Research Collaboration: Sharing Files Across Institutions
Enable research collaboration with secure cross-institutional file sharing. Share datasets, manuscripts, and findings with global research teams.
Cross-institutional research sharing requires a file channel that handles terabyte-scale datasets, respects differing IRB and data-use agreements, and survives network policies at every partner lab. Globus Online dominates the high-performance end for national labs moving 10 TB+ genomics or physics payloads over GridFTP at 40 Gbps. For manuscripts, intermediate datasets, and ad-hoc transfers under 50 GB, a zero-knowledge encrypted link beats email attachments and shared Dropbox folders — the ciphertext crosses institutional firewalls without anyone's IT team needing to whitelist accounts or federate identities.
Data Use Agreements and IRB Constraints
A Data Use Agreement (DUA) between, say, Stanford and the Max Planck Institute specifies which datasets may leave, to whom, in what form, and for how long. Before anything moves, verify the DUA covers the specific dataset (not just "research data"), the specific recipient (Dr. Chen's lab, not "Max Planck"), and the storage location after transfer. Under a standard Federal Demonstration Partnership DUA, de-identified Limited Data Sets still require encryption in transit and at rest. Full identifiable data usually triggers a Business Associate Agreement under HIPAA if PHI is involved, governed by 45 CFR 164.504(e). Keep the signed PDF alongside your transfer logs.
GDPR Article 46 and International Transfers
Moving research data from an EU partner to a US collaborator crosses a GDPR transfer boundary. Post-Schrems II, you need Article 46 safeguards — typically Standard Contractual Clauses (June 2021 version) signed by both institutions, supplemented by a Transfer Impact Assessment. The EU-US Data Privacy Framework, certified through the Department of Commerce, provides an adequacy basis if the US recipient self-certifies. Pseudonymization under Article 4(5) — replacing names with codes held separately — reduces the risk category substantially. Encrypt with AES-256-GCM and keep the key on the EU side until the collaborator's analysis environment meets EU standards, which practically means host the ciphertext anywhere but hand over keys only after confirming the recipient's enclave is locked down.
Dataset Sizes and Protocol Choices
A single cryo-EM session produces 2 TB of raw .mrc micrographs. A Large Hadron Collider AOD slice runs 500 GB. Whole-exome sequencing BAM files land around 10 GB per sample, and a 500-sample cohort hits 5 TB. At these sizes, HTTPS via a browser tab is painful — you want parallel streams and resumable checkpoints. Globus provides endpoint-to-endpoint transfers with automatic retry and checksumming (MD5 or SHA-256), and its fire-and-forget model lets a transfer run for 18 hours across the Atlantic without a researcher babysitting it. Aspera (IBM) uses FASP UDP acceleration and reaches 10 Gbps over a 200 ms latency link where TCP-based tools struggle. For anything under 10 GB, a single encrypted link through a service like HexaTransfer or SwissTransfer is faster to set up than requesting a Globus endpoint.
Manuscript Collaboration Workflows
Manuscripts flow differently from datasets. A Nature submission draft in LaTeX with embedded figures weighs 50 MB; after peer review, reviewer tracked changes, supplementary Excel tables, and a PDF proof balloon to 400 MB. Overleaf and Authorea handle real-time LaTeX collaboration across institutions with Git-backed version history. Send the final submission bundle as a single encrypted tarball — reviewers and editors don't need your draft comments or earlier figure iterations. For preprints headed to arXiv, bioRxiv, or SSRN, the upload is public by design, so encryption is irrelevant — but the transfer from co-authors to the submitting author beforehand should still be locked down, especially for findings under embargo.
Version Control for Datasets: DVC, Git LFS, and DataLad
Git LFS handles files up to 5 GB on GitHub with a pay-per-GB bandwidth model above free tier quotas. DVC (Data Version Control) stores large files in an S3, Google Cloud Storage, or Azure Blob backend and checks in only the hash. DataLad, popular in neuroscience, wraps git-annex and synchronizes across institutional boundaries while tracking who has which revision locally. For a three-institution collaboration on a shared fMRI dataset, DataLad gives each lab a lightweight clone with pointers — the 4 TB of BIDS-formatted NIfTI files stay on an S3 bucket, and researchers pull just the subjects they're analyzing. Commit hashes produce the same reproducibility receipts you'd expect from source code.
Authentication Across Federations
InCommon, eduGAIN, and the Research and Scholarship entity category let a Max Planck researcher log into a Stanford-hosted resource using their home IdP. SAML 2.0 assertions carry a minimal attribute bundle (eduPersonPrincipalName, affiliation, assurance level) so the Stanford system knows Dr. Schmidt is a verified faculty member without Stanford managing her password. For services outside the federation — commercial transfer tools, cloud platforms — ORCID iDs function as a portable researcher identifier. Require two-factor (TOTP, WebAuthn, or FIDO2 hardware keys) for any account touching identifiable human-subjects data.
Export Controls and ITAR
Not all research data can legally cross borders. ITAR-controlled defense research (encryption algorithms in some categories, satellite tech, munitions designs) and EAR dual-use items require licensing before export. A physics collaboration on propulsion systems with a partner in China may be blocked entirely under 15 CFR Part 744. If your data falls under EAR99 or is "fundamental research" under NSDD-189, you're usually clear — but the general counsel's office, not the PI, makes that call. Transfer services operating servers in multiple countries may not satisfy "no foreign person access" requirements; check whether your vendor can provide an attestation that US-only infrastructure handled the payload.
Practical Setup for a Multi-Site Consortium
A three-country NIH U01 consortium typically runs: (1) a central data coordinating center hosting the authoritative copy on an AWS GovCloud or institutional HPC, (2) Globus endpoints at each member site for bulk dataset movement, (3) REDCap for clinical metadata with HIPAA-compliant export, (4) GitHub or GitLab for analysis code with DVC/Git LFS for intermediate artifacts, and (5) an encrypted transfer service for one-off shares of manuscripts, figures, and exploratory subsets that don't warrant an endpoint configuration. Monthly coordinator call to reconcile what's where.
Try it at hexatransfer.com — free, no account, 10 GB max. For the ad-hoc 8 GB supplementary dataset your Tokyo collaborator needs before the Thursday deadline, paste, encrypt, send, done.
Send large files securely with end-to-end encryption
Transfer files up to 10 GB for free with end-to-end encryption. No account required. Your files are encrypted in your browser before upload — no one else can read them.
Send a file