1. What Verae provides — and what it does not

1.1. The boundary

Verae sells and operates software infrastructure and a timestamping service. Customers use that infrastructure to store objects, to send messages, to register hashes, to verify receipts, and to produce an audit trail of what their own systems did.

Verae does not sell a HIPAA certificate. HIPAA is a United States statute (and implementing regulations), not a product seal. A covered entity or business associate becomes “HIPAA compliant” only in the ordinary-language sense that it has performed a risk analysis, implemented the Security Rule’s required and addressable controls as reasonable and appropriate, executed Business Associate Agreements where required, trained its workforce, and can respond to OCR. No software vendor can substitute for that work.

Verae does not sell a SOC 2 report covering the customer’s organization. SOC 2 is an attestation by a licensed CPA firm against the AICPA Trust Services Criteria, for a named entity, over a named period, with a named system description. The customer’s auditor must still walk the customer’s controls.

Verae does not sell an ISO 27001 certificate covering the customer’s organization. ISO 27001 is a management-system standard. A registrar certifies that a named organization operates an Information Security Management System (ISMS) over a named scope. Installing a DataCube does not create an ISMS.

1.2. The tools

Within that boundary, the Verae DataCube Solution is built to make the technical work of those programs less painful. Concretely, it gives the organization the ability to:

Store. Digital objects — messages, images, documents, logs, model prompts, model outputs, attachments — can be written into an encrypted DataCube. The cube is a customer-controlled container. Verae is designed so that the contents stay in the customer’s storage. What leaves the customer’s perimeter for sealing is a fingerprint (a cryptographic hash), not the object.

Communicate. Endpoints exchange messages with point-to-point encryption. The body is unreadable to the router. Destination and subject remain visible because a network that cannot see a destination cannot route.

Timestamp. The first time a hash is registered, Verae records that registration against a time and a sequence. Later, anyone with the receipt and the object (or the object hash) can check that the object existed, in that exact bit pattern, no later than that time.

Verify. Verification does not require trusting Verae’s word, the customer’s archive administrator, or a hosting vendor. It requires recomputing a hash, checking a receipt, and — for stored objects — checking IPFS content identifiers. A regulator can be handed proof rather than a vendor assurance letter.

Audit. Admin history, inspect events, and message-handling summaries are written so that an examiner can see that an action occurred, who authorized it, and which object it touched, without the log itself becoming a second copy of the sensitive payload.

1.3. What the organization must still do

Those five verbs — store, communicate, timestamp, verify, audit — are the technical portion. The rest of a certification or attestation program is organizational:

Policies. Acceptable use, encryption, key custody, access control, retention, legal hold, incident response, vendor management, change management, and (where HIPAA applies) a sanctions policy and a named Privacy Officer and Security Officer.

Procedures. How a new hire is provisioned, how a leaver is deprovisioned, how a restore is tested, how a key is rotated, how a legal hold is placed on a cube, how an inspector is authorized under k-of-n, how a SOC evidence request is answered.

Internal controls. Dual control on inspect. Separation of the author of a change from the officers who approve it. Signed configuration so an unsigned file is rejected. Log-before-reveal so an inspect cannot happen in the dark. Hash-registry “first write wins” so a later rewrite cannot pretend to be the original.

Independent examination. A CPA firm (SOC 2), a registrar (ISO 27001), OCR or a HIPAA assessor, FINRA or SEC examination staff, or an internal audit function that is actually independent. They will ask for evidence that the controls ran during the period, not that a vendor has a nice architecture diagram.

1.4. Why the distinction matters in an exam

Examiners are trained to notice category errors. If a firm says “we are SOC 2 because our storage vendor was pentested in Berlin,” the next hour of the meeting is spent unwinding that claim. If a firm says “we use a component that was independently evaluated in the EU; here is the public report, labeled as a component evaluation; here is our system description, our key-custody procedure, our restore test from last quarter, and our Type II report,” the meeting can proceed.

This chapter exists so that nobody using this briefing makes the first speech. Verae provides tools, background, and software infrastructure. The organization provides the program. The auditor provides the opinion. Those three roles do not collapse into one product SKU.