied, and approve the airlock request, with the approved outputs and the review summary stored in the workspace. This puts the DRE among the few platforms that support SACRO in production today. A separate community app, AIRAlock, was released recently and can be added to a workspace to provide an AI advisory layer on top of this, but it is an optional addition rather than part of the core workspace.

Machine learning and generative AI

The report's AI figures are about training machine learning models. 69% of service providers offer tooling to train AI or machine learning models, and the frameworks listed are the usual machine learning libraries such as PyTorch and scikit-learn. Access to GPU has risen from 47% to 70% between the 2023 and 2025 reviews. Generative AI and large language models sit largely outside the current survey and are flagged only as an area to explore in future (p65).

How does the Aridhia DRE handle machine learning and generative AI?

That distinction matters for how a platform should respond. For machine learning, the DRE provides the frameworks and GPU compute, and the airlocked infrastructure to train and run models against sensitive data with a full audit trail. It also supports federated learning so models can be trained across datasets held in different workspaces without moving the data. For generative AI, the main governance risk is shadow AI, where a researcher pastes sensitive data into an external consumer LLM service and takes it outside the controlled environment. The DRE's controls already prevent bulk data export, and the AIRA framework adds a sanctioned option by running large language models offline inside the workspace, so researchers who want to use an LLM can do so against the data in place without reaching for an outside service. Through AIRA, workspaces can also bring their own model, including UK sovereign options, where the provenance of the model needs to be accounted for alongside the data.

Federation and inter-TRE working

The report treats federation as emerging rather than established. Only two respondents reported fully operational federated analytics (p32), and the GA4GH Task Execution Service was in use at two TREs with the Workflow Execution Service at one. The barriers noted include differences in infrastructure between TREs, the elevated privileges needed to run containers, data and system variability, and the reproducibility of research workflows.

How does the Aridhia DRE handle federation and inter-TRE working?

The DRE supports federation natively. The open source Federated Node that we developed, and which is used in the PHEMS network and our DARE UK TREvolution work, is deployed in production and lets an approved user run an isolated analytical task against data held inside a workspace without extracting it. For federated learning, the DRE supports Flower connectivity, with the Flower SuperNode running inside the workspace and the SuperLink coordinating runs and aggregation across sites. Work to make federated data access a fully native feature of the DRE is continuing, but the capability the report identifies as rare is already in production use here.

Infrastructure and analytical environments

FA Use of specialist TRE platform providers, either alone or combined with other platforms, rose from 16% to 40% between reviews, and pure on-premises provision rose modestly to 27%. Among providers using external cloud, use of AWS and Azure is roughly even. Python and R dominate the analytical tooling, supported by 88% and 85% of providers, and containerisation is common with Docker as the de facto standard.

What infrastructure and analytical environments does the Aridhia DRE offer?

The DRE sits within the specialist cloud platform category the report shows is growing. It runs as a managed cloud service, with enterprise deployments hosted in the Azure region of choice and a multi-tenant option hosted across the UK, US, EU, Canada and Australia. Researchers work in Python and R alongside common statistical packages, and can bring their own tooling or use a curated library of approved software, which aligns with the flexibility most providers reported offering.

Funding, sustainability and public involvement

Funding remains predominantly public, reported by 65% of respondents, and staff time is the largest cost for around two thirds. Public involvement and engagement is widely practised, with 56% engaging monthly or quarterly, though funding for it is generally modest. These findings sit largely outside what a platform provider controls. The relevant point for us is narrower. A managed specialist platform can move part of the engineering and accreditation effort off an institution's own staff, which is one lever available where staff cost is the binding constraint.

Conclusion

It’s worth noting that the data is self-reported and unverified, and the authors note they have probably missed a long tail of smaller TREs, so the report leans toward larger national and regional services. The landscape is genuinely diverse, and no single provider covers every requirement it describes.

Within that, the report's forward looking priorities are the areas where the DRE is already delivering. Inter-TRE federation, greater automation in output checking and the governed use of AI within TREs are all identified as work for the sector in the years ahead. Each is in production in the DRE today, through the Federated Node and Flower connectivity, native ACRO and SACRO support, and the AIRA framework. Judged against the specific capabilities this review measures, the DRE sits at the front of the landscape it describes. Anyone evaluating a TRE should read the full review and test providers against those capabilities and this is a comparison that we welcome and would be happy to discuss in more detail.