Making yourself audit-ready with Verae DataCubes

This volume is a technical briefing. It is not a certificate.

The table of contents below is the document map. In the PDF edition, each chapter starts on a new page and the contents list includes section titles with page numbers. In HTML, each chapter is its own page with the Verae wordmark in the sidebar and Verae Inc contact information in the footer.

Contents

• 1. Executive summary
  • 1.1. What a Verae DataCube Server Solution does
  • 1.2. Data in transit
  • 1.3. Data at rest
  • 1.4. Global timestamped receipts
  • 1.5. Peergos, evaluated in Europe
  • 1.6. Verae global timestamping
  • 1.7. Write-once Iceberg archive
  • 1.8. What this briefing is, and is not
• 2. What Verae provides — and what it does not
  • 2.1. The boundary
  • 2.2. The tools
  • 2.3. What the organization must still do
  • 2.4. Why the distinction matters in an exam
• 3. The Verae DataCube Server Solution
  • 3.1. Purpose
  • 3.2. The DataCube as a container
  • 3.3. Two information states, one operational picture
  • 3.4. What “server” means in practice
  • 3.5. What the server solution is not
• 4. Secure communications — data in transit
  • 4.1. The problem
  • 4.2. Point-to-point encryption
  • 4.3. Visible routing
  • 4.4. Error handling without leaking content
  • 4.5. The public-key directory
  • 4.6. What this does, and does not, satisfy
• 5. Encryption at rest — IPFS blocks and Peergos
  • 5.1. The problem
  • 5.2. Content-addressed blocks
  • 5.3. Peergos on top of IPFS
  • 5.4. Tamper-evident restore
  • 5.5. Append-only at the cube layer
  • 5.6. What a disk operator sees
  • 5.7. What this does, and does not, satisfy
• 6. Global timestamped receipts
  • 6.1. Why hashes are not enough by themselves
  • 6.2. What a Verae receipt is
  • 6.3. What is registered, and what is not
  • 6.4. First registration wins
  • 6.5. Sequence
  • 6.6. Bundles
  • 6.7. What a receipt does not prove
• 7. Peergos security evaluations in Europe
  • 7.1. What was evaluated
  • 7.2. 2019 — Cure53, Berlin, Germany
  • 7.3. 2024 — Radically Open Security B.V., Amsterdam
  • 7.4. How to present these reports to an auditor
  • 7.5. Hosted Peergos versus self-hosted DataCubes
  • 7.6. What “designed under funding from Cure53 / ROS” is not
• 8. Verae global timestamping — a cross-blockchain receipt
  • 8.1. Lineage
  • 8.2. What “cross-blockchain” means here
  • 8.3. Two deployment patterns
  • 8.4. The digital bundle
  • 8.5. Proof of existence versus proof of custody
  • 8.6. What this does, and does not, satisfy
• 9. Write-once Iceberg archive
  • 9.1. The deletion problem
  • 9.2. What “write-once Iceberg” means in this solution
  • 9.3. How cubes move into the archive
  • 9.4. Relation to classical WORM
  • 9.5. What this does, and does not, satisfy
• 10. Architecture for an audit interview
  • 10.1. The picture
  • 10.2. Walkthrough, in the order an examiner usually asks
  • 10.3. Identity planes
  • 10.4. NATS remains untrusted
  • 10.5. What to hand the examiner
• 11. BAAs, DPAs, and ciphertext without host keys
  • 11.1. The technical fact
  • 11.2. HIPAA — Business Associate
  • 11.3. GDPR — processor versus technical measure
  • 11.4. NATS operators
  • 11.5. Verae as timestamping service
  • 11.6. Component assurance versus the organization’s report
• 12. Audit-ready checklist
  • 12.1. A. Scope and honesty
  • 12.2. B. Data in transit
  • 12.3. C. Data at rest
  • 12.4. D. Timestamping
  • 12.5. E. Write-once archive
  • 12.6. F. Access and change
  • 12.7. G. Contracts (counsel)
  • 12.8. H. Independent examination of this organization
• 13. How to use this briefing
• 14. James H. Garfinkel
  • 14.1. Name and sources
  • 14.2. Role at Verae
  • 14.3. FINRA BrokerCheck (CRD 5052743)
  • 14.4. Education (public professional listings)
  • 14.5. Why this biography is in the briefing
• 15. Stuart Haber
  • 15.1. Role at Verae
  • 15.2. The scientific work
  • 15.3. Surety, 1994: first commercial blockchain
  • 15.4. Other cryptographic publications
  • 15.5. Why this biography is in the briefing
• 16. George Lambert
  • 16.1. Role
  • 16.2. Internet technical architect, from 1994
  • 16.3. New Hampshire public office
  • 16.4. Why this biography is in the briefing
• 17. Verae Inc — contact
  • 17.1. Closing reminder