1. Executive summary

Software alone does not make an organization HIPAA certified, SOC 2 attested, or ISO 27001 certified.

That sentence is the point of this document. It is also the sentence that is most often skipped when a vendor, an integrator, or an internal champion shows encryption, hashing, or a pentest PDF and treats the conversation as finished. It is not finished. Encryption is a control. A pentest is an evaluation of a component. A certificate, an attestation, or a covered-entity determination is a statement about an organization — its legal entity, its people, its written policies, its operating procedures, its internal controls, the evidence those controls produce, and the independent party that examined that evidence.

The Verae DataCube Solution gives an organization tools to store, communicate, timestamp, verify, and audit for compliance. Those tools are real, they are specific, and they are described in the chapters that follow. They are still only tools. To obtain HIPAA-aligned status as a covered entity or business associate with a defensible program, a SOC 2 Type I or Type II report, or an ISO 27001 certificate, the organization must still:

  • write and live by policies (what the organization says it will do);

  • operate procedures (how staff actually do it, every day);

  • design and test internal controls (the checks that catch failure);

  • retain evidence (logs, tickets, screenshots, signed approvals, restore tests, training records);

  • engage an independent auditor, CPA firm, or ISO registrar, as the chosen program requires.

Verae cannot issue those certificates. Verae cannot sit in the organization’s chair during an OCR investigation, a SOC 2 fieldwork week, or an ISO Stage 2 audit. What Verae can do — and what this briefing is written to make precise — is provide the tools, the background, and the software infrastructure that make it easier to implement the technical portion of those programs.

1.1. What a Verae DataCube Server Solution does

A Verae DataCube Server Solution provides secure communications and storage for two classical information-security states:

  • Data in transit — messages, objects, and control traffic while they move from one endpoint to another.

  • Data at rest — messages, objects, metadata, and receipts while they sit on disk, in a replica, or in an archive.

Those two states are not the same problem, and they are not solved by the same mechanism. This document treats them separately on purpose.

1.2. Data in transit

Verae uses best-in-class encryption for messaging from point to point. The content of a message is sealed so that only the intended endpoints can open it. Routing, however, must remain visible: a message that cannot be addressed cannot be delivered. Subjects, destination handles, and size or timing metadata are therefore visible to the transport. The transport is treated as honest-but-curious. It can drop, delay, or copy ciphertext. It cannot read the body if it does not hold endpoint private keys.

1.3. Data at rest

Encryption at rest is performed through IPFS content-addressed blocks. Each block is named by its hash. Peergos verifies those hashes on read and on write. A restore is therefore tamper-evident: if a block was altered, its hash no longer matches, and the client refuses it. This is not a plaintext tape backup. It is a re-fetch of hashed ciphertext plus a verification that the bits are the bits that were stored.

1.4. Global timestamped receipts

Independently of who stores the bytes, Verae issues global timestamped receipts based on document hashes. A receipt is proof of the time and sequence of the first registration of a block of digital information — a message, an image, a document, or any other digital object that can be stored in digital media. The receipt does not require Verae to see the object. It requires a fingerprint of the object, registered at a time that can later be shown to third parties.

1.5. Peergos, evaluated in Europe

The offline storage and replication system used with Peergos was audited twice in Europe, and the protocol was designed under work that was independently reviewed:

  • 2019 — Cure53, Berlin, Germany. Pentest, source-code audit, and crypto/design review (May–June 2019). No fundamental architectural or cryptographic problems. Issues found were fixed. Cure53 stated that the platform passed this evaluation.

  • 2024 — Radically Open Security B.V., Amsterdam, Netherlands. Crystal-box pentest plus code audit of the Peergos web UI (September–November 2024). Zero findings rated extreme, high, or elevated; two moderate; six low. Peergos states all were fixed. No data exposure and no integrity compromise (the issues were mostly UI crashes).

Both firms are EU-based. Both full reports are public. That is a security evaluation of the Peergos protocol and implementation. It is not a HIPAA certificate, a SOC 2 report, or an ISO 27001 certificate for Peergos, for Verae, or for any customer.

1.6. Verae global timestamping

The Verae Global Timestamping and receipt solution is a cross-blockchain design. It certifies the time and date stamp of a digital object and stores that information in a digital bundle that can carry private metadata, attached files, and an internal blockchain. That organizational chain is cross-verified either:

  • from an organizational server linked to the central Verae server, or

  • by directly syncing with Verae’s central timestamping server.

The result is proof of existence of a digital object at a specific time and date. When the organization wants the object itself stored — not only its fingerprint — the object can live inside an encrypted Peergos DataCube.

1.7. Write-once Iceberg archive

Those DataCubes are archived into a write-once external Iceberg file-storage solution for compliance reasons. The archive is designed to sit outside the deletion control of any single party. That is a retention and legal-hold property, not a marketing slogan: once a cube is committed to the write-once tier, neither the customer operator, nor Verae, nor a hosting vendor should be able to quietly erase it.

1.8. What this briefing is, and is not

This briefing describes the technical portion of a compliance program that an organization can build with Verae DataCubes. It indexes each of the points above as its own chapter, in enough detail that a CISO, a CCO, outside counsel, or an auditor can distinguish:

  • what the software does;

  • what the independent Peergos evaluations actually said;

  • what Verae timestamping actually proves;

  • what the organization must still write, operate, and have examined.

It does not claim that installing this software finishes HIPAA, SOC 2, or ISO 27001. Anyone who says otherwise is not describing this or any other product honestly. Those certifications require organizational policies and external auditing. This document is designed to clarify information about much of that process from software to organizational planning.