Kapseli user guide

On this page you’ll find simple instructions for ordering Kapseli, using it and verifying the results.

Instructions for using the secure operating environment Kapseli

The user interface of Kapseli is very much in line with the desktop of your own computer, but the desktop of Kapseli is at the end of a remote connection. Due to security regulations, there are a few differences in use of Kapseli compared to the use of an ordinary desktop.

• There is no Internet access from Kapseli. Although the browser is installed, it can only be used locally, such as for opening documents in the HTML format.
• Copying data between the remote desktop and your own computer is blocked.
• It’s not allowed to take any photo of Kapseli.
• No data, images or other material can be transferred independently to Kapseli, instead all data is transferred through Findata’s audits. 

The IP address used with Kapseli must be static, i.e. most often the organization’s IP address. In general, when working remotely, the IP address of your own organization can be accessed via a remote connection, e.g. a VPN connection. If there is change in the organization’s connections, ask your organization’s IT support about the entire address space of IP addresses, so that the change does not hinder the use of Kapseli. Kapseli cannot be used via private IP addresses.

Logging in Kapseli

Before logging in make sure your account has been registered and is ready to use. If you’re not sure whether your account is ready to use get in touch with Findata’s contact person.

1. Install Duo Mobile app (duo.com) to your phone and activate it. The developer is Duo Security Inc. If you’ve already installed and activated the app go to point 2.
   • Installing: find Duo Mobile from your phones app store and install it.
   • Activating: the phone numbers reported when ordering Kapseli will get an automatic activating message for Duo Mobile. The app is activated by clicking the link in the activating message.
2. Log in Kapseli at kapseli.findata.fi using your computers browser.
   • Choose the identification method from the list that you chose while registering.
3. Choose the operating environment you’re going to use. If you have just one operating environment in use go to the next section.
   • After choosing the environment the system goes to the second phase of identification.
4. The second phase of identification.
   • Log in the operating environment.
   • You’ll get a notification about logging in to Duo Mobile. To approve the log in choose ‘Approve’ in Duo Mobile.

Data transfer and folder structure of Kapseli

All software installations and data transfers in Kapseli take place through orders and audits. No data can be independently exported to or imported out of Kapseli.

The data permit specifies the data for which a processing permit has been granted. The data is collected, linked, pre-processed and, if necessary, pseudonymised or anonymised by the Data Permit Authority. Additional information needed for use of the data, such as publicly available statistical data, also requires an audit by the Data Permit Authority and a transfer of data to the Kapseli.

We request the materials from the controllers primarily in CSV format and deliver them to Kapseli in CSV format (semicolon as separator, UTF-8 encoding).

Folder structure:

• Data (D:)
• Backup (E:)
• CRAN (N:)
• Output (O:)
• Work (W:)

The files specified in the data permit are available in the Data (D:) folder. The Data folder is write-protected. Other information supplied to Kapseli, such as any program codes, will also be moved to the Data folder after an audit. For the purposes of work, the system has the Work (W:) folder to which you should copy the files you use from the Data folder.

From the Output (O:) folder intended for data transfer, the data is transferred to the Data Permit Authority’s system to be audited. Note that the data to be transferred must be in anonymous format and that, with regard to program codes, you must also ensure that no personal data is included in the files to be transferred. The data that you want to back up is be exported to Backup (E:) folder. The CRAN (N:) folder contains the software packages required for using the R software.

Exiting the system

There are two ways to stop using the remote desktop.

• Sign out is located behind the human figure at the bottom left. You should use this option when you have finished processing the data. When you exit from Sign out, you release the resources on the remote workstation.
• Disconnect is located behind the Power button. Use this option if you need to leave analyses  running when you leave the workstation. The resources will then remain reserved.

After both options, you will see the options Reconnect and Logout. Select Logout when stopping the use of the system. Close your browser unless you want to log back in.

Software in Kapseli

All Kapseli packages include the software according to the table below as standard. We will expand the range of software as needed.

Windows Server 2016 Standard

Software	Version	Version from 1 December 2022 onward	Further information
7-Zip	19	22	
Adobe Acrobat Reader DC	Up to date	Up to date	
Anaconda 3	2019/10, 2020.07	2022.05	Uses Python Wheel 3.9
GeoDa	1.16	1.2	
Git	2.28.0	2.38.0	
Google Chrome	Up to date	Up to date	
IBM SPSS Statistics	27	29	If the software license requires an update, notify kapseli@findata.fi.
LibreOffice	6.1	7.4	Base, Calc, Draw, Impress, Math, Writer
LyX	2.3	3	
MiKTeX	20.6	22.7	
Notepad++	7	8	
QGIS	3.10	3.26	
R	4	4	Includes CRAN library packages. Please note that R-Tools is not automatically installed in Kapseli. If you need R-Tools, indicate this in the additional information of the subscription form.
RStudio	1.2	2022.07.2+576	
SAS	9.4	9.4	If the software license requires an update, notify kapseli@findata.fi.
Stata	16	16	If the software license requires an update, notify kapseli@findata.fi.
WinPython	3.8	3.8	

Linux CentOS 7

Software	Version	Further information
Emacs		
Golang		
LibreOffice		Base, Calc, Draw, Impress, Math, Writer
Nextflow		
Pigz		
Python	3.7.9.	Includes the following packages: tensorflow nltk spacy scikit-learn seaborn plotly bokeh pydot xgboost lightgbm catboost eli5 torch keras dist-keras elephas gensim scrapy beautifulsoup4 numpy scipy pandas statsmodels matplotlib pyfuse3 crypt4gh trio httpx qrcode
R + R studio	4.2.1	Includes CRAN library packages. Please note that R-Tools is not automatically installed in Kapseli. If you need R-Tools, indicate this in the additional information of the subscription form.
VS Code

If you need other software in addition to the standard software, it is possible to use them by additional order. Orders for additional software are made in connection with the Kapseli order or while using the Kapseli by updating the Kapseli order in the transaction service.

Orders for additional software

If you need additional software other than those available as standard, these can be provided by additional order. Orders for additional software are made in connection with the Kapseli order or while using the Kapseli by updating the Kapseli order in Findata’s e-service. The additional software can be either access or licence based. If software requires a licence, the customer will be responsible for acquiring a licence for themself. We will charge a fee of 86.00 euros/hour (+VAT 24%) for the installation of the user’s own tools/software to the Kapseli machine package.

Transferring own files to Kapseli

Kapseli functions as the project’s desktop throughout the processing of the data. In principle, the processing of the data would take place in Kapseli, i.e. only the final analysis results would be brought outside the system. The same idea of producing code inside the system applies to the production of program code required for analysis. In practice, however, an earlier program code is often used as an analysis framework. Earlier program code and other own files (study protocol, descriptions of variables etc.) can be imported into Kapseli through an audit by Findata.

See the instructions for further details from Data transfers to Findata -page.

Using the R program’s CRAN mirror repository

Enabling CRAN mirror repository on RStudio

Cran mirror repository can be found at cran.findata.local.

1. Remove .Renviron -file under your Documents -folder or Project folders (WORK). You
   may also edit file and remove following lines:
   RSTUDIO_DISABLE_PACKAGES=TRUE
   R_LIBS_USER=N:/
2. Create .Rprofile -file under your Documents -folder with lines below
   local({
   r <- getOption(“repos”)
   r[“CRAN”] <- “https://cran.findata.local/”
   options(repos = r)
   })
   • .Rprofile -file can also copied from D:\ -network drive (DATA).
3. Restart RStudio.
   • You can install R packages with install.packages(“PACKAGE”) -command.
   • If you prefer a graphical user interface to install packages, in RStudio you will find it at Tools -> Install Package. After a package is installed, use the library() function to load package.

Result verification

All those who process personal data must provide the results of their analyses in an anonymous form that cannot be used to reveal any data or aspects concerning individual participants following the instructions given by the Data Permit Authority Findata. According to the Act on the Secondary Use of Health and Social Data, the Data Permit Authority must ensure anonymity. This applies to all materials that have been authorised under said Act.

Anonymisation refers to a process in which the material is processed in a way that

• it cannot be used to identify any individual persons either directly or indirectly
• it cannot be used to make any conclusions concerning a specific individual person
• any information concerning a specific person cannot be linked to any other material

1. Check the anonymity of the results to be publish in regard to our instructions that you can find on page Producing anonymous results.
2. Transfer the results and the conclusion form to Findata via the Kapseli operating environments Output-drive,
   • Fill in the conclusion form (Pyyntö varmistaa tulosten anonymiteetti) and attach it.
   • Pack the results and the conclusion form in a zip file and name it accordingly:
     Tulokset_Diary_number_of_the_data_permit_Operating_environments_identity_code_Transfer_date (the dates should be ddmmyyyy, e.g. Tulokset_THL_1234_14.02.00_2020_a01_15032022)
   • Create an empty text file to the Output-drive and name it ZZZ_READY.txt, so the zip file will automatically transfer to Findata. Check carefully that the ZZZ_READY file is named correctly to make sure the transfer will succeed. The transfers are done on the hour and every 30 minutes. The transferred files are automatically removed from the Output drive after this.
   • If you want to you can notify Findata about the transfer (info@findata.fi). We’ll contact you if the transfer didn’t reach us. You won’t get a notification about a successful transfer.
3. We’ll check the requests in 5 working days and deliver the results to the permit holder via transfer service Nextcloud. If we need more information we’ll contact you.
   • If the result files are very extensive the 5 days limit might not apply.

See also