All that is needed to host a TRM registry is a server that is capable of exposing the needed REST APIs.
The actual implementation of the REST APIs is up to the maintainer of the registry.
The owner of the private registry is the only one accountable for any of the safety concerns that come with hosting a server.
The owner of the private registry is the only one accountable for the material shared within the registry.