Research Data Sharing¶

The problem¶

Researchers need to share datasets with collaborators, reviewers, and external partners under controlled conditions. They need audit trails that document who accessed which data and when, access controls that limit visibility to authorized participants, and reproducibility guarantees that ensure the same dataset version is available over time.

Traditional sharing methods -- email, shared drives, institutional repositories -- lack fine-grained access control, have no usage tracking, and make it difficult to enforce data governance policies across institutional boundaries.

The solution¶

IPTO provides a multi-tenant data platform with role-based access, dataset visibility controls, and scoped API keys. Researchers publish datasets with restricted visibility, invite collaborators through tenant memberships or scoped API keys, and maintain a complete audit trail of all access events.

How it works¶

1. Create a restricted dataset¶

The research lead creates a dataset with restricted visibility so that only explicitly authorized users can discover and access it.

{
  "name": "Clinical Trial Results - Phase II Longitudinal Study",
  "description": "De-identified patient outcomes and biomarker data from 2024 Phase II trials",
  "source_modality": "document",
  "monetization_mode": "open",
  "pricing_model": "fixed",
  "visibility": "restricted"
}

2. Upload and review data¶

Researchers upload files through the presigned upload flow. Each upload enters the staged review workflow:

3. Invite collaborators with scoped API keys¶

The research lead creates API keys for each collaborator or collaborating institution, restricted to the specific datasets they should access.

{
  "name": "university-of-X-collab",
  "scopes": ["search:query", "datasets:read"],
  "dataset_access_mode": "allow_list",
  "dataset_ids": ["dset_trial_phase2"]
}

Key access rules:

• allow_list mode restricts the key to only the specified datasets
• Keys can only narrow tenant-level access, never expand it
• Keys are revocable independently, so access can be removed for a single collaborator without affecting others

4. Collaborators search and retrieve¶

Collaborators use their scoped API keys to search the dataset, retrieve results, and download original files when needed. Every interaction is logged.

5. Monitor access and generate audit reports¶

The research lead monitors all access activity through the buyer activity and spend APIs:

Benefits¶