Rewrite audit-ready briefing: software is not a certificate.

Open with an executive summary that HIPAA, SOC 2, and ISO 27001
are organizational programs. Verae DataCubes supply store,
communicate, timestamp, verify, and audit tools for the technical
portion only. Chapters cover transit (HPKE, visible routing), rest
(IPFS/Peergos hash-verified restore), receipts, EU Peergos
evaluations (Cure53 2019, ROS 2024), cross-blockchain timestamping,
and write-once Iceberg archive. PDF is branded with the Verae logo
top-left and Verae Inc contact in the footer; last chapters are
sourced bios for Garfinkel (FINRA CRD 5052743), Haber, and Lambert.

README.md

@@ -1,62 +1,46 @@
 # Making yourself audit-ready with Verae DataCubes
 
-How to **prepare an organization** for HIPAA-aligned, SOC 2, or ISO 27001
-work using Verae DataCubes on **Peergos** (encrypted cryptree + hashed
-IPFS) and HPKE on an **untrusted NATS** broker.
+**Software alone does not make an organization HIPAA certified,
+SOC 2 attested, or ISO 27001 certified.**
 
-**This repository is not a HIPAA, SOC 2, or ISO certificate.**  
-Peergos’s public pentests are **not** your Type II or ISO registrar
-certificate. They are **component security evaluations** you can attach.
+The Verae DataCube Solution gives you tools to **store**,
+**communicate**, **timestamp**, **verify**, and **audit**. To
+obtain those certifications and attestations, the organization
+still has to write **policies**, run **procedures**, operate
+**internal controls**, and sit with an **independent auditor**.
+Verae provides the tools, the background, and the software
+infrastructure for the **technical portion** of that work.
 
-## What we verified about Peergos (EU)
+A Verae DataCube Server Solution provides secure communications
+and storage for **data in transit** and **data at rest**:
+point-to-point encryption (routing remains visible), IPFS
+content-addressed encryption at rest with Peergos hash
+verification, global timestamped receipts, and a write-once
+Iceberg archive.
 
-Full sources: [`PEERGOS-VERIFICATION.md`](PEERGOS-VERIFICATION.md).
+Peergos was independently evaluated **twice in Europe** (Cure53,
+Berlin, 2019; Radically Open Security, Amsterdam, 2024). Those
+reports are public component evaluations. They are **not** a
+HIPAA, SOC 2, or ISO certificate.
 
-| Fact | Verified? |
-|---|---|
-| Encrypted client-side filesystem (cryptree); keys not on the storage server | Yes — Peergos book + Cure53 design review |
-| IPFS blocks content-addressed; Peergos verifies hashes (tamper-evident restore) | Yes — [trust-free layers](https://book.peergos.org/security/trust.html) |
-| Independent **EU** security audits, reports published | **Yes — two:** Cure53 **Berlin** (2019); Radically Open Security **Amsterdam** (2024, NLnet; EU Horizon 2020 NGI-POINTER mentioned on the post) |
-| “Peergos is HIPAA/SOC 2/ISO certified” | **No.** Those audits are pentest/code/design reviews, not management-system certificates |
+## Document
 
-So: Peergos **was designed as a trust-minimized encrypted filesystem**,
-**evaluated in Europe** by two specialist firms, with **public reports**.
-That supports the **at-rest / backup** story. It does **not** finish
-*your* audit.
-
-## Architecture (audit interview in one page)
+Sphinx sources in `source/`. Each chapter starts on a new page
+in the PDF. The Verae wordmark is at the top left of every page;
+Verae Inc contact is in the footer. Last chapters are
+biographies of James H. Garfinkel (FINRA CRD 5052743), Stuart
+Haber, and George Lambert.
 
 ```
-Endpoint (keys stay here / HSM)
-    │  HPKE content (NPE suite)
-    │  routing: dest + subject in the clear
-    ▼
-Untrusted NATS (cannot read bodies)
-    │
-    ▼
-Verae DataCube chain (append-only hashes)
-    │  written through Peergos client
-    ▼
-Peergos cryptree (encrypted names, sizes, graph)
-    │  chunks → CID / hash
-    ▼
-IPFS  (distributed, hash-verified ciphertext)
+make html
+make latexpdf
 ```
 
-- **At rest:** Peergos cryptree + IPFS. Hosts with disk/backup see
-  **opaque hashed ciphertext**, not PHI, if they lack keys.
-- **In transit (NATS):** HPKE-Base to directory public keys. Broker is
-  honest-but-curious: destinations yes, bodies no.
-- **Integrity:** cube JSONL chain + dual hash + IPFS CID check on
-  restore (re-fetch blocks, re-verify hashes — not a plaintext tape).
+* HTML: `build/html/index.html`
+* PDF: `build/latex/peergos-making-yourself-audit-ready-with-verae-datacubes.pdf`
+* Published: https://docs.pfc.georgelambert.org/audit-ready/
 
-## BAAs / DPAs
-
-Ciphertext-without-keys **narrows** who is a Business Associate or
-GDPR processor for **content**. It does **not** automatically delete
-contracts for VMs, usernames, or logs. See [`BAA-DPA.md`](BAA-DPA.md).
-
-## Pack
+## Pack (Markdown companions)
 
 | File | Use |
 |---|---|
@@ -66,23 +50,6 @@ contracts for VMs, usernames, or logs. See [`BAA-DPA.md`](BAA-DPA.md).
 | `HOWTO.md` | How to hand this to an auditor |
 | `MODULE.md` | Callers / non-runtime |
 
-Live technical surfaces (ns1): https://pfc.georgelambert.org/health ·
-https://pfc.georgelambert.org/v1/npe/keys ·
-https://docs.pfc.georgelambert.org/controls.html
+## Related
 
-Related: https://git.georgelambert.org/marchon/system-git-sync
-
-## Sphinx (HTML + LaTeX PDF)
-
-Sources live in ``source/`` (Sphinx). Build:
-
-```
-make html
-make latexpdf
-```
-
-* HTML: ``build/html/index.html``
-* PDF: ``build/latex/peergos-making-yourself-audit-ready-with-verae-datacubes.pdf``
-
-LaTeX companion links are **relative PDFs** (not Markdown). Live HTML:
-https://docs.pfc.georgelambert.org/audit-ready/
+https://www.verae.com · https://git.georgelambert.org/marchon/system-git-sync