Rewrite audit-ready briefing: software is not a certificate.

Open with an executive summary that HIPAA, SOC 2, and ISO 27001
are organizational programs. Verae DataCubes supply store,
communicate, timestamp, verify, and audit tools for the technical
portion only. Chapters cover transit (HPKE, visible routing), rest
(IPFS/Peergos hash-verified restore), receipts, EU Peergos
evaluations (Cure53 2019, ROS 2024), cross-blockchain timestamping,
and write-once Iceberg archive. PDF is branded with the Verae logo
top-left and Verae Inc contact in the footer; last chapters are
sourced bios for Garfinkel (FINRA CRD 5052743), Haber, and Lambert.

source/executive.rst

@@ -0,0 +1,159 @@
+Executive summary
+=================
+
+Software alone does not make an organization HIPAA certified, SOC 2
+attested, or ISO 27001 certified.
+
+That sentence is the point of this document. It is also the sentence
+that is most often skipped when a vendor, an integrator, or an internal
+champion shows encryption, hashing, or a pentest PDF and treats the
+conversation as finished. It is not finished. Encryption is a control.
+A pentest is an evaluation of a component. A certificate, an attestation,
+or a covered-entity determination is a statement about **an organization**
+--- its legal entity, its people, its written policies, its operating
+procedures, its internal controls, the evidence those controls produce,
+and the independent party that examined that evidence.
+
+The Verae DataCube Solution gives an organization tools to **store**,
+**communicate**, **timestamp**, **verify**, and **audit** for compliance.
+Those tools are real, they are specific, and they are described in the
+chapters that follow. They are still only tools. To obtain HIPAA-aligned
+status as a covered entity or business associate with a defensible
+program, a SOC 2 Type I or Type II report, or an ISO 27001 certificate,
+the organization must still:
+
+* write and live by **policies** (what the organization says it will do);
+* operate **procedures** (how staff actually do it, every day);
+* design and test **internal controls** (the checks that catch failure);
+* retain **evidence** (logs, tickets, screenshots, signed approvals,
+  restore tests, training records);
+* engage an **independent auditor**, CPA firm, or ISO registrar, as the
+  chosen program requires.
+
+Verae cannot issue those certificates. Verae cannot sit in the
+organization's chair during an OCR investigation, a SOC 2 fieldwork
+week, or an ISO Stage 2 audit. What Verae can do --- and what this
+briefing is written to make precise --- is provide the **tools**, the
+**background**, and the **software infrastructure** that make it easier
+to implement the **technical portion** of those programs.
+
+What a Verae DataCube Server Solution does
+------------------------------------------
+
+A Verae DataCube Server Solution provides **secure communications and
+storage** for two classical information-security states:
+
+* **Data in transit** --- messages, objects, and control traffic while
+  they move from one endpoint to another.
+* **Data at rest** --- messages, objects, metadata, and receipts while
+  they sit on disk, in a replica, or in an archive.
+
+Those two states are not the same problem, and they are not solved by
+the same mechanism. This document treats them separately on purpose.
+
+Data in transit
+---------------
+
+Verae uses best-in-class encryption for messaging **from point to
+point**. The content of a message is sealed so that only the intended
+endpoints can open it. Routing, however, **must remain visible**: a
+message that cannot be addressed cannot be delivered. Subjects,
+destination handles, and size or timing metadata are therefore
+visible to the transport. The transport is treated as
+**honest-but-curious**. It can drop, delay, or copy ciphertext. It
+cannot read the body if it does not hold endpoint private keys.
+
+Data at rest
+------------
+
+Encryption at rest is performed through **IPFS content-addressed
+blocks**. Each block is named by its hash. Peergos verifies those
+hashes on read and on write. A restore is therefore
+**tamper-evident**: if a block was altered, its hash no longer
+matches, and the client refuses it. This is not a plaintext tape
+backup. It is a re-fetch of hashed ciphertext plus a verification
+that the bits are the bits that were stored.
+
+Global timestamped receipts
+---------------------------
+
+Independently of who stores the bytes, Verae issues **global
+timestamped receipts** based on **document hashes**. A receipt is
+proof of the **time and sequence of the first registration** of a
+block of digital information --- a message, an image, a document, or
+any other digital object that can be stored in digital media. The
+receipt does not require Verae to see the object. It requires a
+fingerprint of the object, registered at a time that can later be
+shown to third parties.
+
+Peergos, evaluated in Europe
+----------------------------
+
+The offline storage and replication system used with Peergos was
+**audited twice in Europe**, and the protocol was designed under
+work that was independently reviewed:
+
+* **2019 --- Cure53, Berlin, Germany.** Pentest, source-code audit,
+  and **crypto/design review** (May--June 2019). No fundamental
+  architectural or cryptographic problems. Issues found were fixed.
+  Cure53 stated that the platform **passed this evaluation**.
+* **2024 --- Radically Open Security B.V., Amsterdam, Netherlands.**
+  Crystal-box pentest plus code audit of the Peergos web UI
+  (September--November 2024). **Zero** findings rated extreme, high,
+  or elevated; **two** moderate; **six** low. Peergos states all
+  were fixed. No data exposure and no integrity compromise (the
+  issues were mostly UI crashes).
+
+Both firms are **EU-based**. Both full reports are **public**. That
+is a **security evaluation of the Peergos protocol and
+implementation**. It is **not** a HIPAA certificate, a SOC 2 report,
+or an ISO 27001 certificate for Peergos, for Verae, or for any
+customer.
+
+Verae global timestamping
+-------------------------
+
+The Verae Global Timestamping and receipt solution is a
+**cross-blockchain** design. It certifies the time and date stamp of
+a digital object and stores that information in a **digital bundle**
+that can carry private metadata, attached files, and an internal
+blockchain. That organizational chain is **cross-verified** either:
+
+* from an organizational server **linked to the central Verae
+  server**, or
+* by **directly syncing** with Verae's central timestamping server.
+
+The result is **proof of existence** of a digital object at a
+specific time and date. When the organization wants the object
+itself stored --- not only its fingerprint --- the object can live
+inside an **encrypted Peergos DataCube**.
+
+Write-once Iceberg archive
+--------------------------
+
+Those DataCubes are archived into a **write-once external Iceberg
+file-storage solution** for compliance reasons. The archive is
+designed to sit **outside the deletion control of any single
+party**. That is a retention and legal-hold property, not a
+marketing slogan: once a cube is committed to the write-once tier,
+neither the customer operator, nor Verae, nor a hosting vendor
+should be able to quietly erase it.
+
+What this briefing is, and is not
+---------------------------------
+
+This briefing describes the **technical portion** of a compliance
+program that an organization can build with Verae DataCubes. It
+indexes each of the points above as its own chapter, in enough
+detail that a CISO, a CCO, outside counsel, or an auditor can
+distinguish:
+
+* what the software **does**;
+* what the independent **Peergos evaluations** actually said;
+* what **Verae timestamping** actually proves;
+* what the organization **must still write, operate, and have
+  examined**.
+
+It does not claim that installing this software finishes HIPAA,
+SOC 2, or ISO 27001. Anyone who says otherwise is not describing
+this product honestly.