marchon/peergos-making-yourself-audit-ready-with-verae-datacubes
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Rewrite audit-ready briefing: software is not a certificate.
Some checks are pending
ci / markdown (push) Waiting to run
Details

Browse source 
Open with an executive summary that HIPAA, SOC 2, and ISO 27001
are organizational programs. Verae DataCubes supply store,
communicate, timestamp, verify, and audit tools for the technical
portion only. Chapters cover transit (HPKE, visible routing), rest
(IPFS/Peergos hash-verified restore), receipts, EU Peergos
evaluations (Cure53 2019, ROS 2024), cross-blockchain timestamping,
and write-once Iceberg archive. PDF is branded with the Verae logo
top-left and Verae Inc contact in the footer; last chapters are
sourced bios for Garfinkel (FINRA CRD 5052743), Haber, and Lambert.
This commit is contained in:
George Lambert 2026-09-16 00:55:21 -04:00
parent da60402e88
commit 4fcbb9ac95
53 changed files with 6323 additions and 814 deletions
Download patch file Download diff file Expand all files Collapse all files

315
build/html/index.html
View file

@ -8,13 +8,15 @@
<title>Making yourself audit-ready with Verae DataCubes &#8212; Making yourself audit-ready with Verae DataCubes</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=27fed22d" />
<script src="_static/documentation_options.js?v=5929fcd5"></script>
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
<link rel="icon" href="_static/VeraeFullLogo.png"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="Peergos verification (what was actually audited)" href="verification.html" />
<link rel="next" title="1. Executive summary" href="executive.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
@ -23,94 +25,24 @@
</head><body>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<section id="making-yourself-audit-ready-with-verae-datacubes">
<h1>Making yourself audit-ready with Verae DataCubes<a class="headerlink" href="#making-yourself-audit-ready-with-verae-datacubes" title="Link to this heading"></a></h1>
<p>How to <strong>prepare an organization</strong> for HIPAA-aligned, SOC 2, or ISO 27001
work using Verae DataCubes on <strong>Peergos</strong> (encrypted cryptree + hashed
IPFS) and HPKE on an <strong>untrusted NATS</strong> broker.</p>
<p><strong>This document is not a HIPAA, SOC 2, or ISO certificate.</strong>
Peergos’s public pentests are <strong>not</strong> your Type II or ISO registrar
certificate. They are <strong>component security evaluations</strong> you can attach.</p>
<div class="toctree-wrapper compound">
<ul>
<li class="toctree-l1"><a class="reference internal" href="verification.html">Peergos verification (what was actually audited)</a><ul>
<li class="toctree-l2"><a class="reference internal" href="verification.html#claim-to-check">Claim to check</a></li>
<li class="toctree-l2"><a class="reference internal" href="verification.html#independent-security-audits-europe">Independent security audits (Europe)</a></li>
<li class="toctree-l2"><a class="reference internal" href="verification.html#eu-funding-nlnet">EU funding / NLnet</a></li>
<li class="toctree-l2"><a class="reference internal" href="verification.html#hosted-instance-location">Hosted instance location</a></li>
<li class="toctree-l2"><a class="reference internal" href="verification.html#encrypted-filesystem-hashed-ipfs-design">Encrypted filesystem + hashed IPFS (design)</a></li>
<li class="toctree-l2"><a class="reference internal" href="verification.html#not-verified-do-not-claim">Not verified / do not claim</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">Architecture (audit interview)</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">BAAs and DPAs when ciphertext has no host keys</a><ul>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#the-operator-statement">The operator statement</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#hipaa-us-business-associate">HIPAA (US) — Business Associate</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#gdpr-eu-uk-processor-vs-technical-measure">GDPR (EU/UK) — processor vs technical measure</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#nats-operators">NATS operators</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#what-making-yourself-audit-ready-means">What “making yourself audit-ready” means</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">Audit-ready checklist</a><ul>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#a-scope-and-data-map">A. Scope and data map</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#b-keys-and-encryption">B. Keys and encryption</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#c-access">C. Access</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#d-integrity-and-backup">D. Integrity and backup</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#e-logging">E. Logging</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#f-contracts-counsel">F. Contracts (counsel)</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#g-independent-audit-of-you">G. Independent audit of <em>you</em></a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">How to use this pack</a></li>
</ul>
</div>
<section id="what-we-verified-about-peergos-eu">
<h2>What we verified about Peergos (EU)<a class="headerlink" href="#what-we-verified-about-peergos-eu" title="Link to this heading"></a></h2>
<p>See the full sourced table in <a class="reference internal" href="verification.html"><span class="doc">Peergos verification (what was actually audited)</span></a>.</p>
<ul class="simple">
<li><p>Encrypted client-side filesystem (cryptree); keys not on the storage
server — <strong>yes</strong> (Peergos book + Cure53 design review).</p></li>
<li><p>IPFS blocks content-addressed; Peergos verifies hashes — <strong>yes</strong>.</p></li>
<li><p>Independent <strong>EU</strong> security audits, reports published — <strong>yes, two:</strong>
Cure53 Berlin (2019); Radically Open Security Amsterdam (2024).</p></li>
<li><p>“Peergos is HIPAA/SOC 2/ISO certified” — <strong>no.</strong> Those audits are
pentest/code/design reviews, not management-system certificates.</p></li>
</ul>
<p>Peergos <strong>was designed as a trust-minimized encrypted filesystem</strong>,
<strong>evaluated in Europe</strong> by two specialist firms, with <strong>public reports</strong>.
That supports the <strong>at-rest / backup</strong> story. It does <strong>not</strong> finish
<em>your</em> audit.</p>
<p>Live technical surfaces:</p>
<ul class="simple">
<li><p><a class="reference external" href="https://pfc.georgelambert.org/health">https://pfc.georgelambert.org/health</a></p></li>
<li><p><a class="reference external" href="https://pfc.georgelambert.org/v1/npe/keys">https://pfc.georgelambert.org/v1/npe/keys</a></p></li>
<li><p><a class="reference external" href="https://docs.pfc.georgelambert.org/controls.html">https://docs.pfc.georgelambert.org/controls.html</a></p></li>
<li><p><a class="reference external" href="https://git.georgelambert.org/marchon/peergos-making-yourself-audit-ready-with-verae-datacubes">https://git.georgelambert.org/marchon/peergos-making-yourself-audit-ready-with-verae-datacubes</a></p></li>
</ul>
<p>Companion system docs (HTML): <a class="reference external" href="https://docs.pfc.georgelambert.org/">https://docs.pfc.georgelambert.org/</a></p>
</section>
</section>
</div>
</div>
</div>
<div class="document">
<div class="sphinxsidebar" role="navigation" aria-label="Main">
<div class="sphinxsidebarwrapper">
<h1 class="logo"><a href="#">Making yourself audit-ready with Verae DataCubes</a></h1>
<p class="logo"><a href="#">
<img class="logo" src="_static/VeraeFullLogo.png" alt="Logo of Making yourself audit-ready with Verae DataCubes"/>
</a></p>
<p class="logo">
<a href="#">
<img class="logo" src="_static/VeraeFullLogo.png" alt="Logo" />
</a>
</p>
<p class="blurb">Tools for storage, communications, timestamping, verification, and audit — not a certificate.</p>
@ -126,19 +58,32 @@ That supports the <strong>at-rest / backup</strong> story. It does <strong>not</
</div>
</search>
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="verification.html">Peergos verification (what was actually audited)</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">Architecture (audit interview)</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">BAAs and DPAs when ciphertext has no host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">How to use this pack</a></li>
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
</ul>
<div class="relations">
<h3>Related Topics</h3>
<ul>
<li><a href="#">Documentation overview</a><ul>
<li>Next: <a href="verification.html" title="next chapter">Peergos verification (what was actually audited)</a></li>
<li>Next: <a href="executive.html" title="next chapter"><span class="section-number">1. </span>Executive summary</a></li>
</ul></li>
</ul>
</div>
@ -152,22 +97,188 @@ That supports the <strong>at-rest / backup</strong> story. It does <strong>not</
</div>
</div>
<div class="clearer"></div>
</div>
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<section id="making-yourself-audit-ready-with-verae-datacubes">
<h1>Making yourself audit-ready with Verae DataCubes<a class="headerlink" href="#making-yourself-audit-ready-with-verae-datacubes" title="Link to this heading"></a></h1>
<a class="logo reference internal image-reference" href="_images/VeraeFullLogo.png"><img alt="Verae" class="logo" src="_images/VeraeFullLogo.png" style="width: 280px;" />
</a>
<p>This volume is a technical briefing. It is <strong>not</strong> a certificate.</p>
<p>The table of contents below is the document map. In the PDF edition,
each chapter starts on a new page and the contents list includes
<strong>section titles with page numbers</strong>. In HTML, each chapter is its own
page with the Verae wordmark in the sidebar and Verae Inc contact
information in the footer.</p>
<div class="toctree-wrapper compound">
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a><ul>
<li class="toctree-l2"><a class="reference internal" href="executive.html#what-a-verae-datacube-server-solution-does">1.1. What a Verae DataCube Server Solution does</a></li>
<li class="toctree-l2"><a class="reference internal" href="executive.html#data-in-transit">1.2. Data in transit</a></li>
<li class="toctree-l2"><a class="reference internal" href="executive.html#data-at-rest">1.3. Data at rest</a></li>
<li class="toctree-l2"><a class="reference internal" href="executive.html#global-timestamped-receipts">1.4. Global timestamped receipts</a></li>
<li class="toctree-l2"><a class="reference internal" href="executive.html#peergos-evaluated-in-europe">1.5. Peergos, evaluated in Europe</a></li>
<li class="toctree-l2"><a class="reference internal" href="executive.html#verae-global-timestamping">1.6. Verae global timestamping</a></li>
<li class="toctree-l2"><a class="reference internal" href="executive.html#write-once-iceberg-archive">1.7. Write-once Iceberg archive</a></li>
<li class="toctree-l2"><a class="reference internal" href="executive.html#what-this-briefing-is-and-is-not">1.8. What this briefing is, and is not</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a><ul>
<li class="toctree-l2"><a class="reference internal" href="what-verae-provides.html#the-boundary">2.1. The boundary</a></li>
<li class="toctree-l2"><a class="reference internal" href="what-verae-provides.html#the-tools">2.2. The tools</a></li>
<li class="toctree-l2"><a class="reference internal" href="what-verae-provides.html#what-the-organization-must-still-do">2.3. What the organization must still do</a></li>
<li class="toctree-l2"><a class="reference internal" href="what-verae-provides.html#why-the-distinction-matters-in-an-exam">2.4. Why the distinction matters in an exam</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a><ul>
<li class="toctree-l2"><a class="reference internal" href="datacube-server.html#purpose">3.1. Purpose</a></li>
<li class="toctree-l2"><a class="reference internal" href="datacube-server.html#the-datacube-as-a-container">3.2. The DataCube as a container</a></li>
<li class="toctree-l2"><a class="reference internal" href="datacube-server.html#two-information-states-one-operational-picture">3.3. Two information states, one operational picture</a></li>
<li class="toctree-l2"><a class="reference internal" href="datacube-server.html#what-server-means-in-practice">3.4. What “server” means in practice</a></li>
<li class="toctree-l2"><a class="reference internal" href="datacube-server.html#what-the-server-solution-is-not">3.5. What the server solution is not</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a><ul>
<li class="toctree-l2"><a class="reference internal" href="data-in-transit.html#the-problem">4.1. The problem</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-in-transit.html#point-to-point-encryption">4.2. Point-to-point encryption</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-in-transit.html#visible-routing">4.3. Visible routing</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-in-transit.html#error-handling-without-leaking-content">4.4. Error handling without leaking content</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-in-transit.html#the-public-key-directory">4.5. The public-key directory</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-in-transit.html#what-this-does-and-does-not-satisfy">4.6. What this does, and does not, satisfy</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a><ul>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#the-problem">5.1. The problem</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#content-addressed-blocks">5.2. Content-addressed blocks</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#peergos-on-top-of-ipfs">5.3. Peergos on top of IPFS</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#tamper-evident-restore">5.4. Tamper-evident restore</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#append-only-at-the-cube-layer">5.5. Append-only at the cube layer</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#what-a-disk-operator-sees">5.6. What a disk operator sees</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#what-this-does-and-does-not-satisfy">5.7. What this does, and does not, satisfy</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a><ul>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#why-hashes-are-not-enough-by-themselves">6.1. Why hashes are not enough by themselves</a></li>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#what-a-verae-receipt-is">6.2. What a Verae receipt is</a></li>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#what-is-registered-and-what-is-not">6.3. What is registered, and what is not</a></li>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#first-registration-wins">6.4. First registration wins</a></li>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#sequence">6.5. Sequence</a></li>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#bundles">6.6. Bundles</a></li>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#what-a-receipt-does-not-prove">6.7. What a receipt does not prove</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a><ul>
<li class="toctree-l2"><a class="reference internal" href="peergos-eu-evaluations.html#what-was-evaluated">7.1. What was evaluated</a></li>
<li class="toctree-l2"><a class="reference internal" href="peergos-eu-evaluations.html#cure53-berlin-germany">7.2. 2019 — Cure53, Berlin, Germany</a></li>
<li class="toctree-l2"><a class="reference internal" href="peergos-eu-evaluations.html#radically-open-security-b-v-amsterdam">7.3. 2024 — Radically Open Security B.V., Amsterdam</a></li>
<li class="toctree-l2"><a class="reference internal" href="peergos-eu-evaluations.html#how-to-present-these-reports-to-an-auditor">7.4. How to present these reports to an auditor</a></li>
<li class="toctree-l2"><a class="reference internal" href="peergos-eu-evaluations.html#hosted-peergos-versus-self-hosted-datacubes">7.5. Hosted Peergos versus self-hosted DataCubes</a></li>
<li class="toctree-l2"><a class="reference internal" href="peergos-eu-evaluations.html#what-designed-under-funding-from-cure53-ros-is-not">7.6. What “designed under funding from Cure53 / ROS” is not</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a><ul>
<li class="toctree-l2"><a class="reference internal" href="global-timestamping.html#lineage">8.1. Lineage</a></li>
<li class="toctree-l2"><a class="reference internal" href="global-timestamping.html#what-cross-blockchain-means-here">8.2. What “cross-blockchain” means here</a></li>
<li class="toctree-l2"><a class="reference internal" href="global-timestamping.html#two-deployment-patterns">8.3. Two deployment patterns</a></li>
<li class="toctree-l2"><a class="reference internal" href="global-timestamping.html#the-digital-bundle">8.4. The digital bundle</a></li>
<li class="toctree-l2"><a class="reference internal" href="global-timestamping.html#proof-of-existence-versus-proof-of-custody">8.5. Proof of existence versus proof of custody</a></li>
<li class="toctree-l2"><a class="reference internal" href="global-timestamping.html#what-this-does-and-does-not-satisfy">8.6. What this does, and does not, satisfy</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a><ul>
<li class="toctree-l2"><a class="reference internal" href="iceberg-archive.html#the-deletion-problem">9.1. The deletion problem</a></li>
<li class="toctree-l2"><a class="reference internal" href="iceberg-archive.html#what-write-once-iceberg-means-in-this-solution">9.2. What “write-once Iceberg” means in this solution</a></li>
<li class="toctree-l2"><a class="reference internal" href="iceberg-archive.html#how-cubes-move-into-the-archive">9.3. How cubes move into the archive</a></li>
<li class="toctree-l2"><a class="reference internal" href="iceberg-archive.html#relation-to-classical-worm">9.4. Relation to classical WORM</a></li>
<li class="toctree-l2"><a class="reference internal" href="iceberg-archive.html#what-this-does-and-does-not-satisfy">9.5. What this does, and does not, satisfy</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a><ul>
<li class="toctree-l2"><a class="reference internal" href="architecture.html#the-picture">10.1. The picture</a></li>
<li class="toctree-l2"><a class="reference internal" href="architecture.html#walkthrough-in-the-order-an-examiner-usually-asks">10.2. Walkthrough, in the order an examiner usually asks</a></li>
<li class="toctree-l2"><a class="reference internal" href="architecture.html#identity-planes">10.3. Identity planes</a></li>
<li class="toctree-l2"><a class="reference internal" href="architecture.html#nats-remains-untrusted">10.4. NATS remains untrusted</a></li>
<li class="toctree-l2"><a class="reference internal" href="architecture.html#what-to-hand-the-examiner">10.5. What to hand the examiner</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a><ul>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#the-technical-fact">11.1. The technical fact</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#hipaa-business-associate">11.2. HIPAA — Business Associate</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#gdpr-processor-versus-technical-measure">11.3. GDPR — processor versus technical measure</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#nats-operators">11.4. NATS operators</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#verae-as-timestamping-service">11.5. Verae as timestamping service</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#component-assurance-versus-the-organization-s-report">11.6. Component assurance versus the organization’s report</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a><ul>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#a-scope-and-honesty">12.1. A. Scope and honesty</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#b-data-in-transit">12.2. B. Data in transit</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#c-data-at-rest">12.3. C. Data at rest</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#d-timestamping">12.4. D. Timestamping</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#e-write-once-archive">12.5. E. Write-once archive</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#f-access-and-change">12.6. F. Access and change</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#g-contracts-counsel">12.7. G. Contracts (counsel)</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#h-independent-examination-of-this-organization">12.8. H. Independent examination of <em>this</em> organization</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a><ul>
<li class="toctree-l2"><a class="reference internal" href="bio-james-garfinkel.html#name-and-sources">14.1. Name and sources</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-james-garfinkel.html#role-at-verae">14.2. Role at Verae</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-james-garfinkel.html#finra-brokercheck-crd-5052743">14.3. FINRA BrokerCheck (CRD 5052743)</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-james-garfinkel.html#education-public-professional-listings">14.4. Education (public professional listings)</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-james-garfinkel.html#why-this-biography-is-in-the-briefing">14.5. Why this biography is in the briefing</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a><ul>
<li class="toctree-l2"><a class="reference internal" href="bio-stuart-haber.html#role-at-verae">15.1. Role at Verae</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-stuart-haber.html#the-scientific-work">15.2. The scientific work</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-stuart-haber.html#surety-1994-first-commercial-blockchain">15.3. Surety, 1994: first commercial blockchain</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-stuart-haber.html#other-cryptographic-publications">15.4. Other cryptographic publications</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-stuart-haber.html#why-this-biography-is-in-the-briefing">15.5. Why this biography is in the briefing</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a><ul>
<li class="toctree-l2"><a class="reference internal" href="bio-george-lambert.html#role">16.1. Role</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-george-lambert.html#internet-technical-architect-from-1994">16.2. Internet technical architect, from 1994</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-george-lambert.html#new-hampshire-public-office">16.3. New Hampshire public office</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-george-lambert.html#why-this-biography-is-in-the-briefing">16.4. Why this biography is in the briefing</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a><ul>
<li class="toctree-l2"><a class="reference internal" href="contact.html#closing-reminder">17.1. Closing reminder</a></li>
</ul>
</li>
</ul>
</div>
</section>
</div>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="verae-page-footer">
<strong>Verae Inc</strong>
&middot; <a href="https://www.verae.com">https://www.verae.com</a>
&middot; Book a call at <a href="https://www.verae.com">verae.com</a>
&middot; <a href="https://app.verae.com">app.verae.com</a>
</div>
<div class="footer">
&#169;2026, Verae.
&#169;2026, Verae Inc.
|
Powered by <a href="https://www.sphinx-doc.org/">Sphinx 9.1.0</a>
&amp; <a href="https://alabaster.readthedocs.io">Alabaster 1.0.0</a>
|
<a href="_sources/index.rst.txt"
rel="nofollow">Page source</a>
</div>
</body>
</html>