Rewrite audit-ready briefing: software is not a certificate.
Some checks are pending
ci / markdown (push) Waiting to run
Some checks are pending
ci / markdown (push) Waiting to run
Open with an executive summary that HIPAA, SOC 2, and ISO 27001 are organizational programs. Verae DataCubes supply store, communicate, timestamp, verify, and audit tools for the technical portion only. Chapters cover transit (HPKE, visible routing), rest (IPFS/Peergos hash-verified restore), receipts, EU Peergos evaluations (Cure53 2019, ROS 2024), cross-blockchain timestamping, and write-once Iceberg archive. PDF is branded with the Verae logo top-left and Verae Inc contact in the footer; last chapters are sourced bios for Garfinkel (FINRA CRD 5052743), Haber, and Lambert.
This commit is contained in:
parent
da60402e88
commit
4fcbb9ac95
53 changed files with 6323 additions and 814 deletions
|
|
@ -5,17 +5,19 @@
|
|||
<meta charset="utf-8" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
|
||||
|
||||
<title>BAAs and DPAs when ciphertext has no host keys — Making yourself audit-ready with Verae DataCubes</title>
|
||||
<title>11. BAAs, DPAs, and ciphertext without host keys — Making yourself audit-ready with Verae DataCubes</title>
|
||||
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
|
||||
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
|
||||
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=27fed22d" />
|
||||
<script src="_static/documentation_options.js?v=5929fcd5"></script>
|
||||
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
|
||||
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
|
||||
<script src="_static/documentation_options.js?v=250a654d"></script>
|
||||
<script src="_static/doctools.js?v=fd6eb6e6"></script>
|
||||
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
|
||||
<link rel="icon" href="_static/VeraeFullLogo.png"/>
|
||||
<link rel="index" title="Index" href="genindex.html" />
|
||||
<link rel="search" title="Search" href="search.html" />
|
||||
<link rel="next" title="Audit-ready checklist" href="checklist.html" />
|
||||
<link rel="prev" title="Architecture (audit interview)" href="architecture.html" />
|
||||
<link rel="next" title="12. Audit-ready checklist" href="checklist.html" />
|
||||
<link rel="prev" title="10. Architecture for an audit interview" href="architecture.html" />
|
||||
|
||||
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
|
||||
|
||||
|
|
@ -24,93 +26,24 @@
|
|||
|
||||
|
||||
</head><body>
|
||||
|
||||
|
||||
<div class="document">
|
||||
<div class="documentwrapper">
|
||||
<div class="bodywrapper">
|
||||
|
||||
|
||||
<div class="body" role="main">
|
||||
|
||||
<section id="baas-and-dpas-when-ciphertext-has-no-host-keys">
|
||||
<h1>BAAs and DPAs when ciphertext has no host keys<a class="headerlink" href="#baas-and-dpas-when-ciphertext-has-no-host-keys" title="Link to this heading">¶</a></h1>
|
||||
<p>This is <strong>guidance for an evidence pack</strong>, not legal advice.</p>
|
||||
<section id="the-operator-statement">
|
||||
<h2>The operator statement<a class="headerlink" href="#the-operator-statement" title="Link to this heading">¶</a></h2>
|
||||
<p>Data at rest lives in the <strong>encrypted Peergos cryptree</strong>. Restore uses
|
||||
<strong>distributed, hash-verified, encrypted IPFS blocks</strong>. Hosts and backup
|
||||
media see <strong>opaque blobs</strong> (and random CHAMP labels), not filenames, not
|
||||
PHI, not social graph — if keys never leave the client / customer HSM.</p>
|
||||
<p>That is <strong>true of the Peergos design</strong> (see <a class="reference internal" href="verification.html"><span class="doc">Peergos verification (what was actually audited)</span></a>).
|
||||
It <strong>changes the BAA/DPA conversation</strong>. It does <strong>not</strong> auto-delete the
|
||||
need for contracts.</p>
|
||||
</section>
|
||||
<section id="hipaa-us-business-associate">
|
||||
<h2>HIPAA (US) — Business Associate<a class="headerlink" href="#hipaa-us-business-associate" title="Link to this heading">¶</a></h2>
|
||||
<p>A Business Associate is a person who <strong>creates, receives, maintains, or
|
||||
transmits ePHI</strong> for a covered entity.</p>
|
||||
<p><strong>Technical argument you can make (and should document):</strong></p>
|
||||
<ol class="arabic simple">
|
||||
<li><p>ePHI is encrypted <strong>before</strong> it leaves the endpoint (Peergos client /
|
||||
DataCube writer).</p></li>
|
||||
<li><p>The storage node, IPFS, disk, and backup hold <strong>ciphertext + hashes</strong>.</p></li>
|
||||
<li><p>Private keys <strong>do not</strong> reside on the storage host (customer HSM /
|
||||
client). Hash verification detects tampering.</p></li>
|
||||
<li><p>Therefore the host <strong>cannot maintain ePHI in intelligible form</strong>.</p></li>
|
||||
</ol>
|
||||
<p>HHS distinguishes <strong>conduits</strong> and parties that never have access to
|
||||
ePHI. Many programs still <strong>sign a BAA</strong> when a vendor touches
|
||||
infrastructure, because misconfiguration, support exports, or logs could
|
||||
later expose plaintext. OCR looks at <strong>your</strong> risk analysis.</p>
|
||||
<p><strong>Practical pack:</strong> risk analysis memo citing cryptree + IPFS hash checks
|
||||
+ key custody; BAA <strong>or</strong> written determination that the vendor is
|
||||
<strong>not</strong> a BA because they cannot decrypt; list every party with
|
||||
disk/backup (ns1, IPFS cluster, offsite replica).</p>
|
||||
</section>
|
||||
<section id="gdpr-eu-uk-processor-vs-technical-measure">
|
||||
<h2>GDPR (EU/UK) — processor vs technical measure<a class="headerlink" href="#gdpr-eu-uk-processor-vs-technical-measure" title="Link to this heading">¶</a></h2>
|
||||
<p>Encrypted data can still be <strong>personal data</strong> if it is reasonably
|
||||
attributable (usernames, IPs, invoice identity). GDPR <strong>Art. 32</strong> lists
|
||||
encryption as a security measure.</p>
|
||||
<p>Peergos is designed so the <strong>server is an adversary</strong> for content and
|
||||
most metadata. EU-based <strong>independent pentests</strong> (Cure53 DE, ROS NL)
|
||||
evaluated that design. Processing location for <strong>self-host</strong> is <em>your</em>
|
||||
ns1 / customer region, not peergos.net’s Germany hosting, unless you use
|
||||
peergos.net.</p>
|
||||
<p>You may still need a <strong>DPA (Art. 28)</strong> with anyone who <strong>processes</strong>
|
||||
personal data (usernames, logs, billing). Ciphertext-only storage
|
||||
<strong>narrows</strong> the DPA’s technical annex.</p>
|
||||
</section>
|
||||
<section id="nats-operators">
|
||||
<h2>NATS operators<a class="headerlink" href="#nats-operators" title="Link to this heading">¶</a></h2>
|
||||
<p>NATS is an <strong>untrusted broker</strong>. Content is HPKE; destinations and
|
||||
subjects are in the clear. A NATS operator <strong>cannot</strong> read bodies without
|
||||
endpoint private keys; <strong>can</strong> see routing metadata; <strong>can</strong> drop/delay
|
||||
copy <strong>ciphertext</strong>. Treat like a transit provider: DPA/BAA depends on
|
||||
whether routing metadata is personal data in your jurisdiction.</p>
|
||||
</section>
|
||||
<section id="what-making-yourself-audit-ready-means">
|
||||
<h2>What “making yourself audit-ready” means<a class="headerlink" href="#what-making-yourself-audit-ready-means" title="Link to this heading">¶</a></h2>
|
||||
<p>You are <strong>not</strong> buying Peergos’s Cure53/ROS reports as <em>your</em> SOC 2.
|
||||
You are <strong>reusing</strong> those public evaluations as <strong>vendor/component
|
||||
assurance</strong>, then adding your scope, RoPA, key-custody, inspect k-of-n,
|
||||
admin-history, instance evidence, and contracts that match who can
|
||||
actually see plaintext.</p>
|
||||
</section>
|
||||
</section>
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
<div class="document">
|
||||
|
||||
<div class="sphinxsidebar" role="navigation" aria-label="Main">
|
||||
<div class="sphinxsidebarwrapper">
|
||||
<h1 class="logo"><a href="index.html">Making yourself audit-ready with Verae DataCubes</a></h1>
|
||||
<p class="logo"><a href="index.html">
|
||||
<img class="logo" src="_static/VeraeFullLogo.png" alt="Logo of Making yourself audit-ready with Verae DataCubes"/>
|
||||
</a></p>
|
||||
<p class="logo">
|
||||
<a href="index.html">
|
||||
<img class="logo" src="_static/VeraeFullLogo.png" alt="Logo" />
|
||||
|
||||
</a>
|
||||
</p>
|
||||
|
||||
|
||||
|
||||
<p class="blurb">Tools for storage, communications, timestamping, verification, and audit — not a certificate.</p>
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
@ -126,27 +59,41 @@ actually see plaintext.</p>
|
|||
</div>
|
||||
</search>
|
||||
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
|
||||
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
|
||||
<ul class="current">
|
||||
<li class="toctree-l1"><a class="reference internal" href="verification.html">Peergos verification (what was actually audited)</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="architecture.html">Architecture (audit interview)</a></li>
|
||||
<li class="toctree-l1 current"><a class="current reference internal" href="#">BAAs and DPAs when ciphertext has no host keys</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#the-operator-statement">The operator statement</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#hipaa-us-business-associate">HIPAA (US) — Business Associate</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#gdpr-eu-uk-processor-vs-technical-measure">GDPR (EU/UK) — processor vs technical measure</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#nats-operators">NATS operators</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#what-making-yourself-audit-ready-means">What “making yourself audit-ready” means</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
|
||||
<li class="toctree-l1 current"><a class="current reference internal" href="#">11. BAAs, DPAs, and ciphertext without host keys</a><ul>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#the-technical-fact">11.1. The technical fact</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#hipaa-business-associate">11.2. HIPAA — Business Associate</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#gdpr-processor-versus-technical-measure">11.3. GDPR — processor versus technical measure</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#nats-operators">11.4. NATS operators</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#verae-as-timestamping-service">11.5. Verae as timestamping service</a></li>
|
||||
<li class="toctree-l2"><a class="reference internal" href="#component-assurance-versus-the-organization-s-report">11.6. Component assurance versus the organization’s report</a></li>
|
||||
</ul>
|
||||
</li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="checklist.html">Audit-ready checklist</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="howto.html">How to use this pack</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
|
||||
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
|
||||
</ul>
|
||||
|
||||
<div class="relations">
|
||||
<h3>Related Topics</h3>
|
||||
<ul>
|
||||
<li><a href="index.html">Documentation overview</a><ul>
|
||||
<li>Previous: <a href="architecture.html" title="previous chapter">Architecture (audit interview)</a></li>
|
||||
<li>Next: <a href="checklist.html" title="next chapter">Audit-ready checklist</a></li>
|
||||
<li>Previous: <a href="architecture.html" title="previous chapter"><span class="section-number">10. </span>Architecture for an audit interview</a></li>
|
||||
<li>Next: <a href="checklist.html" title="next chapter"><span class="section-number">12. </span>Audit-ready checklist</a></li>
|
||||
</ul></li>
|
||||
</ul>
|
||||
</div>
|
||||
|
|
@ -160,22 +107,129 @@ actually see plaintext.</p>
|
|||
|
||||
</div>
|
||||
</div>
|
||||
<div class="clearer"></div>
|
||||
</div>
|
||||
<div class="documentwrapper">
|
||||
<div class="bodywrapper">
|
||||
|
||||
|
||||
<div class="body" role="main">
|
||||
|
||||
<section id="baas-dpas-and-ciphertext-without-host-keys">
|
||||
<h1><span class="section-number">11. </span>BAAs, DPAs, and ciphertext without host keys<a class="headerlink" href="#baas-dpas-and-ciphertext-without-host-keys" title="Link to this heading">¶</a></h1>
|
||||
<p>This chapter is <strong>guidance for an evidence pack</strong>. It is not
|
||||
legal advice. Counsel has to sign the actual determination.</p>
|
||||
<section id="the-technical-fact">
|
||||
<h2><span class="section-number">11.1. </span>The technical fact<a class="headerlink" href="#the-technical-fact" title="Link to this heading">¶</a></h2>
|
||||
<p>Data at rest lives in the <strong>encrypted Peergos cryptree</strong>.
|
||||
Restore uses <strong>distributed, hash-verified, encrypted IPFS
|
||||
blocks</strong>. Hosts and backup media see <strong>opaque blobs</strong> (and
|
||||
random CHAMP labels), not filenames, not PHI, not the share
|
||||
graph — <strong>if</strong> private keys never leave the client or the
|
||||
customer’s HSM.</p>
|
||||
<p>That fact is true of the Peergos design and is the design
|
||||
Cure53 reviewed in Berlin. It <strong>changes</strong> the Business
|
||||
Associate and GDPR-processor conversation. It does <strong>not</strong>
|
||||
automatically delete the need for contracts.</p>
|
||||
</section>
|
||||
<section id="hipaa-business-associate">
|
||||
<h2><span class="section-number">11.2. </span>HIPAA — Business Associate<a class="headerlink" href="#hipaa-business-associate" title="Link to this heading">¶</a></h2>
|
||||
<p>A Business Associate is a person who <strong>creates, receives,
|
||||
maintains, or transmits ePHI</strong> for a covered entity.</p>
|
||||
<p>A technical argument the organization can document:</p>
|
||||
<ol class="arabic simple">
|
||||
<li><p>ePHI is encrypted <strong>before</strong> it leaves the endpoint.</p></li>
|
||||
<li><p>The storage node, IPFS, disk, Iceberg archive, and backup
|
||||
hold <strong>ciphertext plus hashes</strong>.</p></li>
|
||||
<li><p>Private keys <strong>do not</strong> reside on the storage host.
|
||||
Hash verification detects substitution.</p></li>
|
||||
<li><p>Therefore the host <strong>cannot maintain ePHI in intelligible
|
||||
form</strong>.</p></li>
|
||||
</ol>
|
||||
<p>HHS has distinguished <strong>conduits</strong> and parties that never
|
||||
have access to ePHI. Many programs still <strong>sign a BAA</strong>
|
||||
whenever a vendor touches infrastructure, because
|
||||
misconfiguration, a support export, or a log could later
|
||||
expose plaintext. OCR will look at <strong>the organization’s</strong>
|
||||
risk analysis, not at Verae’s architecture diagram.</p>
|
||||
<p>Practical pack:</p>
|
||||
<ul class="simple">
|
||||
<li><p>a risk-analysis memo citing cryptree, IPFS hash checks,
|
||||
key custody, and the two public Peergos evaluations;</p></li>
|
||||
<li><p>a BAA <strong>or</strong> a written determination that a named vendor
|
||||
is <strong>not</strong> a BA because they cannot decrypt;</p></li>
|
||||
<li><p>a list of every party with disk, VM, backup, IPFS, or
|
||||
Iceberg credentials.</p></li>
|
||||
</ul>
|
||||
</section>
|
||||
<section id="gdpr-processor-versus-technical-measure">
|
||||
<h2><span class="section-number">11.3. </span>GDPR — processor versus technical measure<a class="headerlink" href="#gdpr-processor-versus-technical-measure" title="Link to this heading">¶</a></h2>
|
||||
<p>Encrypted data can still be <strong>personal data</strong> if it is
|
||||
reasonably attributable (usernames, IPs, invoice identity).
|
||||
GDPR Article 32 lists encryption as a security measure, not
|
||||
as an exemption from Article 28.</p>
|
||||
<p>Peergos is designed so the <strong>server is an adversary</strong> for
|
||||
content and most metadata. EU-based independent pentests
|
||||
evaluated that design. Processing location for <strong>self-host</strong>
|
||||
is the customer’s region, not peergos.net’s Germany, unless
|
||||
the customer uses peergos.net.</p>
|
||||
<p>A DPA may still be required with anyone who <strong>processes</strong>
|
||||
usernames, logs, or billing. Ciphertext-only storage
|
||||
<strong>narrows</strong> the technical annex. It does not always
|
||||
eliminate the DPA.</p>
|
||||
</section>
|
||||
<section id="nats-operators">
|
||||
<h2><span class="section-number">11.4. </span>NATS operators<a class="headerlink" href="#nats-operators" title="Link to this heading">¶</a></h2>
|
||||
<p>NATS is an untrusted broker. Content is HPKE. Destinations
|
||||
and subjects are in the clear. A NATS operator <strong>cannot</strong>
|
||||
read bodies without endpoint private keys. They <strong>can</strong> see
|
||||
routing metadata. They <strong>can</strong> drop, delay, or copy
|
||||
ciphertext. Treat them like a transit provider: whether a
|
||||
DPA or BAA is needed depends on whether routing metadata is
|
||||
personal data in the relevant jurisdiction.</p>
|
||||
</section>
|
||||
<section id="verae-as-timestamping-service">
|
||||
<h2><span class="section-number">11.5. </span>Verae as timestamping service<a class="headerlink" href="#verae-as-timestamping-service" title="Link to this heading">¶</a></h2>
|
||||
<p>If Verae receives <strong>only fingerprints</strong>, Verae’s role for
|
||||
<strong>content</strong> is not “stores the records.” Verae’s role is
|
||||
“registers hashes and issues receipts.” That is a narrower
|
||||
processing. Counsel still has to decide whether the
|
||||
fingerprint, plus whatever account data exists (company
|
||||
name, billing, operator emails), requires a DPA or a BAA.
|
||||
Do not let a sales sentence skip that memo.</p>
|
||||
</section>
|
||||
<section id="component-assurance-versus-the-organization-s-report">
|
||||
<h2><span class="section-number">11.6. </span>Component assurance versus the organization’s report<a class="headerlink" href="#component-assurance-versus-the-organization-s-report" title="Link to this heading">¶</a></h2>
|
||||
<p>Attaching Cure53 2019 and ROS 2024 is <strong>vendor / component
|
||||
assurance</strong>. It is appropriate. It is <strong>not</strong> the
|
||||
organization’s SOC 2, ISO 27001, or HIPAA program. Those
|
||||
still require the organization’s scope, Record of
|
||||
Processing, key-custody, inspect k-of-n, admin-history,
|
||||
instance evidence, restore tests, and the contracts that
|
||||
match who can actually see plaintext.</p>
|
||||
</section>
|
||||
</section>
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
<div class="clearer"></div>
|
||||
</div>
|
||||
<div class="verae-page-footer">
|
||||
<strong>Verae Inc</strong>
|
||||
· <a href="https://www.verae.com">https://www.verae.com</a>
|
||||
· Book a call at <a href="https://www.verae.com">verae.com</a>
|
||||
· <a href="https://app.verae.com">app.verae.com</a>
|
||||
</div>
|
||||
|
||||
<div class="footer">
|
||||
©2026, Verae.
|
||||
©2026, Verae Inc.
|
||||
|
||||
|
|
||||
Powered by <a href="https://www.sphinx-doc.org/">Sphinx 9.1.0</a>
|
||||
& <a href="https://alabaster.readthedocs.io">Alabaster 1.0.0</a>
|
||||
|
||||
|
|
||||
<a href="_sources/baa-dpa.rst.txt"
|
||||
rel="nofollow">Page source</a>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</body>
|
||||
</html>
|
||||
Loading…
Add table
Add a link
Reference in a new issue