Kapseli user guide

On this page you’ll find simple instructions for ordering Kapseli, using it and verifying the anonymity of the results.

Content

How to order Kapseli Instructions for using Kapseli Logging in Kapseli Data transfer and folder structure of Kapseli Exiting the system Software in Kapseli Installing user's own software into Kapseli Transferring own files to Kapseli Using the R program’s CRAN mirror repository Verifying the anonymity of results

How to order Kapseli

Log in to our e-service (asiointi.findata.fi).
From the top menu select “Submit application”
Scroll down and select “Order or update of the Kapseli operating environment or the data storage service” from under Select a new application form from below and click “Fill in the application”.
Complete the application form
- Enter your own name in the applicant field
- After this, using the “Invite a member” button add all the persons and email addresses that need user rights to Kapseli
- The invited persons will join using multi factor authentication
- Complete the rest of the form
- Please note, that R-Tools is not automatically installed in Kapseli. If you need R-Tools, indicate this in the additional information section of the form.
Finally, select Send application from the “Actions” section.

Instructions for using Kapseli

Kapseli’s user interface is very much in line with the desktop of your own computer, but Kapseli’s desktop is at the end of a remote connection. Due to security regulations, there are a few differences in use of Kapseli compared to the use of an ordinary desktop.

There is no internet access from Kapseli. Although the browser is installed, you can only use it locally for example to open documents in the HTML format.
Copying data between the remote desktop and your own computer is blocked.
It’s not allowed to take any photo of Kapseli.
You cannot transfer data, images or other material independently to Kapseli. All data is transferred through Findata’s audits.

The IP address you use with Kapseli must be static, i.e. most often your organization’s IP address. In general, when working remotely, the IP address of your own organization can be accessed via a remote connection, such as a VPN connection.

If there is change in the organization’s connections, ask your organization’s IT support about the entire address space of IP addresses, so that the change does not hinder the use of Kapseli. Kapseli cannot be used via private IP addresses.

Logging in Kapseli

Before logging in make sure your account has been registered and is ready to use. If you’re not sure whether your account is ready to use get in touch with Findata’s contact person.

Install Duo Mobile app (duo.com) to your phone and activate it. The developer is Duo Security Inc. If you’ve already installed and activated the app go to point 2.
- Installing: find Duo Mobile from your phones app store and install it.
- Activating: the phone numbers reported when ordering Kapseli will get an automatic activating message for Duo Mobile. The app is activated by clicking the link in the activating message.
Log in Kapseli at kapseli.findata.fi using your computers browser.
- Choose the identification method from the list that you chose while registering.
Choose the operating environment you’re going to use. If you have just one operating environment in use go to the next section.
- After choosing the environment the system goes to the second phase of identification.
The second phase of identification.
- Log in the operating environment.
- You’ll get a notification about logging in to Duo Mobile. To approve the log in choose ‘Approve’ in Duo Mobile.

Data transfer and folder structure of Kapseli

All software installations and data transfers in Kapseli take place through orders and audits. No data can be independently exported to or imported out of Kapseli.

The data permit specifies the data for which a processing permit has been granted. We collect, link, pre-process and if necessary, pseudonymise or anonymise the data. Additional information needed for use of the data, such as publicly available statistical data, also requires an audit by Findata and a transfer of data to the Kapseli.

We request the materials from the controllers primarily in CSV format and deliver them to Kapseli in CSV format (semicolon as separator, UTF-8 encoding).

Folder structure:

Data (D:)
Backup (E:)
CRAN (N:)
Output (O:)
Work (W:)

You can find the files specified in the data permit in the Data (D:) folder. The Data folder is write-protected. Other information supplied to Kapseli, such as any program codes, will also be moved to the Data folder after an audit.

Use the Work (W:) folder when you process and analyse the data. Copy the files you want to use from the Data folder to the Work folder.

From the Output (O:) folder it’s possible to transfer data to Findata if needed. Discuss about the use of the Output folder with Findata in advance. Do not transfer results via Output folder.

Export the data that you want to back up to the Backup (E:) folder.

The CRAN (N:) folder contains the software packages required for using the R software.

Exiting the system

There are two ways you can exit Kapseli, depending on the situation.

Sign out + Log out (recommended)
- Sign out can be found behind the user icon in the lower‑left corner. Use this option when you have finished processing data and do not need to leave any analyses running.
- When you select Sign out and then Log out, you release the Kapseli resources for other users.
- Note: After selecting Sign out, it may take several minutes before the Log out option becomes available. This is due to the way Windows handles resources, and the duration depends on the processes that are running.
Disconnect is located behind the Power button. Use this option if you need to leave analyses running when you leave the workstation. In this case, the resources remain reserved.

After both options, you will see the options Reconnect and Logout. Select Logout when stopping the use of the system. Close your browser unless you want to log back in.

Software in Kapseli

All new Kapseli packages include the software according to the table below as standard. We will expand the software selection as needed.

We reserve the right to modify the standard software offered. We will notify subscribers of any changes in writing at least one (1) month in advance.

Software will be updated with security‑related updates to all Kapseli packages as necessary.

Software updates are automated in Kapseli

Each Kapseli environment includes only one version of each software. By default, the latest supported version is installed, which may not be the same as the newest version available online.
Software versions are updated automatically in all Kapseli environments once a year or when known security threats are identified.
Older versions can still be used, but maintaining and supporting them will incur additional costs.
Updates are carried out during scheduled maintenance breaks.

If you require access to older versions or have any questions, please contact us at kapseli@findata.fi.

Linux (Ubuntu)

Software	Version	Further information
Chromium
Emacs
Firefox
Gnome System Monitor
Golang
Josm
LibreOffice		Base, Calc, Draw, Impress, Math, Writer
Pigz
Python	3.12	Includes the following packages: tensorflow nltk spacy scikit-learn seaborn plotly bokeh pydot xgboost lightgbm catboost eli5 torch keras gensim scrapy beautifulsoup4 numpy scipy pandas statsmodels matplotlib trio httpx qrcode
R + R studio	4.2.1	Includes CRAN library packages. You can start R from the terminal using the command: start-rdesktop.
VS Code

Windows Server 2016 Standard

Software	Version	Further information
7-Zip	Up to date
Adobe Acrobat Reader DC	Up to date
Anaconda 3	2024.06-1	Uses Python Wheel 3.12
GeoDa	1.22
Git	2.46.1
Google Chrome	Up to date
IBM SPSS Statistics	29	The license is activated upon request.
LibreOffice	Up to date	Base, Calc, Draw, Impress, Math, Writer
LyX	2.4.1.1
MiKTeX	24.1
Notepad++	Up to date
QGIS	3.34.11
R	4.3	Includes CRAN library packages. Please note that R-Tools is not automatically installed in Kapseli. If you need R-Tools, indicate this in the additional information of the subscription form.
RStudio	2024.09.0-375
Stata	19	The license is activated upon request.
WinPython	3.12	If you need more information about the packages, please contact customer service at: kapseli@findata.fi

Installing user’s own software into Kapseli

If the software you need is not included in the table above, it may still be installed in Kapseli provided certain conditions are met. The software can be either open access or licence-based. If a licence is required, you are responsible for obtaining and providing it.

Before installation, Findata assesses the software’s information security and compatibility with the Kapseli environment. However, we cannot test the software or guarantee that it will function as expected in the remote environment.

Requirements for installing your own software

Test the software to ensure it works in Kapseli.
Confirm that the software is either open access or licence-based.
If the software is licence-based, ensure you have a valid licence and clear installation instructions.
Note that Kapseli is not connected to the internet. The software must be installable and usable in a closed environment.
Provide Findata with the necessary information to install and use the software.

Installations is charged based on workload and software maintenance is also subject to a fee. See prices here: Pricing.

Please note that Findata cannot guarantee the functionality of your own software in the Kapseli environment. The installation costs will be charged even if the software cannot be used in Kapseli in the manner intended by the customer.

How to transfer your own files to Kapseli

Kapseli serves as the project workspace throughout data processing. Data is primarily handled within Kapseli, and only finalised analysis results are exported. Analysis code is also typically created within Kapseli.

Existing code or personal files, such as research protocols or variable descriptions, can be imported via Findata. We charge for importing personal files into Kapseli based on the required workload.

See prices here: Pricing.

All files, code, and other content must be transferred via Findata’s secure Tunneli transfer service:

Send a notification to data@findata.fi about your data

Provide in your message the following information:

Data permit journal number
Remote environment Kapseli code
Your Tunneli ID if you already have a Tunneli connection.
- You can find your IDs by doing the following:
  - Log into your Tunneli account.
  - Go to the profile icon on the top right.
  - Choose ‘Settings’.
  - Your ID ends in FINDATA.local.

Order a Tunneli ID

If you already have a Tunneli connection, proceed to the next step.

Before logging in find out what is your organisations public ip address for the network from which the data is transferred. Please consult your organisations IT help in case you’re unsure about the IP address.
- The following addresses are not public and therefore cannot be used for transferring data:
- addresses that start with:
  - 10.
  - 192.168.
- or are between:
  - 172.16.0.0 – 172.31.255.255
  - 224.0. – 239.255
Log into the Findata customer service at asiointi.findata.fi
Under Submit application, select Order of a Tunneli user ID
Complete and submit the form
Notify us at data@findata.fi once the form has been submitted. If additional information is needed for registration, we will contactu you by email.
When you receive confirmation from Findata that the connection has been established, proceed to the next step.

Fill in the Files to be sent to Kapseli form

Fill in the form below and submit it to Findata via Tunneli in the same transfer folder together with the other files. Go to the next step.
If you’re transferring data, submit its data description in the same transfer folder.

Files to be sent to Kapseli form (download Word file, 26 kB)

Encrypt the data and transfer it to Tunneli

Log in to Tunneli transfer service: siirto.findata.fi
- Use the same authentication method as in other Findata’s services.
Verify that the diary number is correct.
- The front page shows a folder with the title of the data permit decision’s diary number.
- Open the folder and check that the diary number in the file journal_number.txt is also correct.
Create a new folder on your computer. Ensure that only individuals authorised to handle the data have access to this folder.
Download the following files from Tunneli to the folder:
- Findata Encryption Tool (found in folder named Encryption Tools or Salaustyökalut in Finnish)
- csc.pub (found in folder named Encryption Tools)
- the journal_number.txt file

To download the file, click the three dots after the file and select ‘Download’.

Compress all the files you want to transfer into a single .zip file and move them to the folder you previously created
- Make sure that the zip file size does not exceed 4 GB
- Include in the .zip file the data descriptions
- Include in the .zip file the data descriptions
- Do not password protect the .zip files
- Make sure the file is in the format specified in the data delivery request
- Make sure that the file name does not contain spaces or special characters (/,? +) [). The following special characters are permitted: dots, hyphens, and underscores (.- _)
Open from the folder the Findata Encryption Tool
Select the file for encryption
- The file you are encrypting is the zip file you created in step 5. Select a file by pressing ‘Select File’ (see image below)

Select ‘Start Encryption’ to begin the encryption process (see image below)

Two new files will have appeared in your folder on the machine:
- one .c4gh file and
- one .json file
Open the folder that matches the project’s journal number in Tunneli
Upload both files you created in step 9 to that Tunneli folder (see image below)

Now, your Tunneli folder should contain three files:
- journal_number.txt
- one .c4gh file
- one .json file
Log out of the system.
Notify data@findata.fi when the data has been transferred.
Once the Findata’s processor has confirmed that your data has been transferred successfully, you must permanently delete all personal data from the extraction folder you created on your computer. Not therefore from the Tunneli folder, but from the folder you created yourself.
Empty the Recycle Bin on your computer in case you’ve delivered personal data.

Using the R program’s CRAN mirror repository

Cran mirror repository can be found at cran.findata.local.

Remove .Renviron -file under your Documents -folder or Project folders (WORK). You
may also edit file and remove following lines:
RSTUDIO_DISABLE_PACKAGES=TRUE
R_LIBS_USER=N:/
Create .Rprofile -file under your Documents -folder with lines below
local({
r <- getOption(“repos”)
r[“CRAN”] <- “https://cran.findata.local/”
options(repos = r)
})
- .Rprofile -file can also copied from D:\ -network drive (DATA).
Restart RStudio.
- You can install R packages with install.packages(“PACKAGE”) -command.
- If you prefer a graphical user interface to install packages, in RStudio you will find it at Tools -> Install Package. After a package is installed, use the library() function to load package.

Verifying of the anonymity of results

All those who process personal data must provide the results of their analyses in an anonymous form that cannot be used to reveal any data or aspects concerning individual participants following the instructions given by Findata. According to the Act on the Secondary Use of Health and Social Data, Findata must ensure anonymity. This applies to all materials that have been authorised under said Act.

Anonymisation refers to a process in which the material is processed in a way that

it cannot be used to identify any individual persons either directly or indirectly
it cannot be used to make any conclusions concerning a specific individual person
any information concerning a specific person cannot be linked to any other material

Publishing results from Kapseli

The data is processed within the Kapseli environment, and only the final analysis results are published. The permit holder produces the results in an anonymous format, and Findata ensures compliance with the Secondary Use Act by verifying the anonymity.

All results produced in Kapseli must be exported from the environment using the Portti output tool.
Portti is intended solely for submitting anonymous results for verification. It must never be used to transfer personal data or any other non-anonymous information.
Instructions for producing anonymous results can be found on Findata’s website: https://findata.fi/en/services-and-instructions/producing-anonymous-results/

How to publish results from Kapseli

Open Portti.
- The Portti output tool is available on the Kapseli desktop.
Select language.
- Click ”EN” in the top right corner.
Create a new transfer.
- Click “New submission” in the top left.
Select the files to transfer.
- Click “Choose Files” and choose the file or zip folder containing the results.
- Only one file can be submitted at a time. If you want to transfer multiple files, compress them into a single zip folder.
- Make sure that there have not left data hidden behind the result files (etc. metadata).
- Make sure that the file/zip name does not contain spaces or special characters (/,? +) [). The following special characters are permitted: dots, hyphens, and underscores (.- _)
- The maximum size for one transfer is 20 MB.
Fill in the required information.
- Complete the requested information in the “Results to be submitted” and “Summary” sections.
- Select the result type(s) that best describe your results. The transfer will not proceed without this selection. You may choose multiple options.
Submit the results.
- Click “Submit.” The results will be sent to Findata for anonymity verification.

Processing transfers and approving results

Schedule and communication
- Findata processes the results within five business days of submission.
- You can track the status of your transfers in the “My submissions” view in Portti.
- Findata sends messages from the address: portti@csc.fi.
- When you reply to the email, your message is automatically directed to data@findata.fi, where Findata staff will read it.
If anonymity needs to be reconsidered
- You will receive an email detailing the required changes.
- Make the corrections as instructed and submit a new transfer via Portti.
Approval of results
- Once the results are approved, they will be transferred to the submitter’s personal Tunneli (formerly Nextcloud). You will receive an automatic email notification.
- Results are automatically deleted from Tunneli 6 months after the transfer, so remember to save them to your own device in time.
If additional information on anonymity is needed
- Findata may request more information about the anonymity of the results before final approval.
- After the email exchange, you will receive an official notification of either approval or rejection of the results’ anonymity.

Please note that if your result files are very large, the verification process may exceed the usual 5-day time limit.

Transferring data from Kapseli

Data cannot be transferred outside the secure processing environment. If the secure processing environment will be switched or data are needed for data extraction, permit holder can transfer data to Findata through the Output drive in Kapseli. Discuss about the transfer and ask for more information from Findata before transferring data.