marchon/peergos-making-yourself-audit-ready-with-verae-datacubes
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Put the executive summary on page 2, before the table of contents.
Some checks are pending
ci / markdown (push) Waiting to run
Details

Browse source 
The cover stays page 1. Numbered chapters now start at What Verae
provides. The TOC lists Executive summary at page 2.
This commit is contained in:
George Lambert 2026-09-16 01:21:05 -04:00
parent 5df7ed87d5
commit 8496ef8338
23 changed files with 759 additions and 723 deletions
Download patch file Download diff file Expand all files Collapse all files

67
build/html/architecture.html
View file

@ -5,19 +5,19 @@
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>10. Architecture for an audit interview &#8212; Making yourself audit-ready with Verae DataCubes</title>
<title>9. Architecture for an audit interview &#8212; Making yourself audit-ready with Verae DataCubes</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
<link rel="icon" href="_static/VeraeFullLogo.png"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="11. BAAs, DPAs, and ciphertext without host keys" href="baa-dpa.html" />
<link rel="prev" title="9. Write-once Iceberg archive" href="iceberg-archive.html" />
<link rel="next" title="10. BAAs, DPAs, and ciphertext without host keys" href="baa-dpa.html" />
<link rel="prev" title="8. Write-once Iceberg archive" href="iceberg-archive.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
@ -61,38 +61,37 @@
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">10. Architecture for an audit interview</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#the-picture">10.1. The picture</a></li>
<li class="toctree-l2"><a class="reference internal" href="#walkthrough-in-the-order-an-examiner-usually-asks">10.2. Walkthrough, in the order an examiner usually asks</a></li>
<li class="toctree-l2"><a class="reference internal" href="#identity-planes">10.3. Identity planes</a></li>
<li class="toctree-l2"><a class="reference internal" href="#nats-remains-untrusted">10.4. NATS remains untrusted</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-to-hand-the-examiner">10.5. What to hand the examiner</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">9. Architecture for an audit interview</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#the-picture">9.1. The picture</a></li>
<li class="toctree-l2"><a class="reference internal" href="#walkthrough-in-the-order-an-examiner-usually-asks">9.2. Walkthrough, in the order an examiner usually asks</a></li>
<li class="toctree-l2"><a class="reference internal" href="#identity-planes">9.3. Identity planes</a></li>
<li class="toctree-l2"><a class="reference internal" href="#nats-remains-untrusted">9.4. NATS remains untrusted</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-to-hand-the-examiner">9.5. What to hand the examiner</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
</ul>
<div class="relations">
<h3>Related Topics</h3>
<ul>
<li><a href="index.html">Documentation overview</a><ul>
<li>Previous: <a href="iceberg-archive.html" title="previous chapter"><span class="section-number">9. </span>Write-once Iceberg archive</a></li>
<li>Next: <a href="baa-dpa.html" title="next chapter"><span class="section-number">11. </span>BAAs, DPAs, and ciphertext without host keys</a></li>
<li>Previous: <a href="iceberg-archive.html" title="previous chapter"><span class="section-number">8. </span>Write-once Iceberg archive</a></li>
<li>Next: <a href="baa-dpa.html" title="next chapter"><span class="section-number">10. </span>BAAs, DPAs, and ciphertext without host keys</a></li>
</ul></li>
</ul>
</div>
@ -113,9 +112,9 @@
<div class="body" role="main">
<section id="architecture-for-an-audit-interview">
<h1><span class="section-number">10. </span>Architecture for an audit interview<a class="headerlink" href="#architecture-for-an-audit-interview" title="Link to this heading"></a></h1>
<h1><span class="section-number">9. </span>Architecture for an audit interview<a class="headerlink" href="#architecture-for-an-audit-interview" title="Link to this heading"></a></h1>
<section id="the-picture">
<h2><span class="section-number">10.1. </span>The picture<a class="headerlink" href="#the-picture" title="Link to this heading"></a></h2>
<h2><span class="section-number">9.1. </span>The picture<a class="headerlink" href="#the-picture" title="Link to this heading"></a></h2>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">Endpoint</span> <span class="p">(</span><span class="n">private</span> <span class="n">keys</span> <span class="n">stay</span> <span class="n">here</span> <span class="o">/</span> <span class="n">HSM</span><span class="p">)</span>
<span class="o">|</span> <span class="n">HPKE</span> <span class="n">content</span> <span class="p">(</span><span class="n">point</span><span class="o">-</span><span class="n">to</span><span class="o">-</span><span class="n">point</span><span class="p">)</span>
<span class="o">|</span> <span class="n">routing</span><span class="p">:</span> <span class="n">destination</span> <span class="o">+</span> <span class="n">subject</span> <span class="ow">in</span> <span class="n">the</span> <span class="n">clear</span>
@ -142,7 +141,7 @@
</div>
</section>
<section id="walkthrough-in-the-order-an-examiner-usually-asks">
<h2><span class="section-number">10.2. </span>Walkthrough, in the order an examiner usually asks<a class="headerlink" href="#walkthrough-in-the-order-an-examiner-usually-asks" title="Link to this heading"></a></h2>
<h2><span class="section-number">9.2. </span>Walkthrough, in the order an examiner usually asks<a class="headerlink" href="#walkthrough-in-the-order-an-examiner-usually-asks" title="Link to this heading"></a></h2>
<p><strong>Where are the keys?</strong> On the endpoint or in the customer’s
HSM. Not on the storage host. Not in the public-key
directory (that directory holds public keys only). Not in
@ -171,7 +170,7 @@ k-of-n officers. The author of a change is not an officer
on that change. Log-before-reveal.</p>
</section>
<section id="identity-planes">
<h2><span class="section-number">10.3. </span>Identity planes<a class="headerlink" href="#identity-planes" title="Link to this heading"></a></h2>
<h2><span class="section-number">9.3. </span>Identity planes<a class="headerlink" href="#identity-planes" title="Link to this heading"></a></h2>
<p>There are two login planes, and they must not be collapsed
in an interview:</p>
<ul class="simple">
@ -185,7 +184,7 @@ cubes.</p></li>
the master key.” It is not.</p>
</section>
<section id="nats-remains-untrusted">
<h2><span class="section-number">10.4. </span>NATS remains untrusted<a class="headerlink" href="#nats-remains-untrusted" title="Link to this heading"></a></h2>
<h2><span class="section-number">9.4. </span>NATS remains untrusted<a class="headerlink" href="#nats-remains-untrusted" title="Link to this heading"></a></h2>
<p>The reference message fabric is NATS. It is an
honest-but-curious broker. Destinations in the clear are
<strong>passthrough</strong>, not a bug. Bodies are ciphertext, or the
@ -195,7 +194,7 @@ identifiers, not payloads.</p>
is not the same socket the internal services use.</p>
</section>
<section id="what-to-hand-the-examiner">
<h2><span class="section-number">10.5. </span>What to hand the examiner<a class="headerlink" href="#what-to-hand-the-examiner" title="Link to this heading"></a></h2>
<h2><span class="section-number">9.5. </span>What to hand the examiner<a class="headerlink" href="#what-to-hand-the-examiner" title="Link to this heading"></a></h2>
<ul class="simple">
<li><p>this document (HTML or PDF);</p></li>
<li><p>the two public Peergos reports, labeled as component

71
build/html/baa-dpa.html
View file

@ -5,19 +5,19 @@
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>11. BAAs, DPAs, and ciphertext without host keys &#8212; Making yourself audit-ready with Verae DataCubes</title>
<title>10. BAAs, DPAs, and ciphertext without host keys &#8212; Making yourself audit-ready with Verae DataCubes</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
<link rel="icon" href="_static/VeraeFullLogo.png"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="12. Audit-ready checklist" href="checklist.html" />
<link rel="prev" title="10. Architecture for an audit interview" href="architecture.html" />
<link rel="next" title="11. Audit-ready checklist" href="checklist.html" />
<link rel="prev" title="9. Architecture for an audit interview" href="architecture.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
@ -61,39 +61,38 @@
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">11. BAAs, DPAs, and ciphertext without host keys</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#the-technical-fact">11.1. The technical fact</a></li>
<li class="toctree-l2"><a class="reference internal" href="#hipaa-business-associate">11.2. HIPAA — Business Associate</a></li>
<li class="toctree-l2"><a class="reference internal" href="#gdpr-processor-versus-technical-measure">11.3. GDPR — processor versus technical measure</a></li>
<li class="toctree-l2"><a class="reference internal" href="#nats-operators">11.4. NATS operators</a></li>
<li class="toctree-l2"><a class="reference internal" href="#verae-as-timestamping-service">11.5. Verae as timestamping service</a></li>
<li class="toctree-l2"><a class="reference internal" href="#component-assurance-versus-the-organization-s-report">11.6. Component assurance versus the organization’s report</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">10. BAAs, DPAs, and ciphertext without host keys</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#the-technical-fact">10.1. The technical fact</a></li>
<li class="toctree-l2"><a class="reference internal" href="#hipaa-business-associate">10.2. HIPAA — Business Associate</a></li>
<li class="toctree-l2"><a class="reference internal" href="#gdpr-processor-versus-technical-measure">10.3. GDPR — processor versus technical measure</a></li>
<li class="toctree-l2"><a class="reference internal" href="#nats-operators">10.4. NATS operators</a></li>
<li class="toctree-l2"><a class="reference internal" href="#verae-as-timestamping-service">10.5. Verae as timestamping service</a></li>
<li class="toctree-l2"><a class="reference internal" href="#component-assurance-versus-the-organization-s-report">10.6. Component assurance versus the organization’s report</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
</ul>
<div class="relations">
<h3>Related Topics</h3>
<ul>
<li><a href="index.html">Documentation overview</a><ul>
<li>Previous: <a href="architecture.html" title="previous chapter"><span class="section-number">10. </span>Architecture for an audit interview</a></li>
<li>Next: <a href="checklist.html" title="next chapter"><span class="section-number">12. </span>Audit-ready checklist</a></li>
<li>Previous: <a href="architecture.html" title="previous chapter"><span class="section-number">9. </span>Architecture for an audit interview</a></li>
<li>Next: <a href="checklist.html" title="next chapter"><span class="section-number">11. </span>Audit-ready checklist</a></li>
</ul></li>
</ul>
</div>
@ -114,11 +113,11 @@
<div class="body" role="main">
<section id="baas-dpas-and-ciphertext-without-host-keys">
<h1><span class="section-number">11. </span>BAAs, DPAs, and ciphertext without host keys<a class="headerlink" href="#baas-dpas-and-ciphertext-without-host-keys" title="Link to this heading"></a></h1>
<h1><span class="section-number">10. </span>BAAs, DPAs, and ciphertext without host keys<a class="headerlink" href="#baas-dpas-and-ciphertext-without-host-keys" title="Link to this heading"></a></h1>
<p>This chapter is <strong>guidance for an evidence pack</strong>. It is not
legal advice. Counsel has to sign the actual determination.</p>
<section id="the-technical-fact">
<h2><span class="section-number">11.1. </span>The technical fact<a class="headerlink" href="#the-technical-fact" title="Link to this heading"></a></h2>
<h2><span class="section-number">10.1. </span>The technical fact<a class="headerlink" href="#the-technical-fact" title="Link to this heading"></a></h2>
<p>Data at rest lives in the <strong>encrypted Peergos cryptree</strong>.
Restore uses <strong>distributed, hash-verified, encrypted IPFS
blocks</strong>. Hosts and backup media see <strong>opaque blobs</strong> (and
@ -131,7 +130,7 @@ Associate and GDPR-processor conversation. It does <strong>not</strong>
automatically delete the need for contracts.</p>
</section>
<section id="hipaa-business-associate">
<h2><span class="section-number">11.2. </span>HIPAA — Business Associate<a class="headerlink" href="#hipaa-business-associate" title="Link to this heading"></a></h2>
<h2><span class="section-number">10.2. </span>HIPAA — Business Associate<a class="headerlink" href="#hipaa-business-associate" title="Link to this heading"></a></h2>
<p>A Business Associate is a person who <strong>creates, receives,
maintains, or transmits ePHI</strong> for a covered entity.</p>
<p>A technical argument the organization can document:</p>
@ -161,7 +160,7 @@ Iceberg credentials.</p></li>
</ul>
</section>
<section id="gdpr-processor-versus-technical-measure">
<h2><span class="section-number">11.3. </span>GDPR — processor versus technical measure<a class="headerlink" href="#gdpr-processor-versus-technical-measure" title="Link to this heading"></a></h2>
<h2><span class="section-number">10.3. </span>GDPR — processor versus technical measure<a class="headerlink" href="#gdpr-processor-versus-technical-measure" title="Link to this heading"></a></h2>
<p>Encrypted data can still be <strong>personal data</strong> if it is
reasonably attributable (usernames, IPs, invoice identity).
GDPR Article 32 lists encryption as a security measure, not
@ -177,7 +176,7 @@ usernames, logs, or billing. Ciphertext-only storage
eliminate the DPA.</p>
</section>
<section id="nats-operators">
<h2><span class="section-number">11.4. </span>NATS operators<a class="headerlink" href="#nats-operators" title="Link to this heading"></a></h2>
<h2><span class="section-number">10.4. </span>NATS operators<a class="headerlink" href="#nats-operators" title="Link to this heading"></a></h2>
<p>NATS is an untrusted broker. Content is HPKE. Destinations
and subjects are in the clear. A NATS operator <strong>cannot</strong>
read bodies without endpoint private keys. They <strong>can</strong> see
@ -187,7 +186,7 @@ DPA or BAA is needed depends on whether routing metadata is
personal data in the relevant jurisdiction.</p>
</section>
<section id="verae-as-timestamping-service">
<h2><span class="section-number">11.5. </span>Verae as timestamping service<a class="headerlink" href="#verae-as-timestamping-service" title="Link to this heading"></a></h2>
<h2><span class="section-number">10.5. </span>Verae as timestamping service<a class="headerlink" href="#verae-as-timestamping-service" title="Link to this heading"></a></h2>
<p>If Verae receives <strong>only fingerprints</strong>, Verae’s role for
<strong>content</strong> is not “stores the records.” Verae’s role is
“registers hashes and issues receipts.” That is a narrower
@ -197,7 +196,7 @@ name, billing, operator emails), requires a DPA or a BAA.
Do not let a sales sentence skip that memo.</p>
</section>
<section id="component-assurance-versus-the-organization-s-report">
<h2><span class="section-number">11.6. </span>Component assurance versus the organization’s report<a class="headerlink" href="#component-assurance-versus-the-organization-s-report" title="Link to this heading"></a></h2>
<h2><span class="section-number">10.6. </span>Component assurance versus the organization’s report<a class="headerlink" href="#component-assurance-versus-the-organization-s-report" title="Link to this heading"></a></h2>
<p>Attaching Cure53 2019 and ROS 2024 is <strong>vendor / component
assurance</strong>. It is appropriate. It is <strong>not</strong> the
organization’s SOC 2, ISO 27001, or HIPAA program. Those

63
build/html/bio-george-lambert.html
View file

@ -5,19 +5,19 @@
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>16. George Lambert &#8212; Making yourself audit-ready with Verae DataCubes</title>
<title>15. George Lambert &#8212; Making yourself audit-ready with Verae DataCubes</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
<link rel="icon" href="_static/VeraeFullLogo.png"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="17. Verae Inc — contact" href="contact.html" />
<link rel="prev" title="15. Stuart Haber" href="bio-stuart-haber.html" />
<link rel="next" title="16. Verae Inc — contact" href="contact.html" />
<link rel="prev" title="14. Stuart Haber" href="bio-stuart-haber.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
@ -61,37 +61,36 @@
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">16. George Lambert</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#role">16.1. Role</a></li>
<li class="toctree-l2"><a class="reference internal" href="#internet-technical-architect-from-1994">16.2. Internet technical architect, from 1994</a></li>
<li class="toctree-l2"><a class="reference internal" href="#new-hampshire-public-office">16.3. New Hampshire public office</a></li>
<li class="toctree-l2"><a class="reference internal" href="#why-this-biography-is-in-the-briefing">16.4. Why this biography is in the briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">15. George Lambert</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#role">15.1. Role</a></li>
<li class="toctree-l2"><a class="reference internal" href="#internet-technical-architect-from-1994">15.2. Internet technical architect, from 1994</a></li>
<li class="toctree-l2"><a class="reference internal" href="#new-hampshire-public-office">15.3. New Hampshire public office</a></li>
<li class="toctree-l2"><a class="reference internal" href="#why-this-biography-is-in-the-briefing">15.4. Why this biography is in the briefing</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
</ul>
<div class="relations">
<h3>Related Topics</h3>
<ul>
<li><a href="index.html">Documentation overview</a><ul>
<li>Previous: <a href="bio-stuart-haber.html" title="previous chapter"><span class="section-number">15. </span>Stuart Haber</a></li>
<li>Next: <a href="contact.html" title="next chapter"><span class="section-number">17. </span>Verae Inc — contact</a></li>
<li>Previous: <a href="bio-stuart-haber.html" title="previous chapter"><span class="section-number">14. </span>Stuart Haber</a></li>
<li>Next: <a href="contact.html" title="next chapter"><span class="section-number">16. </span>Verae Inc — contact</a></li>
</ul></li>
</ul>
</div>
@ -112,9 +111,9 @@
<div class="body" role="main">
<section id="george-lambert">
<h1><span class="section-number">16. </span>George Lambert<a class="headerlink" href="#george-lambert" title="Link to this heading"></a></h1>
<h1><span class="section-number">15. </span>George Lambert<a class="headerlink" href="#george-lambert" title="Link to this heading"></a></h1>
<section id="role">
<h2><span class="section-number">16.1. </span>Role<a class="headerlink" href="#role" title="Link to this heading"></a></h2>
<h2><span class="section-number">15.1. </span>Role<a class="headerlink" href="#role" title="Link to this heading"></a></h2>
<p><strong>George Lambert</strong> is an Internet technical architect and a
New Hampshire public official. Public candidate listings
(BallotReady) identify him as <strong>CTO / Chief Architect, Verae
@ -125,7 +124,7 @@ public-key directory, organizational timestamping link, and
write-once archive that an organization actually runs.</p>
</section>
<section id="internet-technical-architect-from-1994">
<h2><span class="section-number">16.2. </span>Internet technical architect, from 1994<a class="headerlink" href="#internet-technical-architect-from-1994" title="Link to this heading"></a></h2>
<h2><span class="section-number">15.2. </span>Internet technical architect, from 1994<a class="headerlink" href="#internet-technical-architect-from-1994" title="Link to this heading"></a></h2>
<p>Lambert’s public account of his engineering work begins in
the <strong>earliest days of the commercial Internet</strong>, when
shipping an application that could speak TCP/IP was still a
@ -156,7 +155,7 @@ systems, and later as founder of PodKey Solutions
(2004–2010) and as an interim/contract CTO.</p>
</section>
<section id="new-hampshire-public-office">
<h2><span class="section-number">16.3. </span>New Hampshire public office<a class="headerlink" href="#new-hampshire-public-office" title="Link to this heading"></a></h2>
<h2><span class="section-number">15.3. </span>New Hampshire public office<a class="headerlink" href="#new-hampshire-public-office" title="Link to this heading"></a></h2>
<p>Lambert is a <strong>Republican</strong> from <strong>Litchfield, New
Hampshire</strong>, born <strong>4 September 1968</strong> in Sanford, Maine
(Wikipedia; Vote Smart).</p>
@ -183,7 +182,7 @@ Borland fact as the credential for knowing what scalable
architecture looks like.</p>
</section>
<section id="why-this-biography-is-in-the-briefing">
<h2><span class="section-number">16.4. </span>Why this biography is in the briefing<a class="headerlink" href="#why-this-biography-is-in-the-briefing" title="Link to this heading"></a></h2>
<h2><span class="section-number">15.4. </span>Why this biography is in the briefing<a class="headerlink" href="#why-this-biography-is-in-the-briefing" title="Link to this heading"></a></h2>
<p>The DataCube Server Solution is not only a timestamping
API. It is a <strong>running system</strong>: keys, brokers, cryptree,
replicas, admin-history, Iceberg export. Lambert is the

67
build/html/bio-james-garfinkel.html
View file

@ -5,19 +5,19 @@
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>14. James H. Garfinkel &#8212; Making yourself audit-ready with Verae DataCubes</title>
<title>13. James H. Garfinkel &#8212; Making yourself audit-ready with Verae DataCubes</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
<link rel="icon" href="_static/VeraeFullLogo.png"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="15. Stuart Haber" href="bio-stuart-haber.html" />
<link rel="prev" title="13. How to use this briefing" href="howto.html" />
<link rel="next" title="14. Stuart Haber" href="bio-stuart-haber.html" />
<link rel="prev" title="12. How to use this briefing" href="howto.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
@ -61,38 +61,37 @@
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">14. James H. Garfinkel</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#name-and-sources">14.1. Name and sources</a></li>
<li class="toctree-l2"><a class="reference internal" href="#role-at-verae">14.2. Role at Verae</a></li>
<li class="toctree-l2"><a class="reference internal" href="#finra-brokercheck-crd-5052743">14.3. FINRA BrokerCheck (CRD 5052743)</a></li>
<li class="toctree-l2"><a class="reference internal" href="#education-public-professional-listings">14.4. Education (public professional listings)</a></li>
<li class="toctree-l2"><a class="reference internal" href="#why-this-biography-is-in-the-briefing">14.5. Why this biography is in the briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">13. James H. Garfinkel</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#name-and-sources">13.1. Name and sources</a></li>
<li class="toctree-l2"><a class="reference internal" href="#role-at-verae">13.2. Role at Verae</a></li>
<li class="toctree-l2"><a class="reference internal" href="#finra-brokercheck-crd-5052743">13.3. FINRA BrokerCheck (CRD 5052743)</a></li>
<li class="toctree-l2"><a class="reference internal" href="#education-public-professional-listings">13.4. Education (public professional listings)</a></li>
<li class="toctree-l2"><a class="reference internal" href="#why-this-biography-is-in-the-briefing">13.5. Why this biography is in the briefing</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
</ul>
<div class="relations">
<h3>Related Topics</h3>
<ul>
<li><a href="index.html">Documentation overview</a><ul>
<li>Previous: <a href="howto.html" title="previous chapter"><span class="section-number">13. </span>How to use this briefing</a></li>
<li>Next: <a href="bio-stuart-haber.html" title="next chapter"><span class="section-number">15. </span>Stuart Haber</a></li>
<li>Previous: <a href="howto.html" title="previous chapter"><span class="section-number">12. </span>How to use this briefing</a></li>
<li>Next: <a href="bio-stuart-haber.html" title="next chapter"><span class="section-number">14. </span>Stuart Haber</a></li>
</ul></li>
</ul>
</div>
@ -113,9 +112,9 @@
<div class="body" role="main">
<section id="james-h-garfinkel">
<h1><span class="section-number">14. </span>James H. Garfinkel<a class="headerlink" href="#james-h-garfinkel" title="Link to this heading"></a></h1>
<h1><span class="section-number">13. </span>James H. Garfinkel<a class="headerlink" href="#james-h-garfinkel" title="Link to this heading"></a></h1>
<section id="name-and-sources">
<h2><span class="section-number">14.1. </span>Name and sources<a class="headerlink" href="#name-and-sources" title="Link to this heading"></a></h2>
<h2><span class="section-number">13.1. </span>Name and sources<a class="headerlink" href="#name-and-sources" title="Link to this heading"></a></h2>
<p>This chapter summarizes <strong>James H. Garfinkel</strong> (the spelling on
the FINRA BrokerCheck individual report; also styled Garfinkle
in some informal references). Two public sources were used, as
@ -133,7 +132,7 @@ fabricated “about the CEO” page.</p></li>
</ul>
</section>
<section id="role-at-verae">
<h2><span class="section-number">14.2. </span>Role at Verae<a class="headerlink" href="#role-at-verae" title="Link to this heading"></a></h2>
<h2><span class="section-number">13.2. </span>Role at Verae<a class="headerlink" href="#role-at-verae" title="Link to this heading"></a></h2>
<p>Public professional listings (including a long-standing
Facebook work listing) identify Garfinkel as <strong>CEO of Verae
LLC</strong>, from <strong>January 2020</strong>, based in <strong>New York, New York</strong>.
@ -150,7 +149,7 @@ timestamping, aimed at compliance and examinations rather than
at operating a public chain.</p>
</section>
<section id="finra-brokercheck-crd-5052743">
<h2><span class="section-number">14.3. </span>FINRA BrokerCheck (CRD 5052743)<a class="headerlink" href="#finra-brokercheck-crd-5052743" title="Link to this heading"></a></h2>
<h2><span class="section-number">13.3. </span>FINRA BrokerCheck (CRD 5052743)<a class="headerlink" href="#finra-brokercheck-crd-5052743" title="Link to this heading"></a></h2>
<p>The following facts are from the public BrokerCheck report.
They are <strong>registration history</strong>, not a Verae claim and not an
endorsement by FINRA.</p>
@ -184,7 +183,7 @@ from November 2009) and <strong>MPWM Advisory Solutions LLC</strong>
registration status changes.</p>
</section>
<section id="education-public-professional-listings">
<h2><span class="section-number">14.4. </span>Education (public professional listings)<a class="headerlink" href="#education-public-professional-listings" title="Link to this heading"></a></h2>
<h2><span class="section-number">13.4. </span>Education (public professional listings)<a class="headerlink" href="#education-public-professional-listings" title="Link to this heading"></a></h2>
<p>Public professional listings state:</p>
<ul class="simple">
<li><p><strong>Hamilton College</strong>, B.A. Economics, class of <strong>1980</strong></p></li>
@ -198,7 +197,7 @@ who searches the name is not surprised. They are not used as
primary evidence of Verae corporate structure.</p>
</section>
<section id="why-this-biography-is-in-the-briefing">
<h2><span class="section-number">14.5. </span>Why this biography is in the briefing<a class="headerlink" href="#why-this-biography-is-in-the-briefing" title="Link to this heading"></a></h2>
<h2><span class="section-number">13.5. </span>Why this biography is in the briefing<a class="headerlink" href="#why-this-biography-is-in-the-briefing" title="Link to this heading"></a></h2>
<p>A compliance briefing is not a pitch deck. Garfinkel’s
biography is here because the user of this system is entitled
to know <strong>who is on the commercial and regulatory-facing side

67
build/html/bio-stuart-haber.html
View file

@ -5,19 +5,19 @@
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>15. Stuart Haber &#8212; Making yourself audit-ready with Verae DataCubes</title>
<title>14. Stuart Haber &#8212; Making yourself audit-ready with Verae DataCubes</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
<link rel="icon" href="_static/VeraeFullLogo.png"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="16. George Lambert" href="bio-george-lambert.html" />
<link rel="prev" title="14. James H. Garfinkel" href="bio-james-garfinkel.html" />
<link rel="next" title="15. George Lambert" href="bio-george-lambert.html" />
<link rel="prev" title="13. James H. Garfinkel" href="bio-james-garfinkel.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
@ -61,38 +61,37 @@
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">15. Stuart Haber</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#role-at-verae">15.1. Role at Verae</a></li>
<li class="toctree-l2"><a class="reference internal" href="#the-scientific-work">15.2. The scientific work</a></li>
<li class="toctree-l2"><a class="reference internal" href="#surety-1994-first-commercial-blockchain">15.3. Surety, 1994: first commercial blockchain</a></li>
<li class="toctree-l2"><a class="reference internal" href="#other-cryptographic-publications">15.4. Other cryptographic publications</a></li>
<li class="toctree-l2"><a class="reference internal" href="#why-this-biography-is-in-the-briefing">15.5. Why this biography is in the briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">14. Stuart Haber</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#role-at-verae">14.1. Role at Verae</a></li>
<li class="toctree-l2"><a class="reference internal" href="#the-scientific-work">14.2. The scientific work</a></li>
<li class="toctree-l2"><a class="reference internal" href="#surety-1994-first-commercial-blockchain">14.3. Surety, 1994: first commercial blockchain</a></li>
<li class="toctree-l2"><a class="reference internal" href="#other-cryptographic-publications">14.4. Other cryptographic publications</a></li>
<li class="toctree-l2"><a class="reference internal" href="#why-this-biography-is-in-the-briefing">14.5. Why this biography is in the briefing</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
</ul>
<div class="relations">
<h3>Related Topics</h3>
<ul>
<li><a href="index.html">Documentation overview</a><ul>
<li>Previous: <a href="bio-james-garfinkel.html" title="previous chapter"><span class="section-number">14. </span>James H. Garfinkel</a></li>
<li>Next: <a href="bio-george-lambert.html" title="next chapter"><span class="section-number">16. </span>George Lambert</a></li>
<li>Previous: <a href="bio-james-garfinkel.html" title="previous chapter"><span class="section-number">13. </span>James H. Garfinkel</a></li>
<li>Next: <a href="bio-george-lambert.html" title="next chapter"><span class="section-number">15. </span>George Lambert</a></li>
</ul></li>
</ul>
</div>
@ -113,9 +112,9 @@
<div class="body" role="main">
<section id="stuart-haber">
<h1><span class="section-number">15. </span>Stuart Haber<a class="headerlink" href="#stuart-haber" title="Link to this heading"></a></h1>
<h1><span class="section-number">14. </span>Stuart Haber<a class="headerlink" href="#stuart-haber" title="Link to this heading"></a></h1>
<section id="role-at-verae">
<h2><span class="section-number">15.1. </span>Role at Verae<a class="headerlink" href="#role-at-verae" title="Link to this heading"></a></h2>
<h2><span class="section-number">14.1. </span>Role at Verae<a class="headerlink" href="#role-at-verae" title="Link to this heading"></a></h2>
<p><strong>Stuart Haber</strong> is a <strong>co-founder of Verae</strong>. The company’s
public site introduces him as one of the creators of
blockchain and as the inventor, in 1991, of cryptographic
@ -136,7 +135,7 @@ remaining in the customer’s storage and only a fingerprint
being sealed.</p>
</section>
<section id="the-scientific-work">
<h2><span class="section-number">15.2. </span>The scientific work<a class="headerlink" href="#the-scientific-work" title="Link to this heading"></a></h2>
<h2><span class="section-number">14.2. </span>The scientific work<a class="headerlink" href="#the-scientific-work" title="Link to this heading"></a></h2>
<p>Haber is a cryptographer. He worked at <strong>Bellcore</strong> (Bell
Communications Research) in Morristown, New Jersey, in the
late 1980s and 1990s, in the research culture descended from
@ -173,7 +172,7 @@ data structure itself. That is a historical statement, not a
claim that Verae is Bitcoin.</p>
</section>
<section id="surety-1994-first-commercial-blockchain">
<h2><span class="section-number">15.3. </span>Surety, 1994: first commercial blockchain<a class="headerlink" href="#surety-1994-first-commercial-blockchain" title="Link to this heading"></a></h2>
<h2><span class="section-number">14.3. </span>Surety, 1994: first commercial blockchain<a class="headerlink" href="#surety-1994-first-commercial-blockchain" title="Link to this heading"></a></h2>
<p>Haber and Stornetta took the research into production as
<strong>Surety</strong>. Surety hashed customer documents, linked those
hashes in a chain of certificates, and published a weekly
@ -187,7 +186,7 @@ witnessed record, without revealing the documents</strong> — is
the same idea Verae productizes for enterprise compliance.</p>
</section>
<section id="other-cryptographic-publications">
<h2><span class="section-number">15.4. </span>Other cryptographic publications<a class="headerlink" href="#other-cryptographic-publications" title="Link to this heading"></a></h2>
<h2><span class="section-number">14.4. </span>Other cryptographic publications<a class="headerlink" href="#other-cryptographic-publications" title="Link to this heading"></a></h2>
<p>Haber’s research record is broader than timestamping. It
includes work on minimum-knowledge interactive proofs,
symmetric public-key encryption, and secure multi-party
@ -198,7 +197,7 @@ three Bitcoin-cited papers and the 1991 <em>Journal of
Cryptology</em> article, then the ACM CCS 1997 paper.</p>
</section>
<section id="why-this-biography-is-in-the-briefing">
<h2><span class="section-number">15.5. </span>Why this biography is in the briefing<a class="headerlink" href="#why-this-biography-is-in-the-briefing" title="Link to this heading"></a></h2>
<h2><span class="section-number">14.5. </span>Why this biography is in the briefing<a class="headerlink" href="#why-this-biography-is-in-the-briefing" title="Link to this heading"></a></h2>
<p>Timestamping in this document is not a metaphor. It is a
specific scientific object — hash, time, sequence, privacy
of the document from the notary — that Haber defined in

79
build/html/checklist.html
View file

@ -5,19 +5,19 @@
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>12. Audit-ready checklist &#8212; Making yourself audit-ready with Verae DataCubes</title>
<title>11. Audit-ready checklist &#8212; Making yourself audit-ready with Verae DataCubes</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
<link rel="icon" href="_static/VeraeFullLogo.png"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="13. How to use this briefing" href="howto.html" />
<link rel="prev" title="11. BAAs, DPAs, and ciphertext without host keys" href="baa-dpa.html" />
<link rel="next" title="12. How to use this briefing" href="howto.html" />
<link rel="prev" title="10. BAAs, DPAs, and ciphertext without host keys" href="baa-dpa.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
@ -61,41 +61,40 @@
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">12. Audit-ready checklist</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#a-scope-and-honesty">12.1. A. Scope and honesty</a></li>
<li class="toctree-l2"><a class="reference internal" href="#b-data-in-transit">12.2. B. Data in transit</a></li>
<li class="toctree-l2"><a class="reference internal" href="#c-data-at-rest">12.3. C. Data at rest</a></li>
<li class="toctree-l2"><a class="reference internal" href="#d-timestamping">12.4. D. Timestamping</a></li>
<li class="toctree-l2"><a class="reference internal" href="#e-write-once-archive">12.5. E. Write-once archive</a></li>
<li class="toctree-l2"><a class="reference internal" href="#f-access-and-change">12.6. F. Access and change</a></li>
<li class="toctree-l2"><a class="reference internal" href="#g-contracts-counsel">12.7. G. Contracts (counsel)</a></li>
<li class="toctree-l2"><a class="reference internal" href="#h-independent-examination-of-this-organization">12.8. H. Independent examination of <em>this</em> organization</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">11. Audit-ready checklist</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#a-scope-and-honesty">11.1. A. Scope and honesty</a></li>
<li class="toctree-l2"><a class="reference internal" href="#b-data-in-transit">11.2. B. Data in transit</a></li>
<li class="toctree-l2"><a class="reference internal" href="#c-data-at-rest">11.3. C. Data at rest</a></li>
<li class="toctree-l2"><a class="reference internal" href="#d-timestamping">11.4. D. Timestamping</a></li>
<li class="toctree-l2"><a class="reference internal" href="#e-write-once-archive">11.5. E. Write-once archive</a></li>
<li class="toctree-l2"><a class="reference internal" href="#f-access-and-change">11.6. F. Access and change</a></li>
<li class="toctree-l2"><a class="reference internal" href="#g-contracts-counsel">11.7. G. Contracts (counsel)</a></li>
<li class="toctree-l2"><a class="reference internal" href="#h-independent-examination-of-this-organization">11.8. H. Independent examination of <em>this</em> organization</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
</ul>
<div class="relations">
<h3>Related Topics</h3>
<ul>
<li><a href="index.html">Documentation overview</a><ul>
<li>Previous: <a href="baa-dpa.html" title="previous chapter"><span class="section-number">11. </span>BAAs, DPAs, and ciphertext without host keys</a></li>
<li>Next: <a href="howto.html" title="next chapter"><span class="section-number">13. </span>How to use this briefing</a></li>
<li>Previous: <a href="baa-dpa.html" title="previous chapter"><span class="section-number">10. </span>BAAs, DPAs, and ciphertext without host keys</a></li>
<li>Next: <a href="howto.html" title="next chapter"><span class="section-number">12. </span>How to use this briefing</a></li>
</ul></li>
</ul>
</div>
@ -116,13 +115,13 @@
<div class="body" role="main">
<section id="audit-ready-checklist">
<h1><span class="section-number">12. </span>Audit-ready checklist<a class="headerlink" href="#audit-ready-checklist" title="Link to this heading"></a></h1>
<h1><span class="section-number">11. </span>Audit-ready checklist<a class="headerlink" href="#audit-ready-checklist" title="Link to this heading"></a></h1>
<p>Use this as a working list. Check an item only when
<strong>evidence exists</strong> (screenshot, log export, signed policy,
ticket, receipt). This list is not a certificate. Software
having been installed does not tick these boxes.</p>
<section id="a-scope-and-honesty">
<h2><span class="section-number">12.1. </span>A. Scope and honesty<a class="headerlink" href="#a-scope-and-honesty" title="Link to this heading"></a></h2>
<h2><span class="section-number">11.1. </span>A. Scope and honesty<a class="headerlink" href="#a-scope-and-honesty" title="Link to this heading"></a></h2>
<ul class="simple">
<li><p>Named legal entity and systems in scope (console, Drive,
message fabric, IPFS, timestamping link, Iceberg archive)</p></li>
@ -137,7 +136,7 @@ security evaluation</strong></p></li>
</ul>
</section>
<section id="b-data-in-transit">
<h2><span class="section-number">12.2. </span>B. Data in transit<a class="headerlink" href="#b-data-in-transit" title="Link to this heading"></a></h2>
<h2><span class="section-number">11.2. </span>B. Data in transit<a class="headerlink" href="#b-data-in-transit" title="Link to this heading"></a></h2>
<ul class="simple">
<li><p>Production algorithm is HPKE (or documented successor),
not a lab construction</p></li>
@ -150,7 +149,7 @@ mode 0600 or HSM</p></li>
</ul>
</section>
<section id="c-data-at-rest">
<h2><span class="section-number">12.3. </span>C. Data at rest<a class="headerlink" href="#c-data-at-rest" title="Link to this heading"></a></h2>
<h2><span class="section-number">11.3. </span>C. Data at rest<a class="headerlink" href="#c-data-at-rest" title="Link to this heading"></a></h2>
<ul class="simple">
<li><p>Customer holds Peergos / Drive keys; not on storage host</p></li>
<li><p>Peergos hash verification on write and on read, evidenced</p></li>
@ -160,7 +159,7 @@ ciphertext <strong>without</strong> a plaintext tape</p></li>
</ul>
</section>
<section id="d-timestamping">
<h2><span class="section-number">12.4. </span>D. Timestamping<a class="headerlink" href="#d-timestamping" title="Link to this heading"></a></h2>
<h2><span class="section-number">11.4. </span>D. Timestamping<a class="headerlink" href="#d-timestamping" title="Link to this heading"></a></h2>
<ul class="simple">
<li><p>First-registration rule documented and tested (second
submit returns original receipt)</p></li>
@ -173,7 +172,7 @@ the data map</p></li>
</ul>
</section>
<section id="e-write-once-archive">
<h2><span class="section-number">12.5. </span>E. Write-once archive<a class="headerlink" href="#e-write-once-archive" title="Link to this heading"></a></h2>
<h2><span class="section-number">11.5. </span>E. Write-once archive<a class="headerlink" href="#e-write-once-archive" title="Link to this heading"></a></h2>
<ul class="simple">
<li><p>Iceberg (or equivalent) export job exists and has a dated
last-run</p></li>
@ -185,7 +184,7 @@ engineering folklore</p></li>
</ul>
</section>
<section id="f-access-and-change">
<h2><span class="section-number">12.6. </span>F. Access and change<a class="headerlink" href="#f-access-and-change" title="Link to this heading"></a></h2>
<h2><span class="section-number">11.6. </span>F. Access and change<a class="headerlink" href="#f-access-and-change" title="Link to this heading"></a></h2>
<ul class="simple">
<li><p>Console requires authentication (TOTP or equivalent);
Drive login is a separate plane</p></li>
@ -197,7 +196,7 @@ prev + new + diff</p></li>
</ul>
</section>
<section id="g-contracts-counsel">
<h2><span class="section-number">12.7. </span>G. Contracts (counsel)<a class="headerlink" href="#g-contracts-counsel" title="Link to this heading"></a></h2>
<h2><span class="section-number">11.7. </span>G. Contracts (counsel)<a class="headerlink" href="#g-contracts-counsel" title="Link to this heading"></a></h2>
<ul class="simple">
<li><p>Written BA / not-a-BA determination for disk, VM, backup,
IPFS, Iceberg</p></li>
@ -208,7 +207,7 @@ IPFS, Iceberg</p></li>
</ul>
</section>
<section id="h-independent-examination-of-this-organization">
<h2><span class="section-number">12.8. </span>H. Independent examination of <em>this</em> organization<a class="headerlink" href="#h-independent-examination-of-this-organization" title="Link to this heading"></a></h2>
<h2><span class="section-number">11.8. </span>H. Independent examination of <em>this</em> organization<a class="headerlink" href="#h-independent-examination-of-this-organization" title="Link to this heading"></a></h2>
<ul class="simple">
<li><p>SOC 2 Type I/II engagement, <strong>or</strong> ISO 27001 registrar,
<strong>or</strong> HIPAA risk analysis plus policies — <strong>the program

47
build/html/contact.html
View file

@ -5,18 +5,18 @@
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>17. Verae Inc — contact &#8212; Making yourself audit-ready with Verae DataCubes</title>
<title>16. Verae Inc — contact &#8212; Making yourself audit-ready with Verae DataCubes</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
<link rel="icon" href="_static/VeraeFullLogo.png"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="prev" title="16. George Lambert" href="bio-george-lambert.html" />
<link rel="prev" title="15. George Lambert" href="bio-george-lambert.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
@ -60,24 +60,23 @@
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">17. Verae Inc — contact</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#closing-reminder">17.1. Closing reminder</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">16. Verae Inc — contact</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#closing-reminder">16.1. Closing reminder</a></li>
</ul>
</li>
</ul>
@ -86,7 +85,7 @@
<h3>Related Topics</h3>
<ul>
<li><a href="index.html">Documentation overview</a><ul>
<li>Previous: <a href="bio-george-lambert.html" title="previous chapter"><span class="section-number">16. </span>George Lambert</a></li>
<li>Previous: <a href="bio-george-lambert.html" title="previous chapter"><span class="section-number">15. </span>George Lambert</a></li>
</ul></li>
</ul>
</div>
@ -107,7 +106,7 @@
<div class="body" role="main">
<section id="verae-inc-contact">
<h1><span class="section-number">17. </span>Verae Inc — contact<a class="headerlink" href="#verae-inc-contact" title="Link to this heading"></a></h1>
<h1><span class="section-number">16. </span>Verae Inc — contact<a class="headerlink" href="#verae-inc-contact" title="Link to this heading"></a></h1>
<p>This page is the contact block that also appears in the
footer of every page of the PDF edition and at the bottom
of every HTML chapter.</p>
@ -129,7 +128,7 @@ here</strong>. If a procurement file requires them, take them from
a current Verae engagement letter, W-9, or the form on
verae.com, not from this paragraph.</p>
<section id="closing-reminder">
<h2><span class="section-number">17.1. </span>Closing reminder<a class="headerlink" href="#closing-reminder" title="Link to this heading"></a></h2>
<h2><span class="section-number">16.1. </span>Closing reminder<a class="headerlink" href="#closing-reminder" title="Link to this heading"></a></h2>
<p>Software alone does not make an organization HIPAA
certified, SOC 2 attested, or ISO 27001 certified.</p>
<p>The Verae DataCube Solution gives you tools to store,

75
build/html/data-at-rest.html
View file

@ -5,19 +5,19 @@
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>5. Encryption at rest — IPFS blocks and Peergos &#8212; Making yourself audit-ready with Verae DataCubes</title>
<title>4. Encryption at rest — IPFS blocks and Peergos &#8212; Making yourself audit-ready with Verae DataCubes</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
<link rel="icon" href="_static/VeraeFullLogo.png"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="6. Global timestamped receipts" href="timestamped-receipts.html" />
<link rel="prev" title="4. Secure communications — data in transit" href="data-in-transit.html" />
<link rel="next" title="5. Global timestamped receipts" href="timestamped-receipts.html" />
<link rel="prev" title="3. Secure communications — data in transit" href="data-in-transit.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
@ -61,40 +61,39 @@
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">5. Encryption at rest — IPFS blocks and Peergos</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#the-problem">5.1. The problem</a></li>
<li class="toctree-l2"><a class="reference internal" href="#content-addressed-blocks">5.2. Content-addressed blocks</a></li>
<li class="toctree-l2"><a class="reference internal" href="#peergos-on-top-of-ipfs">5.3. Peergos on top of IPFS</a></li>
<li class="toctree-l2"><a class="reference internal" href="#tamper-evident-restore">5.4. Tamper-evident restore</a></li>
<li class="toctree-l2"><a class="reference internal" href="#append-only-at-the-cube-layer">5.5. Append-only at the cube layer</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-a-disk-operator-sees">5.6. What a disk operator sees</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-this-does-and-does-not-satisfy">5.7. What this does, and does not, satisfy</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">4. Encryption at rest — IPFS blocks and Peergos</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#the-problem">4.1. The problem</a></li>
<li class="toctree-l2"><a class="reference internal" href="#content-addressed-blocks">4.2. Content-addressed blocks</a></li>
<li class="toctree-l2"><a class="reference internal" href="#peergos-on-top-of-ipfs">4.3. Peergos on top of IPFS</a></li>
<li class="toctree-l2"><a class="reference internal" href="#tamper-evident-restore">4.4. Tamper-evident restore</a></li>
<li class="toctree-l2"><a class="reference internal" href="#append-only-at-the-cube-layer">4.5. Append-only at the cube layer</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-a-disk-operator-sees">4.6. What a disk operator sees</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-this-does-and-does-not-satisfy">4.7. What this does, and does not, satisfy</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
</ul>
<div class="relations">
<h3>Related Topics</h3>
<ul>
<li><a href="index.html">Documentation overview</a><ul>
<li>Previous: <a href="data-in-transit.html" title="previous chapter"><span class="section-number">4. </span>Secure communications — data in transit</a></li>
<li>Next: <a href="timestamped-receipts.html" title="next chapter"><span class="section-number">6. </span>Global timestamped receipts</a></li>
<li>Previous: <a href="data-in-transit.html" title="previous chapter"><span class="section-number">3. </span>Secure communications — data in transit</a></li>
<li>Next: <a href="timestamped-receipts.html" title="next chapter"><span class="section-number">5. </span>Global timestamped receipts</a></li>
</ul></li>
</ul>
</div>
@ -115,9 +114,9 @@
<div class="body" role="main">
<section id="encryption-at-rest-ipfs-blocks-and-peergos">
<h1><span class="section-number">5. </span>Encryption at rest — IPFS blocks and Peergos<a class="headerlink" href="#encryption-at-rest-ipfs-blocks-and-peergos" title="Link to this heading"></a></h1>
<h1><span class="section-number">4. </span>Encryption at rest — IPFS blocks and Peergos<a class="headerlink" href="#encryption-at-rest-ipfs-blocks-and-peergos" title="Link to this heading"></a></h1>
<section id="the-problem">
<h2><span class="section-number">5.1. </span>The problem<a class="headerlink" href="#the-problem" title="Link to this heading"></a></h2>
<h2><span class="section-number">4.1. </span>The problem<a class="headerlink" href="#the-problem" title="Link to this heading"></a></h2>
<p>Bytes that are no longer moving still have to live somewhere: a
disk, a replica, a backup, a cold archive. The people who operate
those surfaces — hosting providers, backup operators, someone
@ -132,7 +131,7 @@ even if it keeps confidentiality.</p>
verifying hashes on the way in and the way out.</p>
</section>
<section id="content-addressed-blocks">
<h2><span class="section-number">5.2. </span>Content-addressed blocks<a class="headerlink" href="#content-addressed-blocks" title="Link to this heading"></a></h2>
<h2><span class="section-number">4.2. </span>Content-addressed blocks<a class="headerlink" href="#content-addressed-blocks" title="Link to this heading"></a></h2>
<p>IPFS names a block by a cryptographic hash of its contents (a
Content Identifier, or CID). Two properties follow immediately:</p>
<ul class="simple">
@ -148,7 +147,7 @@ prevent a hostile replica from refusing to serve a block
serving a substitute and hoping nobody notices (integrity).</p>
</section>
<section id="peergos-on-top-of-ipfs">
<h2><span class="section-number">5.3. </span>Peergos on top of IPFS<a class="headerlink" href="#peergos-on-top-of-ipfs" title="Link to this heading"></a></h2>
<h2><span class="section-number">4.3. </span>Peergos on top of IPFS<a class="headerlink" href="#peergos-on-top-of-ipfs" title="Link to this heading"></a></h2>
<p>Peergos is not “IPFS with a folder UI.” It is an encrypted
filesystem — a <strong>cryptree</strong> — whose nodes and file chunks are
stored as IPFS blocks. The properties that matter for an
@ -177,7 +176,7 @@ without placing the chunk key on the server.</p></li>
</ul>
</section>
<section id="tamper-evident-restore">
<h2><span class="section-number">5.4. </span>Tamper-evident restore<a class="headerlink" href="#tamper-evident-restore" title="Link to this heading"></a></h2>
<h2><span class="section-number">4.4. </span>Tamper-evident restore<a class="headerlink" href="#tamper-evident-restore" title="Link to this heading"></a></h2>
<p>“Backup” in this architecture does not mean a second plaintext
copy in a different building. It means:</p>
<ol class="arabic simple">
@ -194,7 +193,7 @@ plaintext it had. Helpfulness of that kind is how silent
corruption and silent substitution enter an evidence set.</p>
</section>
<section id="append-only-at-the-cube-layer">
<h2><span class="section-number">5.5. </span>Append-only at the cube layer<a class="headerlink" href="#append-only-at-the-cube-layer" title="Link to this heading"></a></h2>
<h2><span class="section-number">4.5. </span>Append-only at the cube layer<a class="headerlink" href="#append-only-at-the-cube-layer" title="Link to this heading"></a></h2>
<p>Peergos itself uses signed updates and immutable blocks. The
Verae DataCube adds an <strong>application-level chain</strong>: a JSONL
history in which each record hashes the previous record. Dual
@ -212,7 +211,7 @@ of writes is append-only at the application layer.</p></li>
<p>Both are needed. Neither is a SOC 2 report.</p>
</section>
<section id="what-a-disk-operator-sees">
<h2><span class="section-number">5.6. </span>What a disk operator sees<a class="headerlink" href="#what-a-disk-operator-sees" title="Link to this heading"></a></h2>
<h2><span class="section-number">4.6. </span>What a disk operator sees<a class="headerlink" href="#what-a-disk-operator-sees" title="Link to this heading"></a></h2>
<p>If keys never leave the client or the customer’s HSM, a disk
operator, a VM snapshot operator, and an offsite replica operator
see <strong>opaque hashed ciphertext</strong>. They do not see PHI, they do
@ -224,7 +223,7 @@ addresses, billing identity, and support logs can still be
personal data. Chapter 11 takes that up.</p>
</section>
<section id="what-this-does-and-does-not-satisfy">
<h2><span class="section-number">5.7. </span>What this does, and does not, satisfy<a class="headerlink" href="#what-this-does-and-does-not-satisfy" title="Link to this heading"></a></h2>
<h2><span class="section-number">4.7. </span>What this does, and does not, satisfy<a class="headerlink" href="#what-this-does-and-does-not-satisfy" title="Link to this heading"></a></h2>
<p>For HIPAA encryption of ePHI <strong>at rest</strong>, for SOC 2 CC6
encryption of stored data, and for ISO 27001 Annex A cryptography
and storage, this is the <strong>technical control</strong>: ciphertext on

71
build/html/data-in-transit.html
View file

@ -5,19 +5,19 @@
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>4. Secure communications — data in transit &#8212; Making yourself audit-ready with Verae DataCubes</title>
<title>3. Secure communications — data in transit &#8212; Making yourself audit-ready with Verae DataCubes</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
<link rel="icon" href="_static/VeraeFullLogo.png"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="5. Encryption at rest — IPFS blocks and Peergos" href="data-at-rest.html" />
<link rel="prev" title="3. The Verae DataCube Server Solution" href="datacube-server.html" />
<link rel="next" title="4. Encryption at rest — IPFS blocks and Peergos" href="data-at-rest.html" />
<link rel="prev" title="2. The Verae DataCube Server Solution" href="datacube-server.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
@ -61,39 +61,38 @@
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">4. Secure communications — data in transit</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#the-problem">4.1. The problem</a></li>
<li class="toctree-l2"><a class="reference internal" href="#point-to-point-encryption">4.2. Point-to-point encryption</a></li>
<li class="toctree-l2"><a class="reference internal" href="#visible-routing">4.3. Visible routing</a></li>
<li class="toctree-l2"><a class="reference internal" href="#error-handling-without-leaking-content">4.4. Error handling without leaking content</a></li>
<li class="toctree-l2"><a class="reference internal" href="#the-public-key-directory">4.5. The public-key directory</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-this-does-and-does-not-satisfy">4.6. What this does, and does not, satisfy</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">3. Secure communications — data in transit</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#the-problem">3.1. The problem</a></li>
<li class="toctree-l2"><a class="reference internal" href="#point-to-point-encryption">3.2. Point-to-point encryption</a></li>
<li class="toctree-l2"><a class="reference internal" href="#visible-routing">3.3. Visible routing</a></li>
<li class="toctree-l2"><a class="reference internal" href="#error-handling-without-leaking-content">3.4. Error handling without leaking content</a></li>
<li class="toctree-l2"><a class="reference internal" href="#the-public-key-directory">3.5. The public-key directory</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-this-does-and-does-not-satisfy">3.6. What this does, and does not, satisfy</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
</ul>
<div class="relations">
<h3>Related Topics</h3>
<ul>
<li><a href="index.html">Documentation overview</a><ul>
<li>Previous: <a href="datacube-server.html" title="previous chapter"><span class="section-number">3. </span>The Verae DataCube Server Solution</a></li>
<li>Next: <a href="data-at-rest.html" title="next chapter"><span class="section-number">5. </span>Encryption at rest — IPFS blocks and Peergos</a></li>
<li>Previous: <a href="datacube-server.html" title="previous chapter"><span class="section-number">2. </span>The Verae DataCube Server Solution</a></li>
<li>Next: <a href="data-at-rest.html" title="next chapter"><span class="section-number">4. </span>Encryption at rest — IPFS blocks and Peergos</a></li>
</ul></li>
</ul>
</div>
@ -114,9 +113,9 @@
<div class="body" role="main">
<section id="secure-communications-data-in-transit">
<h1><span class="section-number">4. </span>Secure communications — data in transit<a class="headerlink" href="#secure-communications-data-in-transit" title="Link to this heading"></a></h1>
<h1><span class="section-number">3. </span>Secure communications — data in transit<a class="headerlink" href="#secure-communications-data-in-transit" title="Link to this heading"></a></h1>
<section id="the-problem">
<h2><span class="section-number">4.1. </span>The problem<a class="headerlink" href="#the-problem" title="Link to this heading"></a></h2>
<h2><span class="section-number">3.1. </span>The problem<a class="headerlink" href="#the-problem" title="Link to this heading"></a></h2>
<p>A message that leaves one machine and arrives at another crosses
infrastructure the endpoints do not own: routers, load balancers,
message brokers, TLS terminators, packet-capture appliances, and
@ -129,7 +128,7 @@ they see, and <strong>what</strong> will they be able to do with it.”</p>
that <strong>routing must be visible</strong>.</p>
</section>
<section id="point-to-point-encryption">
<h2><span class="section-number">4.2. </span>Point-to-point encryption<a class="headerlink" href="#point-to-point-encryption" title="Link to this heading"></a></h2>
<h2><span class="section-number">3.2. </span>Point-to-point encryption<a class="headerlink" href="#point-to-point-encryption" title="Link to this heading"></a></h2>
<p>“Best in class” here is not a slogan; it names a concrete choice.
Production content is sealed with <strong>HPKE</strong> (Hybrid Public Key
Encryption, RFC 9180), in the HPKE-Base mode, using a suite such as
@ -152,7 +151,7 @@ configurations reject it.</p></li>
</ul>
</section>
<section id="visible-routing">
<h2><span class="section-number">4.3. </span>Visible routing<a class="headerlink" href="#visible-routing" title="Link to this heading"></a></h2>
<h2><span class="section-number">3.3. </span>Visible routing<a class="headerlink" href="#visible-routing" title="Link to this heading"></a></h2>
<p>A network that cannot see a destination cannot deliver a message.
The DataCube Server Solution therefore does <strong>not</strong> claim
anonymous, metadata-free messaging. The following remain visible
@ -171,7 +170,7 @@ broker forwards what it is given; it is <strong>not</strong> trusted with
content, and it is <strong>not</strong> trusted not to log destinations.</p>
</section>
<section id="error-handling-without-leaking-content">
<h2><span class="section-number">4.4. </span>Error handling without leaking content<a class="headerlink" href="#error-handling-without-leaking-content" title="Link to this heading"></a></h2>
<h2><span class="section-number">3.4. </span>Error handling without leaking content<a class="headerlink" href="#error-handling-without-leaking-content" title="Link to this heading"></a></h2>
<p>Failures have to be reported. A bounce that includes the original
body would undo the encryption. The design therefore returns
<strong>error metadata</strong>: an error code, a lookup identifier, a
@ -183,7 +182,7 @@ without broadcasting the payload to operators who should never see
it.</p>
</section>
<section id="the-public-key-directory">
<h2><span class="section-number">4.5. </span>The public-key directory<a class="headerlink" href="#the-public-key-directory" title="Link to this heading"></a></h2>
<h2><span class="section-number">3.5. </span>The public-key directory<a class="headerlink" href="#the-public-key-directory" title="Link to this heading"></a></h2>
<p>Point-to-point encryption is only as good as the lookup of public
keys. The server solution publishes a <strong>directory of public keys</strong>
so that availability of those keys is visible to all E2E services.
@ -194,7 +193,7 @@ never returned by the public listing API.</p>
never be given a private key.</p>
</section>
<section id="what-this-does-and-does-not-satisfy">
<h2><span class="section-number">4.6. </span>What this does, and does not, satisfy<a class="headerlink" href="#what-this-does-and-does-not-satisfy" title="Link to this heading"></a></h2>
<h2><span class="section-number">3.6. </span>What this does, and does not, satisfy<a class="headerlink" href="#what-this-does-and-does-not-satisfy" title="Link to this heading"></a></h2>
<p>For HIPAA Security Rule addressable encryption of ePHI <strong>in
transit</strong>, for SOC 2 CC6 cryptographic transmission, and for
ISO 27001 Annex A transmission security, this design is the

67
build/html/datacube-server.html
View file

@ -5,19 +5,19 @@
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>3. The Verae DataCube Server Solution &#8212; Making yourself audit-ready with Verae DataCubes</title>
<title>2. The Verae DataCube Server Solution &#8212; Making yourself audit-ready with Verae DataCubes</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
<link rel="icon" href="_static/VeraeFullLogo.png"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="4. Secure communications — data in transit" href="data-in-transit.html" />
<link rel="prev" title="2. What Verae provides — and what it does not" href="what-verae-provides.html" />
<link rel="next" title="3. Secure communications — data in transit" href="data-in-transit.html" />
<link rel="prev" title="1. What Verae provides — and what it does not" href="what-verae-provides.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
@ -61,38 +61,37 @@
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">3. The Verae DataCube Server Solution</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#purpose">3.1. Purpose</a></li>
<li class="toctree-l2"><a class="reference internal" href="#the-datacube-as-a-container">3.2. The DataCube as a container</a></li>
<li class="toctree-l2"><a class="reference internal" href="#two-information-states-one-operational-picture">3.3. Two information states, one operational picture</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-server-means-in-practice">3.4. What “server” means in practice</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-the-server-solution-is-not">3.5. What the server solution is not</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">2. The Verae DataCube Server Solution</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#purpose">2.1. Purpose</a></li>
<li class="toctree-l2"><a class="reference internal" href="#the-datacube-as-a-container">2.2. The DataCube as a container</a></li>
<li class="toctree-l2"><a class="reference internal" href="#two-information-states-one-operational-picture">2.3. Two information states, one operational picture</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-server-means-in-practice">2.4. What “server” means in practice</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-the-server-solution-is-not">2.5. What the server solution is not</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
</ul>
<div class="relations">
<h3>Related Topics</h3>
<ul>
<li><a href="index.html">Documentation overview</a><ul>
<li>Previous: <a href="what-verae-provides.html" title="previous chapter"><span class="section-number">2. </span>What Verae provides — and what it does not</a></li>
<li>Next: <a href="data-in-transit.html" title="next chapter"><span class="section-number">4. </span>Secure communications — data in transit</a></li>
<li>Previous: <a href="what-verae-provides.html" title="previous chapter"><span class="section-number">1. </span>What Verae provides — and what it does not</a></li>
<li>Next: <a href="data-in-transit.html" title="next chapter"><span class="section-number">3. </span>Secure communications — data in transit</a></li>
</ul></li>
</ul>
</div>
@ -113,9 +112,9 @@
<div class="body" role="main">
<section id="the-verae-datacube-server-solution">
<h1><span class="section-number">3. </span>The Verae DataCube Server Solution<a class="headerlink" href="#the-verae-datacube-server-solution" title="Link to this heading"></a></h1>
<h1><span class="section-number">2. </span>The Verae DataCube Server Solution<a class="headerlink" href="#the-verae-datacube-server-solution" title="Link to this heading"></a></h1>
<section id="purpose">
<h2><span class="section-number">3.1. </span>Purpose<a class="headerlink" href="#purpose" title="Link to this heading"></a></h2>
<h2><span class="section-number">2.1. </span>Purpose<a class="headerlink" href="#purpose" title="Link to this heading"></a></h2>
<p>A Verae DataCube Server Solution is the on-premises or
customer-hosted assembly that gives an organization a place to put
sensitive digital objects, a way to move them, a way to prove when
@ -129,7 +128,7 @@ not a single binary, and it is not a cloud folder with a padlock
icon.</p>
</section>
<section id="the-datacube-as-a-container">
<h2><span class="section-number">3.2. </span>The DataCube as a container<a class="headerlink" href="#the-datacube-as-a-container" title="Link to this heading"></a></h2>
<h2><span class="section-number">2.2. </span>The DataCube as a container<a class="headerlink" href="#the-datacube-as-a-container" title="Link to this heading"></a></h2>
<p>A <strong>DataCube</strong> is a customer-controlled container for digital
objects and for the metadata that makes those objects examinable.
Typical contents include:</p>
@ -150,7 +149,7 @@ records stay in <strong>storage the customer controls</strong>; Verae seals a
that split operational rather than rhetorical.</p>
</section>
<section id="two-information-states-one-operational-picture">
<h2><span class="section-number">3.3. </span>Two information states, one operational picture<a class="headerlink" href="#two-information-states-one-operational-picture" title="Link to this heading"></a></h2>
<h2><span class="section-number">2.3. </span>Two information states, one operational picture<a class="headerlink" href="#two-information-states-one-operational-picture" title="Link to this heading"></a></h2>
<p>Classical security training divides information into <strong>data in
transit</strong> and <strong>data at rest</strong>. The DataCube Server Solution is
built around that division.</p>
@ -174,7 +173,7 @@ receipts (Chapter 6) and the cross-blockchain timestamping
architecture (Chapter 8) address that.</p>
</section>
<section id="what-server-means-in-practice">
<h2><span class="section-number">3.4. </span>What “server” means in practice<a class="headerlink" href="#what-server-means-in-practice" title="Link to this heading"></a></h2>
<h2><span class="section-number">2.4. </span>What “server” means in practice<a class="headerlink" href="#what-server-means-in-practice" title="Link to this heading"></a></h2>
<p>In a typical deployment the organization runs, or links:</p>
<ul class="simple">
<li><p>a <strong>Peergos</strong> instance (or equivalent cryptree client) that
@ -200,7 +199,7 @@ serves a wrong block (detected by hash), a timestamping link that
is down, an archive job that did not run.</p>
</section>
<section id="what-the-server-solution-is-not">
<h2><span class="section-number">3.5. </span>What the server solution is not<a class="headerlink" href="#what-the-server-solution-is-not" title="Link to this heading"></a></h2>
<h2><span class="section-number">2.5. </span>What the server solution is not<a class="headerlink" href="#what-the-server-solution-is-not" title="Link to this heading"></a></h2>
<p>It is not a substitute for workforce training. It is not a
substitute for a Business Associate Agreement analysis. It is not a
substitute for access reviews. It is not, by itself, “the HIPAA

35
build/html/genindex.html
View file

@ -8,7 +8,7 @@
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
@ -58,23 +58,22 @@
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
</ul>
<div class="relations">

71
build/html/global-timestamping.html
View file

@ -5,19 +5,19 @@
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>8. Verae global timestamping — a cross-blockchain receipt &#8212; Making yourself audit-ready with Verae DataCubes</title>
<title>7. Verae global timestamping — a cross-blockchain receipt &#8212; Making yourself audit-ready with Verae DataCubes</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
<link rel="icon" href="_static/VeraeFullLogo.png"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="9. Write-once Iceberg archive" href="iceberg-archive.html" />
<link rel="prev" title="7. Peergos security evaluations in Europe" href="peergos-eu-evaluations.html" />
<link rel="next" title="8. Write-once Iceberg archive" href="iceberg-archive.html" />
<link rel="prev" title="6. Peergos security evaluations in Europe" href="peergos-eu-evaluations.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
@ -61,39 +61,38 @@
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">8. Verae global timestamping — a cross-blockchain receipt</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#lineage">8.1. Lineage</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-cross-blockchain-means-here">8.2. What “cross-blockchain” means here</a></li>
<li class="toctree-l2"><a class="reference internal" href="#two-deployment-patterns">8.3. Two deployment patterns</a></li>
<li class="toctree-l2"><a class="reference internal" href="#the-digital-bundle">8.4. The digital bundle</a></li>
<li class="toctree-l2"><a class="reference internal" href="#proof-of-existence-versus-proof-of-custody">8.5. Proof of existence versus proof of custody</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-this-does-and-does-not-satisfy">8.6. What this does, and does not, satisfy</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">7. Verae global timestamping — a cross-blockchain receipt</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#lineage">7.1. Lineage</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-cross-blockchain-means-here">7.2. What “cross-blockchain” means here</a></li>
<li class="toctree-l2"><a class="reference internal" href="#two-deployment-patterns">7.3. Two deployment patterns</a></li>
<li class="toctree-l2"><a class="reference internal" href="#the-digital-bundle">7.4. The digital bundle</a></li>
<li class="toctree-l2"><a class="reference internal" href="#proof-of-existence-versus-proof-of-custody">7.5. Proof of existence versus proof of custody</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-this-does-and-does-not-satisfy">7.6. What this does, and does not, satisfy</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
</ul>
<div class="relations">
<h3>Related Topics</h3>
<ul>
<li><a href="index.html">Documentation overview</a><ul>
<li>Previous: <a href="peergos-eu-evaluations.html" title="previous chapter"><span class="section-number">7. </span>Peergos security evaluations in Europe</a></li>
<li>Next: <a href="iceberg-archive.html" title="next chapter"><span class="section-number">9. </span>Write-once Iceberg archive</a></li>
<li>Previous: <a href="peergos-eu-evaluations.html" title="previous chapter"><span class="section-number">6. </span>Peergos security evaluations in Europe</a></li>
<li>Next: <a href="iceberg-archive.html" title="next chapter"><span class="section-number">8. </span>Write-once Iceberg archive</a></li>
</ul></li>
</ul>
</div>
@ -114,9 +113,9 @@
<div class="body" role="main">
<section id="verae-global-timestamping-a-cross-blockchain-receipt">
<h1><span class="section-number">8. </span>Verae global timestamping — a cross-blockchain receipt<a class="headerlink" href="#verae-global-timestamping-a-cross-blockchain-receipt" title="Link to this heading"></a></h1>
<h1><span class="section-number">7. </span>Verae global timestamping — a cross-blockchain receipt<a class="headerlink" href="#verae-global-timestamping-a-cross-blockchain-receipt" title="Link to this heading"></a></h1>
<section id="lineage">
<h2><span class="section-number">8.1. </span>Lineage<a class="headerlink" href="#lineage" title="Link to this heading"></a></h2>
<h2><span class="section-number">7.1. </span>Lineage<a class="headerlink" href="#lineage" title="Link to this heading"></a></h2>
<p>The scientific problem Verae is productizing is not new. In
1991, Stuart Haber and W. Scott Stornetta published “How to
Time-Stamp a Digital Document” in the <em>Journal of
@ -142,7 +141,7 @@ blockchain accessible to enterprises without having to deal
with the complexity of blockchain.”</p>
</section>
<section id="what-cross-blockchain-means-here">
<h2><span class="section-number">8.2. </span>What “cross-blockchain” means here<a class="headerlink" href="#what-cross-blockchain-means-here" title="Link to this heading"></a></h2>
<h2><span class="section-number">7.2. </span>What “cross-blockchain” means here<a class="headerlink" href="#what-cross-blockchain-means-here" title="Link to this heading"></a></h2>
<p>A single private log, held only by the vendor, is a vendor
assurance letter with extra steps. A single public chain may
be operationally and commercially the wrong place to put an
@ -168,7 +167,7 @@ receipt. That is the scientific claim, inherited from
Haber–Stornetta.</p>
</section>
<section id="two-deployment-patterns">
<h2><span class="section-number">8.3. </span>Two deployment patterns<a class="headerlink" href="#two-deployment-patterns" title="Link to this heading"></a></h2>
<h2><span class="section-number">7.3. </span>Two deployment patterns<a class="headerlink" href="#two-deployment-patterns" title="Link to this heading"></a></h2>
<p><strong>Linked organizational server.</strong> The organization runs a
timestamping node next to its DataCube server. That node is
linked to the central Verae timestamping server. Local
@ -187,7 +186,7 @@ where the organizational metadata lives and in how much
infrastructure the customer operates.</p>
</section>
<section id="the-digital-bundle">
<h2><span class="section-number">8.4. </span>The digital bundle<a class="headerlink" href="#the-digital-bundle" title="Link to this heading"></a></h2>
<h2><span class="section-number">7.4. </span>The digital bundle<a class="headerlink" href="#the-digital-bundle" title="Link to this heading"></a></h2>
<p>The unit of production is a <strong>digital bundle</strong>:</p>
<ul class="simple">
<li><p>the <strong>receipt</strong> (hash, time, sequence, verification path);</p></li>
@ -203,7 +202,7 @@ without being given a login to the production console and
without Verae ever having seen the object bytes.</p>
</section>
<section id="proof-of-existence-versus-proof-of-custody">
<h2><span class="section-number">8.5. </span>Proof of existence versus proof of custody<a class="headerlink" href="#proof-of-existence-versus-proof-of-custody" title="Link to this heading"></a></h2>
<h2><span class="section-number">7.5. </span>Proof of existence versus proof of custody<a class="headerlink" href="#proof-of-existence-versus-proof-of-custody" title="Link to this heading"></a></h2>
<p>Timestamping answers: <strong>did these bits exist by this time?</strong></p>
<p>The DataCube answers: <strong>does the organization still have
them, encrypted, hash-checkable?</strong></p>
@ -215,7 +214,7 @@ receipt is a pile of files with a clock on the filesystem
that the administrator can set.</p>
</section>
<section id="what-this-does-and-does-not-satisfy">
<h2><span class="section-number">8.6. </span>What this does, and does not, satisfy<a class="headerlink" href="#what-this-does-and-does-not-satisfy" title="Link to this heading"></a></h2>
<h2><span class="section-number">7.6. </span>What this does, and does not, satisfy<a class="headerlink" href="#what-this-does-and-does-not-satisfy" title="Link to this heading"></a></h2>
<p>For SEC Rule 17a-4, FINRA books-and-records, and similar
regimes that demand records in a non-rewriteable,
non-erasable form <strong>with the ability to produce the

47
build/html/howto.html
View file

@ -5,19 +5,19 @@
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>13. How to use this briefing &#8212; Making yourself audit-ready with Verae DataCubes</title>
<title>12. How to use this briefing &#8212; Making yourself audit-ready with Verae DataCubes</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
<link rel="icon" href="_static/VeraeFullLogo.png"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="14. James H. Garfinkel" href="bio-james-garfinkel.html" />
<link rel="prev" title="12. Audit-ready checklist" href="checklist.html" />
<link rel="next" title="13. James H. Garfinkel" href="bio-james-garfinkel.html" />
<link rel="prev" title="11. Audit-ready checklist" href="checklist.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
@ -61,31 +61,30 @@
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">12. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
</ul>
<div class="relations">
<h3>Related Topics</h3>
<ul>
<li><a href="index.html">Documentation overview</a><ul>
<li>Previous: <a href="checklist.html" title="previous chapter"><span class="section-number">12. </span>Audit-ready checklist</a></li>
<li>Next: <a href="bio-james-garfinkel.html" title="next chapter"><span class="section-number">14. </span>James H. Garfinkel</a></li>
<li>Previous: <a href="checklist.html" title="previous chapter"><span class="section-number">11. </span>Audit-ready checklist</a></li>
<li>Next: <a href="bio-james-garfinkel.html" title="next chapter"><span class="section-number">13. </span>James H. Garfinkel</a></li>
</ul></li>
</ul>
</div>
@ -106,7 +105,7 @@
<div class="body" role="main">
<section id="how-to-use-this-briefing">
<h1><span class="section-number">13. </span>How to use this briefing<a class="headerlink" href="#how-to-use-this-briefing" title="Link to this heading"></a></h1>
<h1><span class="section-number">12. </span>How to use this briefing<a class="headerlink" href="#how-to-use-this-briefing" title="Link to this heading"></a></h1>
<ol class="arabic simple">
<li><p>Read the <strong>executive summary</strong> aloud in the first five
minutes of any vendor, board, or auditor meeting that

67
build/html/iceberg-archive.html
View file

@ -5,19 +5,19 @@
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>9. Write-once Iceberg archive &#8212; Making yourself audit-ready with Verae DataCubes</title>
<title>8. Write-once Iceberg archive &#8212; Making yourself audit-ready with Verae DataCubes</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
<link rel="icon" href="_static/VeraeFullLogo.png"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="10. Architecture for an audit interview" href="architecture.html" />
<link rel="prev" title="8. Verae global timestamping — a cross-blockchain receipt" href="global-timestamping.html" />
<link rel="next" title="9. Architecture for an audit interview" href="architecture.html" />
<link rel="prev" title="7. Verae global timestamping — a cross-blockchain receipt" href="global-timestamping.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
@ -61,38 +61,37 @@
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">9. Write-once Iceberg archive</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#the-deletion-problem">9.1. The deletion problem</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-write-once-iceberg-means-in-this-solution">9.2. What “write-once Iceberg” means in this solution</a></li>
<li class="toctree-l2"><a class="reference internal" href="#how-cubes-move-into-the-archive">9.3. How cubes move into the archive</a></li>
<li class="toctree-l2"><a class="reference internal" href="#relation-to-classical-worm">9.4. Relation to classical WORM</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-this-does-and-does-not-satisfy">9.5. What this does, and does not, satisfy</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">8. Write-once Iceberg archive</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#the-deletion-problem">8.1. The deletion problem</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-write-once-iceberg-means-in-this-solution">8.2. What “write-once Iceberg” means in this solution</a></li>
<li class="toctree-l2"><a class="reference internal" href="#how-cubes-move-into-the-archive">8.3. How cubes move into the archive</a></li>
<li class="toctree-l2"><a class="reference internal" href="#relation-to-classical-worm">8.4. Relation to classical WORM</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-this-does-and-does-not-satisfy">8.5. What this does, and does not, satisfy</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
</ul>
<div class="relations">
<h3>Related Topics</h3>
<ul>
<li><a href="index.html">Documentation overview</a><ul>
<li>Previous: <a href="global-timestamping.html" title="previous chapter"><span class="section-number">8. </span>Verae global timestamping — a cross-blockchain receipt</a></li>
<li>Next: <a href="architecture.html" title="next chapter"><span class="section-number">10. </span>Architecture for an audit interview</a></li>
<li>Previous: <a href="global-timestamping.html" title="previous chapter"><span class="section-number">7. </span>Verae global timestamping — a cross-blockchain receipt</a></li>
<li>Next: <a href="architecture.html" title="next chapter"><span class="section-number">9. </span>Architecture for an audit interview</a></li>
</ul></li>
</ul>
</div>
@ -113,9 +112,9 @@
<div class="body" role="main">
<section id="write-once-iceberg-archive">
<h1><span class="section-number">9. </span>Write-once Iceberg archive<a class="headerlink" href="#write-once-iceberg-archive" title="Link to this heading"></a></h1>
<h1><span class="section-number">8. </span>Write-once Iceberg archive<a class="headerlink" href="#write-once-iceberg-archive" title="Link to this heading"></a></h1>
<section id="the-deletion-problem">
<h2><span class="section-number">9.1. </span>The deletion problem<a class="headerlink" href="#the-deletion-problem" title="Link to this heading"></a></h2>
<h2><span class="section-number">8.1. </span>The deletion problem<a class="headerlink" href="#the-deletion-problem" title="Link to this heading"></a></h2>
<p>Encryption at rest stops a disk operator from <strong>reading</strong>.
Hash verification stops a replica from <strong>substituting</strong>.
Timestamped receipts stop a custodian from <strong>back-dating</strong>.
@ -131,7 +130,7 @@ that cannot be produced.</p>
administrative power does not include delete</strong>.</p>
</section>
<section id="what-write-once-iceberg-means-in-this-solution">
<h2><span class="section-number">9.2. </span>What “write-once Iceberg” means in this solution<a class="headerlink" href="#what-write-once-iceberg-means-in-this-solution" title="Link to this heading"></a></h2>
<h2><span class="section-number">8.2. </span>What “write-once Iceberg” means in this solution<a class="headerlink" href="#what-write-once-iceberg-means-in-this-solution" title="Link to this heading"></a></h2>
<p>DataCubes — the encrypted, hash-chained containers — are
<strong>archived</strong> into an <strong>external, write-once file-storage
solution</strong> built on the <strong>Iceberg</strong> table/file model (a
@ -159,7 +158,7 @@ require it — not because it is a convenient backup.</p></li>
</ul>
</section>
<section id="how-cubes-move-into-the-archive">
<h2><span class="section-number">9.3. </span>How cubes move into the archive<a class="headerlink" href="#how-cubes-move-into-the-archive" title="Link to this heading"></a></h2>
<h2><span class="section-number">8.3. </span>How cubes move into the archive<a class="headerlink" href="#how-cubes-move-into-the-archive" title="Link to this heading"></a></h2>
<p>A live DataCube is an operational object: it receives new
writes, it is replicated as encrypted IPFS blocks, it is
readable by holders of the right capabilities. On a schedule
@ -207,7 +206,7 @@ legally permitted at all.</p></li>
retention schedule. Counsel and the records officer do that.</p>
</section>
<section id="relation-to-classical-worm">
<h2><span class="section-number">9.4. </span>Relation to classical WORM<a class="headerlink" href="#relation-to-classical-worm" title="Link to this heading"></a></h2>
<h2><span class="section-number">8.4. </span>Relation to classical WORM<a class="headerlink" href="#relation-to-classical-worm" title="Link to this heading"></a></h2>
<p>Broker-dealer Rule 17a-4 and similar texts speak of
non-rewriteable, non-erasable media, originally meaning
optical WORM, later allowing disk with object-lock semantics
@ -221,7 +220,7 @@ receipt even if they do not trust the vendor’s “WORM was
on” screenshot.</p>
</section>
<section id="what-this-does-and-does-not-satisfy">
<h2><span class="section-number">9.5. </span>What this does, and does not, satisfy<a class="headerlink" href="#what-this-does-and-does-not-satisfy" title="Link to this heading"></a></h2>
<h2><span class="section-number">8.5. </span>What this does, and does not, satisfy<a class="headerlink" href="#what-this-does-and-does-not-satisfy" title="Link to this heading"></a></h2>
<p>This is the <strong>technical portion</strong> of retention and
production: committed cubes are not under a single delete
key, they are hash-checkable, and they carry a time of

281
build/html/index.html
View file

@ -9,14 +9,14 @@
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
<link rel="icon" href="_static/VeraeFullLogo.png"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="1. Executive summary" href="executive.html" />
<link rel="next" title="1. What Verae provides — and what it does not" href="what-verae-provides.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
@ -60,30 +60,29 @@
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
</ul>
<div class="relations">
<h3>Related Topics</h3>
<ul>
<li><a href="#">Documentation overview</a><ul>
<li>Next: <a href="executive.html" title="next chapter"><span class="section-number">1. </span>Executive summary</a></li>
<li>Next: <a href="what-verae-provides.html" title="next chapter"><span class="section-number">1. </span>What Verae provides — and what it does not</a></li>
</ul></li>
</ul>
</div>
@ -107,150 +106,166 @@
<h1>Making yourself audit-ready with Verae DataCubes<a class="headerlink" href="#making-yourself-audit-ready-with-verae-datacubes" title="Link to this heading"></a></h1>
<a class="logo reference internal image-reference" href="_images/VeraeFullLogo.png"><img alt="Verae" class="logo" src="_images/VeraeFullLogo.png" style="width: 280px;" />
</a>
<p>This volume is a technical briefing. It is <strong>not</strong> a certificate.</p>
<p>The table of contents below is the document map. In the PDF edition,
each chapter starts on a new page and the contents list includes
<strong>section titles with page numbers</strong>. In HTML, each chapter is its own
page with the Verae wordmark in the sidebar and Verae Inc contact
information in the footer.</p>
<p>Software alone does not make an organization HIPAA certified, SOC 2
attested, or ISO 27001 certified.</p>
<p>That sentence is the point of this document. It is also the sentence
that is most often skipped when a vendor, an integrator, or an internal
champion shows encryption, hashing, or a pentest PDF and treats the
conversation as finished. It is not finished. Encryption is a control.
A pentest is an evaluation of a component. A certificate, an attestation,
or a covered-entity determination is a statement about <strong>an organization</strong>
— its legal entity, its people, its written policies, its operating
procedures, its internal controls, the evidence those controls produce,
and the independent party that examined that evidence.</p>
<p>The Verae DataCube Solution gives an organization tools to <strong>store</strong>,
<strong>communicate</strong>, <strong>timestamp</strong>, <strong>verify</strong>, and <strong>audit</strong> for compliance.
Those tools are real, they are specific, and they are described in the
chapters that follow. They are still only tools. To obtain HIPAA-aligned
status as a covered entity or business associate with a defensible
program, a SOC 2 Type I or Type II report, or an ISO 27001 certificate,
the organization must still:</p>
<ul class="simple">
<li><p>write and live by <strong>policies</strong> (what the organization says it will do);</p></li>
<li><p>operate <strong>procedures</strong> (how staff actually do it, every day);</p></li>
<li><p>design and test <strong>internal controls</strong> (the checks that catch failure);</p></li>
<li><p>retain <strong>evidence</strong> (logs, tickets, screenshots, signed approvals,
restore tests, training records);</p></li>
<li><p>engage an <strong>independent auditor</strong>, CPA firm, or ISO registrar, as the
chosen program requires.</p></li>
</ul>
<p>Verae cannot issue those certificates. Verae cannot sit in the
organization’s chair during an OCR investigation, a SOC 2 fieldwork
week, or an ISO Stage 2 audit. What Verae can do — and what this
briefing is written to make precise — is provide the <strong>tools</strong>, the
<strong>background</strong>, and the <strong>software infrastructure</strong> that make it easier
to implement the <strong>technical portion</strong> of those programs.</p>
<div class="toctree-wrapper compound">
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a><ul>
<li class="toctree-l2"><a class="reference internal" href="executive.html#what-a-verae-datacube-server-solution-does">1.1. What a Verae DataCube Server Solution does</a></li>
<li class="toctree-l2"><a class="reference internal" href="executive.html#data-in-transit">1.2. Data in transit</a></li>
<li class="toctree-l2"><a class="reference internal" href="executive.html#data-at-rest">1.3. Data at rest</a></li>
<li class="toctree-l2"><a class="reference internal" href="executive.html#global-timestamped-receipts">1.4. Global timestamped receipts</a></li>
<li class="toctree-l2"><a class="reference internal" href="executive.html#peergos-evaluated-in-europe">1.5. Peergos, evaluated in Europe</a></li>
<li class="toctree-l2"><a class="reference internal" href="executive.html#verae-global-timestamping">1.6. Verae global timestamping</a></li>
<li class="toctree-l2"><a class="reference internal" href="executive.html#write-once-iceberg-archive">1.7. Write-once Iceberg archive</a></li>
<li class="toctree-l2"><a class="reference internal" href="executive.html#what-this-briefing-is-and-is-not">1.8. What this briefing is, and is not</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a><ul>
<li class="toctree-l2"><a class="reference internal" href="what-verae-provides.html#the-boundary">1.1. The boundary</a></li>
<li class="toctree-l2"><a class="reference internal" href="what-verae-provides.html#the-tools">1.2. The tools</a></li>
<li class="toctree-l2"><a class="reference internal" href="what-verae-provides.html#what-the-organization-must-still-do">1.3. What the organization must still do</a></li>
<li class="toctree-l2"><a class="reference internal" href="what-verae-provides.html#why-the-distinction-matters-in-an-exam">1.4. Why the distinction matters in an exam</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a><ul>
<li class="toctree-l2"><a class="reference internal" href="what-verae-provides.html#the-boundary">2.1. The boundary</a></li>
<li class="toctree-l2"><a class="reference internal" href="what-verae-provides.html#the-tools">2.2. The tools</a></li>
<li class="toctree-l2"><a class="reference internal" href="what-verae-provides.html#what-the-organization-must-still-do">2.3. What the organization must still do</a></li>
<li class="toctree-l2"><a class="reference internal" href="what-verae-provides.html#why-the-distinction-matters-in-an-exam">2.4. Why the distinction matters in an exam</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a><ul>
<li class="toctree-l2"><a class="reference internal" href="datacube-server.html#purpose">2.1. Purpose</a></li>
<li class="toctree-l2"><a class="reference internal" href="datacube-server.html#the-datacube-as-a-container">2.2. The DataCube as a container</a></li>
<li class="toctree-l2"><a class="reference internal" href="datacube-server.html#two-information-states-one-operational-picture">2.3. Two information states, one operational picture</a></li>
<li class="toctree-l2"><a class="reference internal" href="datacube-server.html#what-server-means-in-practice">2.4. What “server” means in practice</a></li>
<li class="toctree-l2"><a class="reference internal" href="datacube-server.html#what-the-server-solution-is-not">2.5. What the server solution is not</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a><ul>
<li class="toctree-l2"><a class="reference internal" href="datacube-server.html#purpose">3.1. Purpose</a></li>
<li class="toctree-l2"><a class="reference internal" href="datacube-server.html#the-datacube-as-a-container">3.2. The DataCube as a container</a></li>
<li class="toctree-l2"><a class="reference internal" href="datacube-server.html#two-information-states-one-operational-picture">3.3. Two information states, one operational picture</a></li>
<li class="toctree-l2"><a class="reference internal" href="datacube-server.html#what-server-means-in-practice">3.4. What “server” means in practice</a></li>
<li class="toctree-l2"><a class="reference internal" href="datacube-server.html#what-the-server-solution-is-not">3.5. What the server solution is not</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a><ul>
<li class="toctree-l2"><a class="reference internal" href="data-in-transit.html#the-problem">3.1. The problem</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-in-transit.html#point-to-point-encryption">3.2. Point-to-point encryption</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-in-transit.html#visible-routing">3.3. Visible routing</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-in-transit.html#error-handling-without-leaking-content">3.4. Error handling without leaking content</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-in-transit.html#the-public-key-directory">3.5. The public-key directory</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-in-transit.html#what-this-does-and-does-not-satisfy">3.6. What this does, and does not, satisfy</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a><ul>
<li class="toctree-l2"><a class="reference internal" href="data-in-transit.html#the-problem">4.1. The problem</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-in-transit.html#point-to-point-encryption">4.2. Point-to-point encryption</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-in-transit.html#visible-routing">4.3. Visible routing</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-in-transit.html#error-handling-without-leaking-content">4.4. Error handling without leaking content</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-in-transit.html#the-public-key-directory">4.5. The public-key directory</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-in-transit.html#what-this-does-and-does-not-satisfy">4.6. What this does, and does not, satisfy</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a><ul>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#the-problem">4.1. The problem</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#content-addressed-blocks">4.2. Content-addressed blocks</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#peergos-on-top-of-ipfs">4.3. Peergos on top of IPFS</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#tamper-evident-restore">4.4. Tamper-evident restore</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#append-only-at-the-cube-layer">4.5. Append-only at the cube layer</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#what-a-disk-operator-sees">4.6. What a disk operator sees</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#what-this-does-and-does-not-satisfy">4.7. What this does, and does not, satisfy</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a><ul>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#the-problem">5.1. The problem</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#content-addressed-blocks">5.2. Content-addressed blocks</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#peergos-on-top-of-ipfs">5.3. Peergos on top of IPFS</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#tamper-evident-restore">5.4. Tamper-evident restore</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#append-only-at-the-cube-layer">5.5. Append-only at the cube layer</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#what-a-disk-operator-sees">5.6. What a disk operator sees</a></li>
<li class="toctree-l2"><a class="reference internal" href="data-at-rest.html#what-this-does-and-does-not-satisfy">5.7. What this does, and does not, satisfy</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a><ul>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#why-hashes-are-not-enough-by-themselves">5.1. Why hashes are not enough by themselves</a></li>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#what-a-verae-receipt-is">5.2. What a Verae receipt is</a></li>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#what-is-registered-and-what-is-not">5.3. What is registered, and what is not</a></li>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#first-registration-wins">5.4. First registration wins</a></li>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#sequence">5.5. Sequence</a></li>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#bundles">5.6. Bundles</a></li>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#what-a-receipt-does-not-prove">5.7. What a receipt does not prove</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a><ul>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#why-hashes-are-not-enough-by-themselves">6.1. Why hashes are not enough by themselves</a></li>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#what-a-verae-receipt-is">6.2. What a Verae receipt is</a></li>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#what-is-registered-and-what-is-not">6.3. What is registered, and what is not</a></li>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#first-registration-wins">6.4. First registration wins</a></li>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#sequence">6.5. Sequence</a></li>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#bundles">6.6. Bundles</a></li>
<li class="toctree-l2"><a class="reference internal" href="timestamped-receipts.html#what-a-receipt-does-not-prove">6.7. What a receipt does not prove</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a><ul>
<li class="toctree-l2"><a class="reference internal" href="peergos-eu-evaluations.html#what-was-evaluated">6.1. What was evaluated</a></li>
<li class="toctree-l2"><a class="reference internal" href="peergos-eu-evaluations.html#cure53-berlin-germany">6.2. 2019 — Cure53, Berlin, Germany</a></li>
<li class="toctree-l2"><a class="reference internal" href="peergos-eu-evaluations.html#radically-open-security-b-v-amsterdam">6.3. 2024 — Radically Open Security B.V., Amsterdam</a></li>
<li class="toctree-l2"><a class="reference internal" href="peergos-eu-evaluations.html#how-to-present-these-reports-to-an-auditor">6.4. How to present these reports to an auditor</a></li>
<li class="toctree-l2"><a class="reference internal" href="peergos-eu-evaluations.html#hosted-peergos-versus-self-hosted-datacubes">6.5. Hosted Peergos versus self-hosted DataCubes</a></li>
<li class="toctree-l2"><a class="reference internal" href="peergos-eu-evaluations.html#what-designed-under-funding-from-cure53-ros-is-not">6.6. What “designed under funding from Cure53 / ROS” is not</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a><ul>
<li class="toctree-l2"><a class="reference internal" href="peergos-eu-evaluations.html#what-was-evaluated">7.1. What was evaluated</a></li>
<li class="toctree-l2"><a class="reference internal" href="peergos-eu-evaluations.html#cure53-berlin-germany">7.2. 2019 — Cure53, Berlin, Germany</a></li>
<li class="toctree-l2"><a class="reference internal" href="peergos-eu-evaluations.html#radically-open-security-b-v-amsterdam">7.3. 2024 — Radically Open Security B.V., Amsterdam</a></li>
<li class="toctree-l2"><a class="reference internal" href="peergos-eu-evaluations.html#how-to-present-these-reports-to-an-auditor">7.4. How to present these reports to an auditor</a></li>
<li class="toctree-l2"><a class="reference internal" href="peergos-eu-evaluations.html#hosted-peergos-versus-self-hosted-datacubes">7.5. Hosted Peergos versus self-hosted DataCubes</a></li>
<li class="toctree-l2"><a class="reference internal" href="peergos-eu-evaluations.html#what-designed-under-funding-from-cure53-ros-is-not">7.6. What “designed under funding from Cure53 / ROS” is not</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a><ul>
<li class="toctree-l2"><a class="reference internal" href="global-timestamping.html#lineage">7.1. Lineage</a></li>
<li class="toctree-l2"><a class="reference internal" href="global-timestamping.html#what-cross-blockchain-means-here">7.2. What “cross-blockchain” means here</a></li>
<li class="toctree-l2"><a class="reference internal" href="global-timestamping.html#two-deployment-patterns">7.3. Two deployment patterns</a></li>
<li class="toctree-l2"><a class="reference internal" href="global-timestamping.html#the-digital-bundle">7.4. The digital bundle</a></li>
<li class="toctree-l2"><a class="reference internal" href="global-timestamping.html#proof-of-existence-versus-proof-of-custody">7.5. Proof of existence versus proof of custody</a></li>
<li class="toctree-l2"><a class="reference internal" href="global-timestamping.html#what-this-does-and-does-not-satisfy">7.6. What this does, and does not, satisfy</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a><ul>
<li class="toctree-l2"><a class="reference internal" href="global-timestamping.html#lineage">8.1. Lineage</a></li>
<li class="toctree-l2"><a class="reference internal" href="global-timestamping.html#what-cross-blockchain-means-here">8.2. What “cross-blockchain” means here</a></li>
<li class="toctree-l2"><a class="reference internal" href="global-timestamping.html#two-deployment-patterns">8.3. Two deployment patterns</a></li>
<li class="toctree-l2"><a class="reference internal" href="global-timestamping.html#the-digital-bundle">8.4. The digital bundle</a></li>
<li class="toctree-l2"><a class="reference internal" href="global-timestamping.html#proof-of-existence-versus-proof-of-custody">8.5. Proof of existence versus proof of custody</a></li>
<li class="toctree-l2"><a class="reference internal" href="global-timestamping.html#what-this-does-and-does-not-satisfy">8.6. What this does, and does not, satisfy</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a><ul>
<li class="toctree-l2"><a class="reference internal" href="iceberg-archive.html#the-deletion-problem">8.1. The deletion problem</a></li>
<li class="toctree-l2"><a class="reference internal" href="iceberg-archive.html#what-write-once-iceberg-means-in-this-solution">8.2. What “write-once Iceberg” means in this solution</a></li>
<li class="toctree-l2"><a class="reference internal" href="iceberg-archive.html#how-cubes-move-into-the-archive">8.3. How cubes move into the archive</a></li>
<li class="toctree-l2"><a class="reference internal" href="iceberg-archive.html#relation-to-classical-worm">8.4. Relation to classical WORM</a></li>
<li class="toctree-l2"><a class="reference internal" href="iceberg-archive.html#what-this-does-and-does-not-satisfy">8.5. What this does, and does not, satisfy</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a><ul>
<li class="toctree-l2"><a class="reference internal" href="iceberg-archive.html#the-deletion-problem">9.1. The deletion problem</a></li>
<li class="toctree-l2"><a class="reference internal" href="iceberg-archive.html#what-write-once-iceberg-means-in-this-solution">9.2. What “write-once Iceberg” means in this solution</a></li>
<li class="toctree-l2"><a class="reference internal" href="iceberg-archive.html#how-cubes-move-into-the-archive">9.3. How cubes move into the archive</a></li>
<li class="toctree-l2"><a class="reference internal" href="iceberg-archive.html#relation-to-classical-worm">9.4. Relation to classical WORM</a></li>
<li class="toctree-l2"><a class="reference internal" href="iceberg-archive.html#what-this-does-and-does-not-satisfy">9.5. What this does, and does not, satisfy</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a><ul>
<li class="toctree-l2"><a class="reference internal" href="architecture.html#the-picture">9.1. The picture</a></li>
<li class="toctree-l2"><a class="reference internal" href="architecture.html#walkthrough-in-the-order-an-examiner-usually-asks">9.2. Walkthrough, in the order an examiner usually asks</a></li>
<li class="toctree-l2"><a class="reference internal" href="architecture.html#identity-planes">9.3. Identity planes</a></li>
<li class="toctree-l2"><a class="reference internal" href="architecture.html#nats-remains-untrusted">9.4. NATS remains untrusted</a></li>
<li class="toctree-l2"><a class="reference internal" href="architecture.html#what-to-hand-the-examiner">9.5. What to hand the examiner</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a><ul>
<li class="toctree-l2"><a class="reference internal" href="architecture.html#the-picture">10.1. The picture</a></li>
<li class="toctree-l2"><a class="reference internal" href="architecture.html#walkthrough-in-the-order-an-examiner-usually-asks">10.2. Walkthrough, in the order an examiner usually asks</a></li>
<li class="toctree-l2"><a class="reference internal" href="architecture.html#identity-planes">10.3. Identity planes</a></li>
<li class="toctree-l2"><a class="reference internal" href="architecture.html#nats-remains-untrusted">10.4. NATS remains untrusted</a></li>
<li class="toctree-l2"><a class="reference internal" href="architecture.html#what-to-hand-the-examiner">10.5. What to hand the examiner</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a><ul>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#the-technical-fact">10.1. The technical fact</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#hipaa-business-associate">10.2. HIPAA — Business Associate</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#gdpr-processor-versus-technical-measure">10.3. GDPR — processor versus technical measure</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#nats-operators">10.4. NATS operators</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#verae-as-timestamping-service">10.5. Verae as timestamping service</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#component-assurance-versus-the-organization-s-report">10.6. Component assurance versus the organization’s report</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a><ul>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#the-technical-fact">11.1. The technical fact</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#hipaa-business-associate">11.2. HIPAA — Business Associate</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#gdpr-processor-versus-technical-measure">11.3. GDPR — processor versus technical measure</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#nats-operators">11.4. NATS operators</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#verae-as-timestamping-service">11.5. Verae as timestamping service</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#component-assurance-versus-the-organization-s-report">11.6. Component assurance versus the organization’s report</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a><ul>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#a-scope-and-honesty">11.1. A. Scope and honesty</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#b-data-in-transit">11.2. B. Data in transit</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#c-data-at-rest">11.3. C. Data at rest</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#d-timestamping">11.4. D. Timestamping</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#e-write-once-archive">11.5. E. Write-once archive</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#f-access-and-change">11.6. F. Access and change</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#g-contracts-counsel">11.7. G. Contracts (counsel)</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#h-independent-examination-of-this-organization">11.8. H. Independent examination of <em>this</em> organization</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a><ul>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#a-scope-and-honesty">12.1. A. Scope and honesty</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#b-data-in-transit">12.2. B. Data in transit</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#c-data-at-rest">12.3. C. Data at rest</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#d-timestamping">12.4. D. Timestamping</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#e-write-once-archive">12.5. E. Write-once archive</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#f-access-and-change">12.6. F. Access and change</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#g-contracts-counsel">12.7. G. Contracts (counsel)</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#h-independent-examination-of-this-organization">12.8. H. Independent examination of <em>this</em> organization</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a><ul>
<li class="toctree-l2"><a class="reference internal" href="bio-james-garfinkel.html#name-and-sources">13.1. Name and sources</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-james-garfinkel.html#role-at-verae">13.2. Role at Verae</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-james-garfinkel.html#finra-brokercheck-crd-5052743">13.3. FINRA BrokerCheck (CRD 5052743)</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-james-garfinkel.html#education-public-professional-listings">13.4. Education (public professional listings)</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-james-garfinkel.html#why-this-biography-is-in-the-briefing">13.5. Why this biography is in the briefing</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a><ul>
<li class="toctree-l2"><a class="reference internal" href="bio-james-garfinkel.html#name-and-sources">14.1. Name and sources</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-james-garfinkel.html#role-at-verae">14.2. Role at Verae</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-james-garfinkel.html#finra-brokercheck-crd-5052743">14.3. FINRA BrokerCheck (CRD 5052743)</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-james-garfinkel.html#education-public-professional-listings">14.4. Education (public professional listings)</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-james-garfinkel.html#why-this-biography-is-in-the-briefing">14.5. Why this biography is in the briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a><ul>
<li class="toctree-l2"><a class="reference internal" href="bio-stuart-haber.html#role-at-verae">14.1. Role at Verae</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-stuart-haber.html#the-scientific-work">14.2. The scientific work</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-stuart-haber.html#surety-1994-first-commercial-blockchain">14.3. Surety, 1994: first commercial blockchain</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-stuart-haber.html#other-cryptographic-publications">14.4. Other cryptographic publications</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-stuart-haber.html#why-this-biography-is-in-the-briefing">14.5. Why this biography is in the briefing</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a><ul>
<li class="toctree-l2"><a class="reference internal" href="bio-stuart-haber.html#role-at-verae">15.1. Role at Verae</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-stuart-haber.html#the-scientific-work">15.2. The scientific work</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-stuart-haber.html#surety-1994-first-commercial-blockchain">15.3. Surety, 1994: first commercial blockchain</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-stuart-haber.html#other-cryptographic-publications">15.4. Other cryptographic publications</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-stuart-haber.html#why-this-biography-is-in-the-briefing">15.5. Why this biography is in the briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a><ul>
<li class="toctree-l2"><a class="reference internal" href="bio-george-lambert.html#role">15.1. Role</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-george-lambert.html#internet-technical-architect-from-1994">15.2. Internet technical architect, from 1994</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-george-lambert.html#new-hampshire-public-office">15.3. New Hampshire public office</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-george-lambert.html#why-this-biography-is-in-the-briefing">15.4. Why this biography is in the briefing</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a><ul>
<li class="toctree-l2"><a class="reference internal" href="bio-george-lambert.html#role">16.1. Role</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-george-lambert.html#internet-technical-architect-from-1994">16.2. Internet technical architect, from 1994</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-george-lambert.html#new-hampshire-public-office">16.3. New Hampshire public office</a></li>
<li class="toctree-l2"><a class="reference internal" href="bio-george-lambert.html#why-this-biography-is-in-the-briefing">16.4. Why this biography is in the briefing</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a><ul>
<li class="toctree-l2"><a class="reference internal" href="contact.html#closing-reminder">17.1. Closing reminder</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a><ul>
<li class="toctree-l2"><a class="reference internal" href="contact.html#closing-reminder">16.1. Closing reminder</a></li>
</ul>
</li>
</ul>

71
build/html/peergos-eu-evaluations.html
View file

@ -5,19 +5,19 @@
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>7. Peergos security evaluations in Europe &#8212; Making yourself audit-ready with Verae DataCubes</title>
<title>6. Peergos security evaluations in Europe &#8212; Making yourself audit-ready with Verae DataCubes</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
<link rel="icon" href="_static/VeraeFullLogo.png"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="8. Verae global timestamping — a cross-blockchain receipt" href="global-timestamping.html" />
<link rel="prev" title="6. Global timestamped receipts" href="timestamped-receipts.html" />
<link rel="next" title="7. Verae global timestamping — a cross-blockchain receipt" href="global-timestamping.html" />
<link rel="prev" title="5. Global timestamped receipts" href="timestamped-receipts.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
@ -61,39 +61,38 @@
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">7. Peergos security evaluations in Europe</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#what-was-evaluated">7.1. What was evaluated</a></li>
<li class="toctree-l2"><a class="reference internal" href="#cure53-berlin-germany">7.2. 2019 — Cure53, Berlin, Germany</a></li>
<li class="toctree-l2"><a class="reference internal" href="#radically-open-security-b-v-amsterdam">7.3. 2024 — Radically Open Security B.V., Amsterdam</a></li>
<li class="toctree-l2"><a class="reference internal" href="#how-to-present-these-reports-to-an-auditor">7.4. How to present these reports to an auditor</a></li>
<li class="toctree-l2"><a class="reference internal" href="#hosted-peergos-versus-self-hosted-datacubes">7.5. Hosted Peergos versus self-hosted DataCubes</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-designed-under-funding-from-cure53-ros-is-not">7.6. What “designed under funding from Cure53 / ROS” is not</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">6. Peergos security evaluations in Europe</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#what-was-evaluated">6.1. What was evaluated</a></li>
<li class="toctree-l2"><a class="reference internal" href="#cure53-berlin-germany">6.2. 2019 — Cure53, Berlin, Germany</a></li>
<li class="toctree-l2"><a class="reference internal" href="#radically-open-security-b-v-amsterdam">6.3. 2024 — Radically Open Security B.V., Amsterdam</a></li>
<li class="toctree-l2"><a class="reference internal" href="#how-to-present-these-reports-to-an-auditor">6.4. How to present these reports to an auditor</a></li>
<li class="toctree-l2"><a class="reference internal" href="#hosted-peergos-versus-self-hosted-datacubes">6.5. Hosted Peergos versus self-hosted DataCubes</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-designed-under-funding-from-cure53-ros-is-not">6.6. What “designed under funding from Cure53 / ROS” is not</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
</ul>
<div class="relations">
<h3>Related Topics</h3>
<ul>
<li><a href="index.html">Documentation overview</a><ul>
<li>Previous: <a href="timestamped-receipts.html" title="previous chapter"><span class="section-number">6. </span>Global timestamped receipts</a></li>
<li>Next: <a href="global-timestamping.html" title="next chapter"><span class="section-number">8. </span>Verae global timestamping — a cross-blockchain receipt</a></li>
<li>Previous: <a href="timestamped-receipts.html" title="previous chapter"><span class="section-number">5. </span>Global timestamped receipts</a></li>
<li>Next: <a href="global-timestamping.html" title="next chapter"><span class="section-number">7. </span>Verae global timestamping — a cross-blockchain receipt</a></li>
</ul></li>
</ul>
</div>
@ -114,9 +113,9 @@
<div class="body" role="main">
<section id="peergos-security-evaluations-in-europe">
<h1><span class="section-number">7. </span>Peergos security evaluations in Europe<a class="headerlink" href="#peergos-security-evaluations-in-europe" title="Link to this heading"></a></h1>
<h1><span class="section-number">6. </span>Peergos security evaluations in Europe<a class="headerlink" href="#peergos-security-evaluations-in-europe" title="Link to this heading"></a></h1>
<section id="what-was-evaluated">
<h2><span class="section-number">7.1. </span>What was evaluated<a class="headerlink" href="#what-was-evaluated" title="Link to this heading"></a></h2>
<h2><span class="section-number">6.1. </span>What was evaluated<a class="headerlink" href="#what-was-evaluated" title="Link to this heading"></a></h2>
<p>The offline storage and replication system used with Verae
DataCubes is <strong>Peergos</strong>: an encrypted, peer-to-peer filesystem
whose blocks live on IPFS. Peergos was designed as a
@ -139,7 +138,7 @@ is unusual and is worth attaching to a vendor-assurance file,
<strong>labeled correctly</strong>.</p>
</section>
<section id="cure53-berlin-germany">
<h2><span class="section-number">7.2. </span>2019 — Cure53, Berlin, Germany<a class="headerlink" href="#cure53-berlin-germany" title="Link to this heading"></a></h2>
<h2><span class="section-number">6.2. </span>2019 — Cure53, Berlin, Germany<a class="headerlink" href="#cure53-berlin-germany" title="Link to this heading"></a></h2>
<ul class="simple">
<li><p><strong>Firm:</strong> Cure53</p></li>
<li><p><strong>Location:</strong> Berlin, Germany</p></li>
@ -167,7 +166,7 @@ did find were addressed.</p>
</ul>
</section>
<section id="radically-open-security-b-v-amsterdam">
<h2><span class="section-number">7.3. </span>2024 — Radically Open Security B.V., Amsterdam<a class="headerlink" href="#radically-open-security-b-v-amsterdam" title="Link to this heading"></a></h2>
<h2><span class="section-number">6.3. </span>2024 — Radically Open Security B.V., Amsterdam<a class="headerlink" href="#radically-open-security-b-v-amsterdam" title="Link to this heading"></a></h2>
<ul class="simple">
<li><p><strong>Firm:</strong> Radically Open Security B.V.</p></li>
<li><p><strong>Location:</strong> Amsterdam, Netherlands</p></li>
@ -198,7 +197,7 @@ still not a customer’s Type II.</p>
</ul>
</section>
<section id="how-to-present-these-reports-to-an-auditor">
<h2><span class="section-number">7.4. </span>How to present these reports to an auditor<a class="headerlink" href="#how-to-present-these-reports-to-an-auditor" title="Link to this heading"></a></h2>
<h2><span class="section-number">6.4. </span>How to present these reports to an auditor<a class="headerlink" href="#how-to-present-these-reports-to-an-auditor" title="Link to this heading"></a></h2>
<p>Correct:</p>
<blockquote>
<div><p>“Our at-rest layer is Peergos. Peergos was independently
@ -221,7 +220,7 @@ is a research-and-innovation funding fact. It is worth
listing under “provenance.” It is not a registrar’s mark.</p>
</section>
<section id="hosted-peergos-versus-self-hosted-datacubes">
<h2><span class="section-number">7.5. </span>Hosted Peergos versus self-hosted DataCubes<a class="headerlink" href="#hosted-peergos-versus-self-hosted-datacubes" title="Link to this heading"></a></h2>
<h2><span class="section-number">6.5. </span>Hosted Peergos versus self-hosted DataCubes<a class="headerlink" href="#hosted-peergos-versus-self-hosted-datacubes" title="Link to this heading"></a></h2>
<p>Peergos’s hosted privacy notice has stated that peergos.net
uses servers in <strong>Germany</strong>. A <strong>self-hosted</strong> organizational
DataCube is a <strong>different processing location</strong>. The
@ -234,7 +233,7 @@ implementation</strong>. Location of processing is an
organizational fact on top.</p>
</section>
<section id="what-designed-under-funding-from-cure53-ros-is-not">
<h2><span class="section-number">7.6. </span>What “designed under funding from Cure53 / ROS” is not<a class="headerlink" href="#what-designed-under-funding-from-cure53-ros-is-not" title="Link to this heading"></a></h2>
<h2><span class="section-number">6.6. </span>What “designed under funding from Cure53 / ROS” is not<a class="headerlink" href="#what-designed-under-funding-from-cure53-ros-is-not" title="Link to this heading"></a></h2>
<p>The 2019 Cure53 work and the 2024 ROS work are <strong>evaluations</strong>
of a system that was designed by the Peergos authors. They
are not a claim that Cure53 or Radically Open Security

BIN
build/html/peergos-making-yourself-audit-ready-with-verae-datacubes.pdf
View file

Binary file not shown.

35
build/html/search.html
View file

@ -8,7 +8,7 @@
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
@ -56,23 +56,22 @@
<h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul>
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
</ul>
<div class="relations">

75
build/html/timestamped-receipts.html
View file

@ -5,19 +5,19 @@
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>6. Global timestamped receipts &#8212; Making yourself audit-ready with Verae DataCubes</title>
<title>5. Global timestamped receipts &#8212; Making yourself audit-ready with Verae DataCubes</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
<link rel="icon" href="_static/VeraeFullLogo.png"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="7. Peergos security evaluations in Europe" href="peergos-eu-evaluations.html" />
<link rel="prev" title="5. Encryption at rest — IPFS blocks and Peergos" href="data-at-rest.html" />
<link rel="next" title="6. Peergos security evaluations in Europe" href="peergos-eu-evaluations.html" />
<link rel="prev" title="4. Encryption at rest — IPFS blocks and Peergos" href="data-at-rest.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
@ -61,40 +61,39 @@
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">2. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">6. Global timestamped receipts</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#why-hashes-are-not-enough-by-themselves">6.1. Why hashes are not enough by themselves</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-a-verae-receipt-is">6.2. What a Verae receipt is</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-is-registered-and-what-is-not">6.3. What is registered, and what is not</a></li>
<li class="toctree-l2"><a class="reference internal" href="#first-registration-wins">6.4. First registration wins</a></li>
<li class="toctree-l2"><a class="reference internal" href="#sequence">6.5. Sequence</a></li>
<li class="toctree-l2"><a class="reference internal" href="#bundles">6.6. Bundles</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-a-receipt-does-not-prove">6.7. What a receipt does not prove</a></li>
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">5. Global timestamped receipts</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#why-hashes-are-not-enough-by-themselves">5.1. Why hashes are not enough by themselves</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-a-verae-receipt-is">5.2. What a Verae receipt is</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-is-registered-and-what-is-not">5.3. What is registered, and what is not</a></li>
<li class="toctree-l2"><a class="reference internal" href="#first-registration-wins">5.4. First registration wins</a></li>
<li class="toctree-l2"><a class="reference internal" href="#sequence">5.5. Sequence</a></li>
<li class="toctree-l2"><a class="reference internal" href="#bundles">5.6. Bundles</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-a-receipt-does-not-prove">5.7. What a receipt does not prove</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
</ul>
<div class="relations">
<h3>Related Topics</h3>
<ul>
<li><a href="index.html">Documentation overview</a><ul>
<li>Previous: <a href="data-at-rest.html" title="previous chapter"><span class="section-number">5. </span>Encryption at rest — IPFS blocks and Peergos</a></li>
<li>Next: <a href="peergos-eu-evaluations.html" title="next chapter"><span class="section-number">7. </span>Peergos security evaluations in Europe</a></li>
<li>Previous: <a href="data-at-rest.html" title="previous chapter"><span class="section-number">4. </span>Encryption at rest — IPFS blocks and Peergos</a></li>
<li>Next: <a href="peergos-eu-evaluations.html" title="next chapter"><span class="section-number">6. </span>Peergos security evaluations in Europe</a></li>
</ul></li>
</ul>
</div>
@ -115,9 +114,9 @@
<div class="body" role="main">
<section id="global-timestamped-receipts">
<h1><span class="section-number">6. </span>Global timestamped receipts<a class="headerlink" href="#global-timestamped-receipts" title="Link to this heading"></a></h1>
<h1><span class="section-number">5. </span>Global timestamped receipts<a class="headerlink" href="#global-timestamped-receipts" title="Link to this heading"></a></h1>
<section id="why-hashes-are-not-enough-by-themselves">
<h2><span class="section-number">6.1. </span>Why hashes are not enough by themselves<a class="headerlink" href="#why-hashes-are-not-enough-by-themselves" title="Link to this heading"></a></h2>
<h2><span class="section-number">5.1. </span>Why hashes are not enough by themselves<a class="headerlink" href="#why-hashes-are-not-enough-by-themselves" title="Link to this heading"></a></h2>
<p>A cryptographic hash of a document proves that two copies are
bit-for-bit the same, or that they are not. It does <strong>not</strong> prove
<strong>when</strong> the document first existed. Anyone can hash a file
@ -132,7 +131,7 @@ the hash, that a later examiner can check without trusting the
file’s custodian.</strong></p>
</section>
<section id="what-a-verae-receipt-is">
<h2><span class="section-number">6.2. </span>What a Verae receipt is<a class="headerlink" href="#what-a-verae-receipt-is" title="Link to this heading"></a></h2>
<h2><span class="section-number">5.2. </span>What a Verae receipt is<a class="headerlink" href="#what-a-verae-receipt-is" title="Link to this heading"></a></h2>
<p>A Verae <strong>global timestamped receipt</strong> is proof of:</p>
<ul class="simple">
<li><p>the <strong>hash</strong> of a block of digital information;</p></li>
@ -149,7 +148,7 @@ from 1991, applied here as a product: time-stamp the data, not
the disk.</p>
</section>
<section id="what-is-registered-and-what-is-not">
<h2><span class="section-number">6.3. </span>What is registered, and what is not<a class="headerlink" href="#what-is-registered-and-what-is-not" title="Link to this heading"></a></h2>
<h2><span class="section-number">5.3. </span>What is registered, and what is not<a class="headerlink" href="#what-is-registered-and-what-is-not" title="Link to this heading"></a></h2>
<p>Verae’s public description of sealing is that <strong>only a
fingerprint leaves the customer’s systems</strong>. The object itself
can remain in the customer’s DataCube. The central service
@ -164,7 +163,7 @@ For HIPAA, GDPR, and ordinary commercial secrecy, that is the
desired shape.</p>
</section>
<section id="first-registration-wins">
<h2><span class="section-number">6.4. </span>First registration wins<a class="headerlink" href="#first-registration-wins" title="Link to this heading"></a></h2>
<h2><span class="section-number">5.4. </span>First registration wins<a class="headerlink" href="#first-registration-wins" title="Link to this heading"></a></h2>
<p>A hash registry that allowed a later write to overwrite the
timestamp of an earlier write would be a forgery machine. The
rule is: <strong>the first SHA-256 (and companion hash) and its
@ -174,7 +173,7 @@ which is exactly how a revision should be modeled. Revisions
get their own receipts. They do not steal the original’s time.</p>
</section>
<section id="sequence">
<h2><span class="section-number">6.5. </span>Sequence<a class="headerlink" href="#sequence" title="Link to this heading"></a></h2>
<h2><span class="section-number">5.5. </span>Sequence<a class="headerlink" href="#sequence" title="Link to this heading"></a></h2>
<p>Time on a wall clock is a social convention and a NTP
configuration. Sequence inside a registration service is a
data-structure fact: this hash was committed after that hash,
@ -184,7 +183,7 @@ order even when two wall-clock stamps are close enough to argue
about.</p>
</section>
<section id="bundles">
<h2><span class="section-number">6.6. </span>Bundles<a class="headerlink" href="#bundles" title="Link to this heading"></a></h2>
<h2><span class="section-number">5.6. </span>Bundles<a class="headerlink" href="#bundles" title="Link to this heading"></a></h2>
<p>A receipt does not have to travel as a bare timestamp. It can
travel inside a <strong>digital bundle</strong> that also holds:</p>
<ul class="simple">
@ -200,7 +199,7 @@ the metadata we claim goes with it, here is the verification
path.”</p>
</section>
<section id="what-a-receipt-does-not-prove">
<h2><span class="section-number">6.7. </span>What a receipt does not prove<a class="headerlink" href="#what-a-receipt-does-not-prove" title="Link to this heading"></a></h2>
<h2><span class="section-number">5.7. </span>What a receipt does not prove<a class="headerlink" href="#what-a-receipt-does-not-prove" title="Link to this heading"></a></h2>
<p>A receipt does not prove that the person who registered the
hash was authorized to do so. That is an access-control and
identity problem.</p>

63
build/html/what-verae-provides.html
View file

@ -5,19 +5,19 @@
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>2. What Verae provides — and what it does not &#8212; Making yourself audit-ready with Verae DataCubes</title>
<title>1. What Verae provides — and what it does not &#8212; Making yourself audit-ready with Verae DataCubes</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=050b9d5b" />
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
<script src="_static/documentation_options.js?v=250a654d"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
<link rel="icon" href="_static/VeraeFullLogo.png"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="3. The Verae DataCube Server Solution" href="datacube-server.html" />
<link rel="prev" title="1. Executive summary" href="executive.html" />
<link rel="next" title="2. The Verae DataCube Server Solution" href="datacube-server.html" />
<link rel="prev" title="Making yourself audit-ready with Verae DataCubes" href="index.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
@ -61,37 +61,36 @@
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="executive.html">1. Executive summary</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">2. What Verae provides — and what it does not</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#the-boundary">2.1. The boundary</a></li>
<li class="toctree-l2"><a class="reference internal" href="#the-tools">2.2. The tools</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-the-organization-must-still-do">2.3. What the organization must still do</a></li>
<li class="toctree-l2"><a class="reference internal" href="#why-the-distinction-matters-in-an-exam">2.4. Why the distinction matters in an exam</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">1. What Verae provides — and what it does not</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#the-boundary">1.1. The boundary</a></li>
<li class="toctree-l2"><a class="reference internal" href="#the-tools">1.2. The tools</a></li>
<li class="toctree-l2"><a class="reference internal" href="#what-the-organization-must-still-do">1.3. What the organization must still do</a></li>
<li class="toctree-l2"><a class="reference internal" href="#why-the-distinction-matters-in-an-exam">1.4. Why the distinction matters in an exam</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">3. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">4. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">5. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">6. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">7. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">8. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">9. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">10. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">11. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">12. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">13. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">14. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">15. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">16. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">17. Verae Inc — contact</a></li>
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
</ul>
<div class="relations">
<h3>Related Topics</h3>
<ul>
<li><a href="index.html">Documentation overview</a><ul>
<li>Previous: <a href="executive.html" title="previous chapter"><span class="section-number">1. </span>Executive summary</a></li>
<li>Next: <a href="datacube-server.html" title="next chapter"><span class="section-number">3. </span>The Verae DataCube Server Solution</a></li>
<li>Previous: <a href="index.html" title="previous chapter">Making yourself audit-ready with Verae DataCubes</a></li>
<li>Next: <a href="datacube-server.html" title="next chapter"><span class="section-number">2. </span>The Verae DataCube Server Solution</a></li>
</ul></li>
</ul>
</div>
@ -112,9 +111,9 @@
<div class="body" role="main">
<section id="what-verae-provides-and-what-it-does-not">
<h1><span class="section-number">2. </span>What Verae provides — and what it does not<a class="headerlink" href="#what-verae-provides-and-what-it-does-not" title="Link to this heading"></a></h1>
<h1><span class="section-number">1. </span>What Verae provides — and what it does not<a class="headerlink" href="#what-verae-provides-and-what-it-does-not" title="Link to this heading"></a></h1>
<section id="the-boundary">
<h2><span class="section-number">2.1. </span>The boundary<a class="headerlink" href="#the-boundary" title="Link to this heading"></a></h2>
<h2><span class="section-number">1.1. </span>The boundary<a class="headerlink" href="#the-boundary" title="Link to this heading"></a></h2>
<p>Verae sells and operates <strong>software infrastructure</strong> and a
<strong>timestamping service</strong>. Customers use that infrastructure to store
objects, to send messages, to register hashes, to verify receipts,
@ -140,7 +139,7 @@ an Information Security Management System (ISMS) over a named
scope. Installing a DataCube does not create an ISMS.</p>
</section>
<section id="the-tools">
<h2><span class="section-number">2.2. </span>The tools<a class="headerlink" href="#the-tools" title="Link to this heading"></a></h2>
<h2><span class="section-number">1.2. </span>The tools<a class="headerlink" href="#the-tools" title="Link to this heading"></a></h2>
<p>Within that boundary, the Verae DataCube Solution is built to make
the <strong>technical</strong> work of those programs less painful. Concretely,
it gives the organization the ability to:</p>
@ -170,7 +169,7 @@ without the log itself becoming a second copy of the sensitive
payload.</p>
</section>
<section id="what-the-organization-must-still-do">
<h2><span class="section-number">2.3. </span>What the organization must still do<a class="headerlink" href="#what-the-organization-must-still-do" title="Link to this heading"></a></h2>
<h2><span class="section-number">1.3. </span>What the organization must still do<a class="headerlink" href="#what-the-organization-must-still-do" title="Link to this heading"></a></h2>
<p>Those five verbs — store, communicate, timestamp, verify, audit
— are the technical portion. The rest of a certification or
attestation program is organizational:</p>
@ -194,7 +193,7 @@ They will ask for evidence that the controls ran during the period,
not that a vendor has a nice architecture diagram.</p>
</section>
<section id="why-the-distinction-matters-in-an-exam">
<h2><span class="section-number">2.4. </span>Why the distinction matters in an exam<a class="headerlink" href="#why-the-distinction-matters-in-an-exam" title="Link to this heading"></a></h2>
<h2><span class="section-number">1.4. </span>Why the distinction matters in an exam<a class="headerlink" href="#why-the-distinction-matters-in-an-exam" title="Link to this heading"></a></h2>
<p>Examiners are trained to notice category errors. If a firm says
“we are SOC 2 because our storage vendor was pentested in Berlin,”
the next hour of the meeting is spent unwinding that claim. If a

BIN
build/latex/peergos-making-yourself-audit-ready-with-verae-datacubes.pdf
View file

Binary file not shown.