Rewrite audit-ready briefing: software is not a certificate.

Open with an executive summary that HIPAA, SOC 2, and ISO 27001 are organizational programs. Verae DataCubes supply store, communicate, timestamp, verify, and audit tools for the technical portion only. Chapters cover transit (HPKE, visible routing), rest (IPFS/Peergos hash-verified restore), receipts, EU Peergos evaluations (Cure53 2019, ROS 2024), cross-blockchain timestamping, and write-once Iceberg archive. PDF is branded with the Verae logo top-left and Verae Inc contact in the footer; last chapters are sourced bios for Garfinkel (FINRA CRD 5052743), Haber, and Lambert.
2026-09-16 00:55:21 -04:00 · 2026-09-16 00:55:21 -04:00 · 4fcbb9ac95
commit 4fcbb9ac95
parent da60402e88
53 changed files with 6323 additions and 814 deletions
--- a/build/html/architecture.html
+++ b/build/html/architecture.html
@ -5,17 +5,19 @@
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />

-    <title>Architecture (audit interview) &#8212; Making yourself audit-ready with Verae DataCubes</title>
+    <title>10. Architecture for an audit interview &#8212; Making yourself audit-ready with Verae DataCubes</title>
    <link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
    <link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
-    <link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=27fed22d" />
-    <script src="_static/documentation_options.js?v=5929fcd5"></script>
+    <link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
+    <link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
+    <script src="_static/documentation_options.js?v=250a654d"></script>
    <script src="_static/doctools.js?v=fd6eb6e6"></script>
    <script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
+    <link rel="icon" href="_static/VeraeFullLogo.png"/>
    <link rel="index" title="Index" href="genindex.html" />
    <link rel="search" title="Search" href="search.html" />
-    <link rel="next" title="BAAs and DPAs when ciphertext has no host keys" href="baa-dpa.html" />
-    <link rel="prev" title="Peergos verification (what was actually audited)" href="verification.html" />
+    <link rel="next" title="11. BAAs, DPAs, and ciphertext without host keys" href="baa-dpa.html" />
+    <link rel="prev" title="9. Write-once Iceberg archive" href="iceberg-archive.html" />
   
  <link rel="stylesheet" href="_static/custom.css" type="text/css" />
  
@ -24,58 +26,24 @@
  

  </head><body>
-  
-
-    <div class="document">
-      <div class="documentwrapper">
-        <div class="bodywrapper">
-          
-
-          <div class="body" role="main">
-            
-  <section id="architecture-audit-interview">
-<h1>Architecture (audit interview)<a class="headerlink" href="#architecture-audit-interview" title="Link to this heading">¶</a></h1>
-<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>Endpoint (keys stay here / HSM)
-    │  HPKE content (NPE suite)
-    │  routing: dest + subject in the clear
-    ▼
-Untrusted NATS (cannot read bodies)
-    │
-    ▼
-Verae DataCube chain (append-only hashes)
-    │  written through Peergos client
-    ▼
-Peergos cryptree (encrypted names, sizes, graph)
-    │  chunks → CID / hash
-    ▼
-IPFS  (distributed, hash-verified ciphertext)
-</pre></div>
-</div>
-<ul class="simple">
-<li><p><strong>At rest:</strong> Peergos cryptree + IPFS. Hosts with disk/backup see
-<strong>opaque hashed ciphertext</strong>, not PHI, if they lack keys.</p></li>
-<li><p><strong>In transit (NATS):</strong> HPKE-Base to directory public keys. Broker is
-honest-but-curious: destinations yes, bodies no.</p></li>
-<li><p><strong>Integrity:</strong> cube JSONL chain + dual hash + IPFS CID check on
-restore (re-fetch blocks, re-verify hashes — not a plaintext tape).</p></li>
-</ul>
-<p>NATS remains an untrusted router. Production E2E is NPE/HPKE.
-Passthrough means destination in the clear; the body is ciphertext.</p>
-<p>Live: <a class="reference external" href="https://pfc.georgelambert.org/v1/npe/keys">https://pfc.georgelambert.org/v1/npe/keys</a> (public keys only).
-Controls: <a class="reference external" href="https://docs.pfc.georgelambert.org/controls.html">https://docs.pfc.georgelambert.org/controls.html</a></p>
-</section>
-
-
-          </div>
-          
-        </div>
-      </div>
+  <div class="document">
+    
      <div class="sphinxsidebar" role="navigation" aria-label="Main">
        <div class="sphinxsidebarwrapper">
-<h1 class="logo"><a href="index.html">Making yourself audit-ready with Verae DataCubes</a></h1>
+            <p class="logo"><a href="index.html">
+              <img class="logo" src="_static/VeraeFullLogo.png" alt="Logo of Making yourself audit-ready with Verae DataCubes"/>
+            </a></p>
+<p class="logo">
+  <a href="index.html">
+    <img class="logo" src="_static/VeraeFullLogo.png" alt="Logo" />
+    
+  </a>
+</p>



+<p class="blurb">Tools for storage, communications, timestamping, verification, and audit — not a certificate.</p>
+



@ -91,20 +59,40 @@ Controls: <a class="reference external" href="https://docs.pfc.georgelambert.org
    </div>
 </search>
 <script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
+<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
 <ul class="current">
-<li class="toctree-l1"><a class="reference internal" href="verification.html">Peergos verification (what was actually audited)</a></li>
-<li class="toctree-l1 current"><a class="current reference internal" href="#">Architecture (audit interview)</a></li>
-<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">BAAs and DPAs when ciphertext has no host keys</a></li>
-<li class="toctree-l1"><a class="reference internal" href="checklist.html">Audit-ready checklist</a></li>
-<li class="toctree-l1"><a class="reference internal" href="howto.html">How to use this pack</a></li>
+<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
+<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
+<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
+<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
+<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
+<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
+<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
+<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
+<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">10. Architecture for an audit interview</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="#the-picture">10.1. The picture</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#walkthrough-in-the-order-an-examiner-usually-asks">10.2. Walkthrough, in the order an examiner usually asks</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#identity-planes">10.3. Identity planes</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#nats-remains-untrusted">10.4. NATS remains untrusted</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#what-to-hand-the-examiner">10.5. What to hand the examiner</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
+<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
+<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
+<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
+<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
+<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
+<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
 </ul>

 <div class="relations">
 <h3>Related Topics</h3>
 <ul>
  <li><a href="index.html">Documentation overview</a><ul>
-      <li>Previous: <a href="verification.html" title="previous chapter">Peergos verification (what was actually audited)</a></li>
-      <li>Next: <a href="baa-dpa.html" title="next chapter">BAAs and DPAs when ciphertext has no host keys</a></li>
+      <li>Previous: <a href="iceberg-archive.html" title="previous chapter"><span class="section-number">9. </span>Write-once Iceberg archive</a></li>
+      <li>Next: <a href="baa-dpa.html" title="next chapter"><span class="section-number">11. </span>BAAs, DPAs, and ciphertext without host keys</a></li>
  </ul></li>
 </ul>
 </div>
@ -118,22 +106,137 @@ Controls: <a class="reference external" href="https://docs.pfc.georgelambert.org

        </div>
      </div>
-      <div class="clearer"></div>
-    </div>
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          
+
+          <div class="body" role="main">
+            
+  <section id="architecture-for-an-audit-interview">
+<h1><span class="section-number">10. </span>Architecture for an audit interview<a class="headerlink" href="#architecture-for-an-audit-interview" title="Link to this heading">¶</a></h1>
+<section id="the-picture">
+<h2><span class="section-number">10.1. </span>The picture<a class="headerlink" href="#the-picture" title="Link to this heading">¶</a></h2>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">Endpoint</span> <span class="p">(</span><span class="n">private</span> <span class="n">keys</span> <span class="n">stay</span> <span class="n">here</span> <span class="o">/</span> <span class="n">HSM</span><span class="p">)</span>
+    <span class="o">|</span>  <span class="n">HPKE</span> <span class="n">content</span> <span class="p">(</span><span class="n">point</span><span class="o">-</span><span class="n">to</span><span class="o">-</span><span class="n">point</span><span class="p">)</span>
+    <span class="o">|</span>  <span class="n">routing</span><span class="p">:</span> <span class="n">destination</span> <span class="o">+</span> <span class="n">subject</span> <span class="ow">in</span> <span class="n">the</span> <span class="n">clear</span>
+    <span class="n">v</span>
+<span class="n">Untrusted</span> <span class="n">message</span> <span class="n">fabric</span> <span class="p">(</span><span class="n">honest</span><span class="o">-</span><span class="n">but</span><span class="o">-</span><span class="n">curious</span><span class="p">)</span>
+    <span class="o">|</span>  <span class="n">cannot</span> <span class="n">read</span> <span class="n">bodies</span><span class="p">;</span> <span class="n">can</span> <span class="n">see</span> <span class="n">dest</span> <span class="o">/</span> <span class="n">subject</span> <span class="o">/</span> <span class="n">size</span>
+    <span class="n">v</span>
+<span class="n">Organizational</span> <span class="n">DataCube</span>
+    <span class="o">|</span>  <span class="n">append</span><span class="o">-</span><span class="n">only</span> <span class="n">cube</span> <span class="n">chain</span> <span class="p">(</span><span class="n">prev</span> <span class="o">+</span> <span class="n">new</span> <span class="o">+</span> <span class="n">diff</span><span class="p">)</span>
+    <span class="o">|</span>  <span class="n">private</span> <span class="n">metadata</span><span class="p">,</span> <span class="n">attachments</span><span class="p">,</span> <span class="n">internal</span> <span class="n">chain</span>
+    <span class="n">v</span>
+<span class="n">Peergos</span> <span class="n">cryptree</span>  <span class="p">(</span><span class="n">encrypted</span> <span class="n">names</span><span class="p">,</span> <span class="n">sizes</span><span class="p">,</span> <span class="n">graph</span><span class="p">)</span>
+    <span class="o">|</span>  <span class="n">chunks</span> <span class="o">-&gt;</span> <span class="n">CID</span> <span class="o">/</span> <span class="nb">hash</span><span class="p">,</span> <span class="n">hashes</span> <span class="n">verified</span>
+    <span class="n">v</span>
+<span class="n">IPFS</span>  <span class="p">(</span><span class="n">distributed</span><span class="p">,</span> <span class="n">content</span><span class="o">-</span><span class="n">addressed</span> <span class="n">ciphertext</span><span class="p">)</span>
+    <span class="o">|</span>
+    <span class="o">+--</span> <span class="n">Verae</span> <span class="n">timestamping</span>
+    <span class="o">|</span>      <span class="n">fingerprint</span> <span class="n">only</span> <span class="o">-&gt;</span> <span class="n">receipt</span> <span class="p">(</span><span class="n">time</span> <span class="o">+</span> <span class="n">sequence</span><span class="p">)</span>
+    <span class="o">|</span>      <span class="n">org</span> <span class="n">server</span> <span class="n">linked</span> <span class="n">to</span> <span class="n">central</span> <span class="n">Verae</span><span class="p">,</span> <span class="ow">or</span> <span class="n">direct</span> <span class="n">sync</span>
+    <span class="o">|</span>
+    <span class="o">+--</span> <span class="n">Iceberg</span> <span class="n">write</span><span class="o">-</span><span class="n">once</span> <span class="n">archive</span>
+           <span class="n">snapshot</span> <span class="n">of</span> <span class="n">cube</span> <span class="n">CIDs</span><span class="p">,</span> <span class="ow">not</span> <span class="n">under</span> <span class="n">single</span><span class="o">-</span><span class="n">party</span> <span class="n">delete</span>
+</pre></div>
+</div>
+</section>
+<section id="walkthrough-in-the-order-an-examiner-usually-asks">
+<h2><span class="section-number">10.2. </span>Walkthrough, in the order an examiner usually asks<a class="headerlink" href="#walkthrough-in-the-order-an-examiner-usually-asks" title="Link to this heading">¶</a></h2>
+<p><strong>Where are the keys?</strong> On the endpoint or in the customer’s
+HSM. Not on the storage host. Not in the public-key
+directory (that directory holds public keys only). Not in
+the NATS payload.</p>
+<p><strong>What does the network see?</strong> Destination, subject, size,
+timing. Not the body. Production algorithm is HPKE, not a
+lab construction.</p>
+<p><strong>What does the disk see?</strong> Padded encrypted chunks under
+random labels. Peergos verifies hashes. A restore re-fetches
+CIDs and re-checks them.</p>
+<p><strong>How do you prove when it existed?</strong> A hash is registered
+the first time it is seen. A receipt binds hash, time, and
+sequence. The organizational chain and the central Verae
+chain cross-verify. Verae is not given the object, only the
+fingerprint.</p>
+<p><strong>How do you stop delete?</strong> Live cubes replicate as hashed
+ciphertext. Committed snapshots go to an external Iceberg
+write-once tier that is specified to sit outside any one
+party’s delete control.</p>
+<p><strong>How do you know the software was not quietly reconfigured?</strong>
+Configuration is Ed25519-signed. Unsigned files are
+rejected. Admin-history records previous state, new state,
+and a diff.</p>
+<p><strong>How do you inspect without turning inspect into a leak?</strong>
+k-of-n officers. The author of a change is not an officer
+on that change. Log-before-reveal.</p>
+</section>
+<section id="identity-planes">
+<h2><span class="section-number">10.3. </span>Identity planes<a class="headerlink" href="#identity-planes" title="Link to this heading">¶</a></h2>
+<p>There are two login planes, and they must not be collapsed
+in an interview:</p>
+<ul class="simple">
+<li><p><strong>Drive / Peergos identity</strong> — unwraps cubes. This is
+the cryptographic identity.</p></li>
+<li><p><strong>Console identity</strong> — TOTP (RFC 6238), session cookie,
+admin actions. Google SSO, if present, does <strong>not</strong> unwrap
+cubes.</p></li>
+</ul>
+<p>Mixing those planes is how “we have SSO” becomes “SSO is
+the master key.” It is not.</p>
+</section>
+<section id="nats-remains-untrusted">
+<h2><span class="section-number">10.4. </span>NATS remains untrusted<a class="headerlink" href="#nats-remains-untrusted" title="Link to this heading">¶</a></h2>
+<p>The reference message fabric is NATS. It is an
+honest-but-curious broker. Destinations in the clear are
+<strong>passthrough</strong>, not a bug. Bodies are ciphertext, or the
+message is rejected. Error responses carry codes and lookup
+identifiers, not payloads.</p>
+<p>A public-edge NATS listener, if enabled, is token-gated and
+is not the same socket the internal services use.</p>
+</section>
+<section id="what-to-hand-the-examiner">
+<h2><span class="section-number">10.5. </span>What to hand the examiner<a class="headerlink" href="#what-to-hand-the-examiner" title="Link to this heading">¶</a></h2>
+<ul class="simple">
+<li><p>this document (HTML or PDF);</p></li>
+<li><p>the two public Peergos reports, labeled as component
+evaluations;</p></li>
+<li><p>a data-flow diagram of <em>this</em> instance;</p></li>
+<li><p>the public-key listing (public keys only);</p></li>
+<li><p>a restore-test ticket;</p></li>
+<li><p>an admin-history excerpt for a dated change;</p></li>
+<li><p>the organization’s policies, not Verae’s.</p></li>
+</ul>
+<p>Live technical surfaces (reference instance):</p>
+<ul class="simple">
+<li><p><a class="reference external" href="https://pfc.georgelambert.org/health">https://pfc.georgelambert.org/health</a></p></li>
+<li><p><a class="reference external" href="https://pfc.georgelambert.org/v1/npe/keys">https://pfc.georgelambert.org/v1/npe/keys</a></p></li>
+<li><p><a class="reference external" href="https://docs.pfc.georgelambert.org/controls.html">https://docs.pfc.georgelambert.org/controls.html</a></p></li>
+</ul>
+</section>
+</section>
+
+
+          </div>
+          
+        </div>
+      </div>
+    <div class="clearer"></div>
+  </div>
+<div class="verae-page-footer">
+  <strong>Verae Inc</strong>
+  &middot; <a href="https://www.verae.com">https://www.verae.com</a>
+  &middot; Book a call at <a href="https://www.verae.com">verae.com</a>
+  &middot; <a href="https://app.verae.com">app.verae.com</a>
+</div>
+
    <div class="footer">
-      &#169;2026, Verae.
+      &#169;2026, Verae Inc.
      
-      |
-      Powered by <a href="https://www.sphinx-doc.org/">Sphinx 9.1.0</a>
-      &amp; <a href="https://alabaster.readthedocs.io">Alabaster 1.0.0</a>
-      
-      |
-      <a href="_sources/architecture.rst.txt"
-          rel="nofollow">Page source</a>
    </div>

    

    
+
  </body>
 </html>