Skip to main content
tiCrypt 2.18.1

User Guide Overview

This article introduces everything available to you as a tiCrypt user. It covers three areas: your account and settings, the Vault (tiCrypt's encrypted file management interface), and virtual machines. Each section explains what the feature does, why it exists, and where to find step-by-step instructions.

tiCrypt is accessed through the tiCrypt Connect desktop application, which connects to your institution's deployment. When you register your account, tiCrypt generates a key file containing your private encryption key, which you download and save to your device. You load this key file each time you log in.

This key file is essential: it is the only way to decrypt your data. Store backup copies in secure locations and never share it. If you lose both your password and your key file, your data cannot be recovered unless your deployment has key escrow configured (see your administrator for details).

Migrating from a shared computing cluster?

See From Shared Computing Cluster to tiCrypt for a concept-by-concept mapping. For how VM roles (Owner, Co-Owner, Manager, User) work independently from system roles, see VM Roles and Permissions.

A few concepts appear throughout tiCrypt and are worth defining up front:

  • Teams control resource allocation. Every VM, drive, and storage quota belongs to a team. Your administrator assigns you to one or more teams, and each team defines how many CPU cores, how much memory, and how much drive storage you can use.
  • Projects are a tagging mechanism with system-enforced separation. When a resource (file, drive, VM, or inbox) is tagged with a project, only active members of that project can access it. Projects organize work around research efforts, contracts, or compliance boundaries.
  • Groups are collaborative collections of users who share access to resources. Unlike teams (which govern quotas), groups let you share files and drives with a defined set of collaborators.
  • User Profiles (also called Permission Profiles) bundle a role with granular permissions into a named template. Your administrator assigns a profile that determines what you can do in tiCrypt. If you need access to a feature and do not see it, ask your administrator to update your profile. Your administrator may also use an Onboarding Template to assign your profile, teams, projects, and certifications in a single step.

Account and Settings​

The Account and Settings section covers your identity, preferences, and session management in tiCrypt. Access all account features through the Open user menu button (your profile picture) in the toolbar. It is the first item in the toolbar on Windows and Linux, and the last item on macOS.

The toolbar also holds the main sections. Vault is always there. Virtual Machines appears if you have the View their VMs and VMs shared with them permission. Management appears only for Sub-admins and above who also have the View all users, not only those in their teams, groups and projects permission.

Sign-In Notices​

Signing in can show up to four notices: a login message on the login page, a CUI acknowledgement, the terms of service, and a "Since you last logged in" summary of failed logins and changes to your role, permissions, projects, and certifications. Declining the CUI acknowledgement or the terms of service logs you out.

For details, see Sign-In Notices.

Profile​

Your profile is the central view of your tiCrypt identity. It contains:

  • Properties: your state (Active, Inactive, or Active and escrow on next login, which means your encryption keys will be backed up for recovery at your next login), your assigned User Profile, and your certifications.
  • Associations: the teams, projects, and groups you belong to. From here you can view your teams, and add or remove yourself from projects and groups (if your permissions allow). To change your team membership, contact your administrator.
  • Virtual machines: your VM configurations, running VMs, and drives. You can start, share, connect to, and manage VMs directly from your profile.

From your profile you can also transfer files between your Vault and a running VM, open remote desktop connections, launch terminal sessions, and manage drive sharing.

For step-by-step instructions, see Profile.

Certifications​

Some projects require security certifications before you can access their resources. A certification is an attestation that you meet a specific security requirement (for example, training completion or clearance verification). Your administrator or project manager grants certifications, and each one has an optional expiration date.

You can view your certifications in your profile under Properties > Certifications. If a project requires a certification you do not hold, you will not be able to access resources tagged with that project until the certification is granted.

Teams' Resource Usage​

This view shows how much of your team's resource quota you and your team are consuming. It displays:

  • Vault storage: how much storage your encrypted Vault files use.
  • Overall team quota: the team's total allocation for CPU cores, memory, and drive storage.
  • Your quota within the team: your personal allocation within the team's limits.

If your resources are running low, contact your administrator to request an increase. If this view fails to load, you may be missing a permission; contact your administrator.

For step-by-step instructions, see Teams' Resource Usage.

User Settings​

User settings let you customize the tiCrypt interface:

  • Toolbar layout (Connect Application only): keep the default two toolbars, or merge them into a single toolbar.
  • Toolbar position: move the toolbar to the top, left, bottom, or right of the screen. The default is left.
  • Theme: choose from Default for OS, Modern, Light, Dark, or High Contrast. The High Contrast theme complies with the Web Content Accessibility Guidelines.
  • Single-key keyboard shortcuts: turn off shortcuts that use one key, such as T for the task tray, if you use speech input or press keys by accident.

Settings take effect immediately and are saved on your account, so they follow you to any computer.

For step-by-step instructions, see User Settings.

Change Password​

Changing your password re-encrypts your private key with the new password and generates a new key file, which downloads as soon as you apply the change. After changing your password:

  1. Delete all copies of the old key file.
  2. Use the new key file from your next login on.
  3. Store backup copies of the new key file in secure locations.

If your deployment has split credentials enabled (the server stores part of the encryption material separately, so neither the client nor the server alone can recover the private key), the server-side credentials are also regenerated, making the old key file permanently invalid. After five incorrect attempts at your current password in the password change pop-up, you are logged out. If your deployment uses key escrow, your administrator may be able to restore access; contact your administrator for details.

For step-by-step instructions, see Change Password.

Profile Picture​

You can upload a custom profile picture or use the system-generated color pattern. Most image formats are supported. tiCrypt crops the picture to a circle and scales it down to at most 256 by 256 pixels; you can resize and move the circular crop area before saving.

For step-by-step instructions, see Profile Picture.

Logout, Exit, and Session Security​

tiCrypt provides several session management options:

  • Log out: ends your active session. A 60-second countdown starts; if you do not cancel, the system logs you out automatically. Closing the tiCrypt Connect application tears down the connection to the secure enclave and to all your virtual machines. The virtual machines keep running; only the connection ends.
  • Exit (labelled with your deployment's name, for example Exit tiCrypt Edge): closes the deployment and returns to the Connect Application's deployment selection.
  • Time until key is purged from memory: a timer showing when your decrypted private key is cleared from memory, a security measure. The key is purged automatically when this timer reaches zero, after a period without using the key.
  • Time until session is locked: a timer showing when your session locks for inactivity. Mouse clicks, running file transfers, and input in a VM console reset it; typing alone does not. When it reaches zero, you must enter your password again. Ctrl+Shift+P locks the session at once.
  • Download Debug Logs (N): saves the errors recorded since you logged in to a text file for troubleshooting. It reads No logs to download when there is nothing to save.
  • Message History: shows recent pop-up messages again after they disappear.
  • Helpdesk links: links or phone numbers your administrator added to the user menu, if any.
  • Exit on the login page: the same button, below the login box, switches between deployments (when your institution has two or more).

For step-by-step instructions, see Logout and Exit. For the lock screen and how to unlock it, see Session Lock.

Notifications and Tasks​

The bell in the toolbar opens your notifications: files other users shared with you, group membership changes, and messages sent to you or to your teams, projects, and groups. The task tray lists the operations you started, such as uploads and downloads, with their progress and logs. Reloading or closing the window cancels running tasks.

For details, see Notifications and Tasks.

Keyboard and Navigation​

tiCrypt has keyboard shortcuts for locking the session, logging out, showing the task tray, zooming, and searching the documentation. Press ? to list them. After you sign in, a Skip to main content link is the first Tab stop on every page.

For details, see Keyboard and Navigation.

Vault​

The Vault is tiCrypt's general-purpose encrypted file storage, independent of any virtual machine. It is separate from the encrypted drives attached to VMs: drives hold data you work with inside a VM, while the Vault holds data at rest outside of VMs. The Vault also serves as the audited passthrough between external data sources and VMs. Most transfers into and out of VMs use the Vault, so the operations are logged. SFTP to a VM and SSHFS write into the VM directly, and nothing leaves a VM except through the Vault.

Every file stored in the Vault is encrypted on your device before upload with its own AES-256 key. The file is split into 8 MB chunks, and each chunk is encrypted separately with its own random initialization vector. The server infrastructure never holds your encryption keys. This means that even system administrators cannot read your files.

The Vault opens from the Vault icon in the toolbar. Its left panel holds your file tree: My Files (your own files and directories), your groups' directories, Downloads, Trash, Inboxes (secure ways for people without a tiCrypt account to send you files), Shared With Me and Shared By Me. A Groups panel (sets of users who share files) sits on the right.

Users​

The Vault has no list of users. You pick collaborators at the moment you work with them: sharing a file or drive, adding someone to a group, or adding a VM user each opens a selector of the users visible to you, normally the members of your own teams. Sub-Admins and above who have the View all users, not only those in their teams, groups and projects permission can browse every user under Management > Users.

For step-by-step instructions, see Users.

Groups​

Groups are collaborative collections of users who share access to files and resources. You can create groups, add members, and share files with an entire group in a single action rather than sharing with each user individually. Groups can also be tagged with a project. Members must then meet that project's restrictions to open the group's files.

Key group operations:

  1. Create a group and name it for your collaboration (e.g., "Lab Meeting Data").
  2. Add members from users visible to you.
  3. Share files with the group, granting all members access at once.
  4. Transfer ownership of a group to another member when responsibilities change.

For step-by-step instructions, see Groups.

Projects​

Projects in the Vault are a tagging mechanism with system-enforced separation. When you tag a file, drive, VM, or inbox with a project, only active members of that project can access it. This enforcement is automatic and cannot be bypassed.

Projects organize resources around research efforts, contracts, or compliance boundaries. Some projects require security certifications: you must hold valid certifications for all requirements at the project's security level before you can access its resources.

Key project operations:

  1. View projects you are a member of from My Profile > Associations > Projects.
  2. Tag resources with a project to restrict access to project members.
  3. Create subprojects (if you manage the parent project) for finer-grained organization.
  4. View members and their roles within a project.

For step-by-step instructions, see Projects. Creating subprojects and managing members are covered in Admin Guide: Projects.

Files​

The Files area is the core of the Vault, where you manage your encrypted file tree.

Creating Files and Directories​

You can create directories to organize your work, then upload files into them. tiCrypt does not create new files itself. Directories form a tree structure in the left panel of the Vault.

For step-by-step instructions, see Create.

Uploading Files​

You can upload files through two methods:

  1. Upload Files button: click Upload Files at the top of the left panel, choose Files or Directories, select them on your local machine, and confirm.
  2. Transfer files between My Vault and My Computer: a transfer window in tiCrypt for moving files between your local machine and the Vault. It needs the Connect Application to be running.

Uploads support bulk actions, so you can select multiple files at once.

For step-by-step instructions, see Upload.

Downloading Files​

Download files from the Vault to your local machine. The encrypted chunks are retrieved from the server, decrypted in your browser, and assembled into the original file. You can download individual files or select multiple files for bulk download.

For step-by-step instructions, see Download.

Viewing Files​

View file contents directly within tiCrypt without downloading. The viewer decrypts and renders the file in your browser, supporting common file types.

For step-by-step instructions, see View.

Sharing Files​

Share files with individual users or entire groups. Sharing grants each recipient an independently encrypted copy of the file's decryption key, so the server never has access to the decrypted content.

When sharing, you can set expiration dates and apply the restrictions Cannot view and Cannot download. Files can be shared only with groups you are a member of. Sharing supports bulk actions for selecting multiple files.

For step-by-step instructions, see Share.

Transferring Files​

Transfer files between the Vault and your computer, a cloud storage service, or an SFTP server. To move or copy files between folders inside the Vault, drag and drop them in the file tree. Transfers support bulk selection.

For step-by-step instructions, see Transfer.

Renaming Files​

Rename files and directories within the Vault.

For step-by-step instructions, see Rename.

Changing a File's Project Tag​

Change which project a file is tagged with. This controls who can access the file: only active members of the tagged project will have access. If you are a project manager, you can also declassify files (remove the project tag).

For step-by-step instructions, see Change Project.

Viewing File History​

View the event history of a file: who created, accessed, shared, unshared, classified, declassified, or deleted it, and when. tiCrypt keeps no earlier versions of a file's content; the history lists events only.

For step-by-step instructions, see View History.

Computing Disk Usage​

Check how much storage your files consume within the Vault. This helps you monitor your usage against your team's storage quota.

For step-by-step instructions, see Compute Disk Usage.

Deleting Files​

Remove files from the Vault. Deleting moves items to the Trash first, from where you can restore them. Deleting them from the Trash is permanent and cannot be undone.

For step-by-step instructions, see Delete.

Inboxes​

Inboxes are secure file-receiving endpoints that let external users upload files into your Vault without needing a tiCrypt account. You create an inbox, set an expiration date and upload capacity, and share the generated URL with the uploader. Files uploaded through the inbox are encrypted and deposited into a directory you specify.

Inboxes are useful for receiving data from collaborators, research subjects, or external partners who do not have tiCrypt accounts.

Key inbox operations:

  1. Create an inbox by specifying a name, parent directory, expiration date, capacity, and a message for the uploader.
  2. Share the URL with the person who needs to upload files.
  3. Manage access points to view, copy the link of, add, or delete an inbox's access points. An access point cannot be edited after it is created; create a new one instead.
  4. Convert a directory into an inbox by selecting Make inbox from the directory's menu.

For step-by-step instructions, see Inboxes.

Virtual Machines​

tiCrypt provides fully encrypted virtual machines that run on isolated infrastructure. VM images reset on every boot, eliminating persistent malware. Drives attached to VMs are encrypted with LUKS (Linux Unified Key Setup, a disk encryption standard) for Linux or BitLocker for Windows, with encryption keys provided by the data owner. The server infrastructure never holds drive encryption keys.

Access virtual machines through the Virtual Machines icon in the toolbar. The icon appears only if you have the View their VMs and VMs shared with them permission. The VM interface has two sections: Virtual Machines (your VM table) and Drives (your encrypted storage). Command-line access opens in the Terminal Hub, and Slurm jobs are submitted from inside a VM.

Understanding the VM Lifecycle​

Working with virtual machines in tiCrypt follows a consistent flow:

  1. Create a VM configuration: select a hardware setup (a preconfigured template, created by your administrator, that bundles an OS image with CPU cores, memory, and optional devices like GPUs), attach a home drive and any extra drives, assign the configuration to a team, and optionally tag it with a project.
  2. Start the VM: launch the configuration. tiCrypt provisions the VM on the host infrastructure, boots the image, and attaches your encrypted drives.
  3. Connect: access the running VM through RDP (Remote Desktop Protocol), a browser-based terminal, or a VNC (Virtual Network Computing) console.
  4. Work: use the VM as a standard Linux or Windows machine. Your drives are decrypted inside the VM using your keys.
  5. Transfer data: move files between the VM and your Vault, or use SFTP for larger transfers.
  6. Shut down: stop the VM when finished. The VM image resets to its clean state; only your encrypted drives persist data between sessions. Any software you install or settings you change inside the VM will not survive a reboot. If you need additional software in the base image, contact your administrator.

VM Table​

The VM table shows all VMs you own, co-own, or have access to via sharing. Each VM displays its connection status, ownership type (owner, co-owner, or shared), and a FIPS (Federal Information Processing Standards, a government security compliance mode) indicator.

From the VM table you can:

  • Pin frequently used VMs for quick access.
  • View VM status: Connected, Running, Stopped, Not Running (error), or Unknown (processing).
  • Create, edit, share, start, and delete VM configurations.
  • Connect to running VMs via RDP, terminal hub, or VNC.
  • Transfer files between a running VM and your Vault.
  • Open an SFTP pathway for large data transfers via a proxy connection.

To connect to a project-tagged VM, you must be a member of that project.

For step-by-step instructions, see Virtual Machines Table.

Drives​

Drives are encrypted virtual disks that persist your data between VM sessions. Every drive has an owner, belongs to a team, and can optionally be tagged with a project. When you create a drive, you can format it as EXT4 or BTRFS (Linux) or NTFS (Windows).

The drive lifecycle:

  1. Create a drive: specify a name, team, capacity, and filesystem format.
  2. Attach to a VM: connect the drive to a running or configured VM. A read-write drive can attach to only one VM at a time; a read-only drive can attach to multiple VMs simultaneously.
  3. Use in the VM: the drive appears as a standard filesystem volume, decrypted with your keys inside the VM.
  4. Detach: disconnect the drive from the VM when finished.
  5. Share: share drives with other users in read-write or read-only mode. A drive must be formatted and attached to a VM at least once before it can be shared.

Additional drive operations:

  • Change project tag: restrict drive access to project members.
  • Transfer ownership: hand a drive to another user (the drive must be shared in read-write mode with at least one user before ownership can be transferred).
  • Migrate: move a drive between storage pools.
  • Access via File Explorer: browse drive contents from within the VM interface.

For step-by-step instructions, see Drives Table.

Terminals​

The Terminal Hub provides browser-based command-line access to your running VMs. You can open multiple terminals to the same VM simultaneously and arrange them in split layouts.

Key terminal features:

  • Multiple terminals: open as many terminals as needed (recommended maximum of 16 for organized workflows).
  • Split view: drag and drop terminal tabs to create side-by-side layouts.
  • Minimize: collapse terminals you are not actively using. Minimized terminals remain active.
  • Reset layout: restore all terminals to their default arrangement.

A home drive must be attached to the VM before you can open a terminal.

For step-by-step instructions, see Terminals.

Submitting Jobs via Slurm​

tiCrypt integrates with Slurm (Simple Linux Utility for Resource Management) for scheduling compute jobs on secure infrastructure. Jobs are submitted from within a tiCrypt virtual machine through the terminal or an RDP session.

To use Slurm, your system administrator must configure your VM as a Slurm submit host, and the VM image must have Slurm installed. You submit jobs from inside the VM using standard Slurm commands.

The typical workflow:

  1. Verify availability: run sinfo in the VM terminal to confirm Slurm is configured.
  2. Compose a job script: write a shell script with #SBATCH directives specifying resource requirements (CPU cores, memory, time limit, partition) followed by your workload command.
  3. Submit the job: run sbatch myjob.sh to queue the script, or use srun for direct execution and interactive sessions.
  4. Monitor progress: run squeue --me to list your queued and running jobs.
  5. Review results: run sacct to check resource consumption after completion.

Both sbatch (batch submission) and srun (direct execution, including interactive sessions) are supported. The workload command can be any program callable from the shell: Python, R, compiled binaries, shell pipelines, or other tools.

For step-by-step instructions and example job scripts, see Submitting Jobs via Slurm.

Remote File System​

A remote file system via SSHFS (Secure Shell Filesystem) establishes a one-way connection from your local machine into your virtual machine. Once connected, you can write files from your local drive into the VM. Downloads and file reads from the VM are blocked by design to prevent data exfiltration. This lets you transfer data into your VM and works with external SFTP tools.

Setting up a remote file system requires installing macFUSE and SSHFS (macOS) or WinFsp and SSHFS-Win (Windows) on your local machine. Your Linux VM must be configured for SFTP (Secure File Transfer Protocol). Separate licenses may be required for non-personal or commercial use.

For step-by-step instructions, see Remote File System.

How the Sections Connect​

The three areas of the User Guide form an interconnected system:

  1. Your account determines what you can do. Your permission profile controls which Vault operations, VM features, and project interactions are available to you. If a feature is not visible, your profile may not include the required permission.
  2. Teams set your resource limits. Every VM and drive belongs to a team. Your team's quota determines how many cores, how much memory, and how much drive storage you can use. Check your usage in Teams' Resource Usage.
  3. Projects restrict access to resources. Files, drives, VMs, and inboxes tagged with a project are accessible only to project members. Some projects additionally require security certifications.
  4. Groups simplify collaboration. Instead of sharing files with individual users, share with a group to grant access to all members at once.
  5. The Vault and VMs share data through file transfers. You can transfer files between the Vault and a running VM through the built-in transfer interface, SFTP pathways, or remote file system mounts.
  6. Drives persist data across VM reboots. VM images reset on every boot, but encrypted drives retain your data. Share drives with collaborators to give them access to the same persistent storage.