We have some confidential data for our research. Currently, we use an encrypted hard drive for storing the data and any researcher using the data takes it off the drive.
However, we do not have any way of knowing where the data copies exist at a certain point in time and it is generally up to the researchers to manage their own copies. Also, the external hard drive needs to be locked up and may or may not be available when needed because someone took it or the person managing it was out of office or whatever.
EDITED FOR CLARITY: I'm looking for a way to have the data shared with the section on a local area network (even in un-encrypted form) with the caveat that the user's have to log into the file server using their institution emails. Once they download a file, it is logged somewhere that person x took a copy of the file y.
Once they have taken the copy, we don't police them about it. It is more self reporting where once they've used the file and deleted it, they log back in and sign off somewhere that they deleted the copy. Once in a while we (or the server) look up if any files have not been reported back and email the person to confirm if they have in fact deleted their copy.
I should re-iterate that this is not a matter of trust but more a check-in / check-out thing.
I know I can probably do this by having a web server hosted on the machine having the files and user's have to log in to get access to the web page that can then track which files they take but I have a gut feeling that there must be a more elegant way of doing this than files over HTTP and that there should probably be something out there that does something similar already.
Also, any thoughts on reliability? Can I have data backed up automatically or synced without using a cloud service that may potentially have leaks (or a private cloud service that is reasonably secure and recommended for this application).
Apologies if this sounds naive. Security isn't my strong point.