About the Atrium Platform¶
Atrium is a platform your organisation runs to host secure research and teaching environments in the cloud. If you use one of those environments, you reach it through a single web address, sign in once, and work entirely in your browser — this page explains what sits behind that and why it is built the way it is.
The problems it addresses¶
Sensitive data needs a safe place to be worked on. Research on health, social, or otherwise confidential data comes with obligations: the data must stay inside a controlled environment, everything that enters or leaves must be governed, and there must be a record of what happened. Atrium environments are built for exactly this — analysis happens inside the environment, not on personal machines, and data moves only through reviewed routes.
Secure environments are hard to build well, and harder to build repeatedly. Every new project needs the same foundations — private networking, identity, a hardened entry point, secrets handling, logging. Rebuilding those per project is slow and each rebuild is a fresh chance to misconfigure something. Atrium builds the shared foundations once, to one reviewed standard, and each environment plugs into them.
Cloud costs need governing as much as data does. Environments track spending against project budgets, and can be paused when not in use so idle infrastructure isn't billing.
How it is put together¶
Three layers, each with a clear job:
- A durable foundation of shared services — networking, secrets, logging, and the platform's stable public address.
- A platform hub providing the single entry point, sign-in, and administration.
- Modules — the environments people actually use. Each is self-contained and attaches to the platform rather than building its own foundations.
As a user you never see the layers: one address, one account, one browser.
Key design considerations¶
- One front door. Everything is reached over HTTPS through a single hardened gateway; nothing else in the platform is exposed to the internet.
- One identity. A single sign-on covers every application in your environment, with two-factor authentication required in secure environments. See Your Account.
- Private by default. The platform's internal services — storage, secrets, infrastructure — are not reachable from the internet at all, only from inside the platform's own private network.
- Governed data movement. In secure environments, data enters and leaves only through the governed, reviewed routes the environment defines, with every transfer recorded.
- Everything as code. The whole platform is defined in reviewed, version-controlled code and stood up by automation — so environments are reproducible, and changes go through approval rather than ad-hoc edits.
- Auditable. Platform actions and data movements are recorded centrally, so operators and governance teams can see what exists and what happened.
- Cost-aware. Environments track project budgets and can be parked when idle.
Using an environment¶
Each environment publishes its own user guide covering its applications and day-to-day use — your operator will share its address alongside your sign-in details. For account matters (passwords, two-factor setup), see Your Account.