7. Peergos security evaluations in Europe

7.1. What was evaluated

The offline storage and replication system used with Verae DataCubes is Peergos: an encrypted, peer-to-peer filesystem whose blocks live on IPFS. Peergos was designed as a trust-minimized store — the server is treated as an adversary for content and for most metadata — and that design was submitted to independent European security firms twice.

Those engagements are security evaluations of the Peergos protocol and implementation. They are pentests, source-code audits, and (in 2019) a cryptographic and design review. They are not:

• a HIPAA certification of Peergos, Verae, or any customer;

• a SOC 2 Type I or Type II report;

• an ISO 27001 certificate of an ISMS;

• a government “certified filesystem” designation.

Both firms are EU-based. Both full reports are public. That combination — independent, European, public, repeat — is unusual and is worth attaching to a vendor-assurance file, labeled correctly.

7.2. 2019 — Cure53, Berlin, Germany

• Firm: Cure53

• Location: Berlin, Germany

• When: May–June 2019

• Scope: pentest, source-code audit, and crypto / design review

• Outcome: no fundamental architectural or cryptographic problems were identified. Issues that were identified were fixed. Cure53 stated that the platform passed this evaluation.

A crypto/design review is a stronger statement than a black-box pentest of a web form. It is an expert reading of whether the cryptree, the chunk encryption, the identity model, and the threat model hang together. “Passed” in Cure53’s language is not an ISO mark. It is a specialist firm saying: we looked at the cryptography and the architecture, we did not find a fatal flaw, and the issues we did find were addressed.

Primary sources (public):

• https://peergos.org/posts/security-audit

• https://cure53.de/pentest-report_peergos.pdf

• https://github.com/Peergos/Peergos/tree/master/audits

7.3. 2024 — Radically Open Security B.V., Amsterdam

• Firm: Radically Open Security B.V.

• Location: Amsterdam, Netherlands

• When: September–November 2024

• Scope: crystal-box pentest plus code audit of the Peergos web UI

• Funding context: the 2024 audit post states support from NLnet (Netherlands) and refers to European Union Horizon 2020 NGI-POINTER, grant 871528.

• Outcome: 0 findings rated extreme, high, or elevated; 2 moderate; 6 low. Peergos states that all were fixed. There was no data exposure and no integrity compromise. The issues were described as mostly UI crashes.

A crystal-box (clear-box) engagement means the testers had source. A web-UI scope is narrower than the 2019 crypto/design review: it is evidence about the interface that humans actually click, which is where many “encrypted backend” products fail in practice. Zero high-severity findings, no data exposure, no integrity compromise, and a public report are the facts. They are good facts. They are still not a customer’s Type II.

Primary sources (public):

• https://peergos.org/posts/security-audit-2024

• https://github.com/Peergos/Peergos/tree/master/audits

7.4. How to present these reports to an auditor

Correct:

“Our at-rest layer is Peergos. Peergos was independently evaluated in Berlin in 2019 (crypto and design) and in Amsterdam in 2024 (web UI, crystal box). Both reports are public. We attach them as component security evaluations. They are not our SOC 2, not our ISO 27001, and not a HIPAA certification. Our own controls, our own period of examination, and our own auditor are separate.”

Incorrect:

“We are HIPAA certified because Peergos was audited in Europe.”

“Peergos is ISO 27001.”

“The EU certified this filesystem.”

EU funding is not a certification. NGI-POINTER grant 871528 is a research-and-innovation funding fact. It is worth listing under “provenance.” It is not a registrar’s mark.

7.5. Hosted Peergos versus self-hosted DataCubes

Peergos’s hosted privacy notice has stated that peergos.net uses servers in Germany. A self-hosted organizational DataCube is a different processing location. The customer’s Record of Processing, BAA pack, and ISO scope must name that location — the customer’s ns1, region, or chosen host — not peergos.net’s Germany, unless the customer actually uses peergos.net.

The evaluations still apply to the protocol and implementation. Location of processing is an organizational fact on top.

7.6. What “designed under funding from Cure53 / ROS” is not

The 2019 Cure53 work and the 2024 ROS work are evaluations of a system that was designed by the Peergos authors. They are not a claim that Cure53 or Radically Open Security designed Peergos. The accurate statement is: the storage and replication system was independently audited twice in Europe, by Cure53 in Berlin (2019) and by Radically Open Security in Amsterdam (2024), with public reports, and the 2019 work included a cryptographic and design review of the architecture that Verae DataCubes rely on for data at rest.