Sphinx HTML and 17-page LaTeX PDF for the audit-ready pack

source/ is the Sphinx tree. Companion PDF hrefs are relative, not Markdown.
2026-09-15 23:59:54 -04:00 · 2026-09-15 23:59:54 -04:00 · da60402e88
commit da60402e88
parent afa270a141
104 changed files with 16818 additions and 0 deletions
--- a/build/html/index.html
+++ b/build/html/index.html
@ -0,0 +1,173 @@
+<!DOCTYPE html>
+
+<html lang="en" data-content_root="./">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
+
+    <title>Making yourself audit-ready with Verae DataCubes &#8212; Making yourself audit-ready with Verae DataCubes</title>
+    <link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
+    <link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
+    <link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=27fed22d" />
+    <script src="_static/documentation_options.js?v=5929fcd5"></script>
+    <script src="_static/doctools.js?v=fd6eb6e6"></script>
+    <script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
+    <link rel="index" title="Index" href="genindex.html" />
+    <link rel="search" title="Search" href="search.html" />
+    <link rel="next" title="Peergos verification (what was actually audited)" href="verification.html" />
+   
+  <link rel="stylesheet" href="_static/custom.css" type="text/css" />
+  
+
+  
+  
+
+  </head><body>
+  
+
+    <div class="document">
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          
+
+          <div class="body" role="main">
+            
+  <section id="making-yourself-audit-ready-with-verae-datacubes">
+<h1>Making yourself audit-ready with Verae DataCubes<a class="headerlink" href="#making-yourself-audit-ready-with-verae-datacubes" title="Link to this heading">¶</a></h1>
+<p>How to <strong>prepare an organization</strong> for HIPAA-aligned, SOC 2, or ISO 27001
+work using Verae DataCubes on <strong>Peergos</strong> (encrypted cryptree + hashed
+IPFS) and HPKE on an <strong>untrusted NATS</strong> broker.</p>
+<p><strong>This document is not a HIPAA, SOC 2, or ISO certificate.</strong>
+Peergos’s public pentests are <strong>not</strong> your Type II or ISO registrar
+certificate. They are <strong>component security evaluations</strong> you can attach.</p>
+<div class="toctree-wrapper compound">
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="verification.html">Peergos verification (what was actually audited)</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="verification.html#claim-to-check">Claim to check</a></li>
+<li class="toctree-l2"><a class="reference internal" href="verification.html#independent-security-audits-europe">Independent security audits (Europe)</a></li>
+<li class="toctree-l2"><a class="reference internal" href="verification.html#eu-funding-nlnet">EU funding / NLnet</a></li>
+<li class="toctree-l2"><a class="reference internal" href="verification.html#hosted-instance-location">Hosted instance location</a></li>
+<li class="toctree-l2"><a class="reference internal" href="verification.html#encrypted-filesystem-hashed-ipfs-design">Encrypted filesystem + hashed IPFS (design)</a></li>
+<li class="toctree-l2"><a class="reference internal" href="verification.html#not-verified-do-not-claim">Not verified / do not claim</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="architecture.html">Architecture (audit interview)</a></li>
+<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">BAAs and DPAs when ciphertext has no host keys</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#the-operator-statement">The operator statement</a></li>
+<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#hipaa-us-business-associate">HIPAA (US) — Business Associate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#gdpr-eu-uk-processor-vs-technical-measure">GDPR (EU/UK) — processor vs technical measure</a></li>
+<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#nats-operators">NATS operators</a></li>
+<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#what-making-yourself-audit-ready-means">What “making yourself audit-ready” means</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="checklist.html">Audit-ready checklist</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="checklist.html#a-scope-and-data-map">A. Scope and data map</a></li>
+<li class="toctree-l2"><a class="reference internal" href="checklist.html#b-keys-and-encryption">B. Keys and encryption</a></li>
+<li class="toctree-l2"><a class="reference internal" href="checklist.html#c-access">C. Access</a></li>
+<li class="toctree-l2"><a class="reference internal" href="checklist.html#d-integrity-and-backup">D. Integrity and backup</a></li>
+<li class="toctree-l2"><a class="reference internal" href="checklist.html#e-logging">E. Logging</a></li>
+<li class="toctree-l2"><a class="reference internal" href="checklist.html#f-contracts-counsel">F. Contracts (counsel)</a></li>
+<li class="toctree-l2"><a class="reference internal" href="checklist.html#g-independent-audit-of-you">G. Independent audit of <em>you</em></a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="howto.html">How to use this pack</a></li>
+</ul>
+</div>
+<section id="what-we-verified-about-peergos-eu">
+<h2>What we verified about Peergos (EU)<a class="headerlink" href="#what-we-verified-about-peergos-eu" title="Link to this heading">¶</a></h2>
+<p>See the full sourced table in <a class="reference internal" href="verification.html"><span class="doc">Peergos verification (what was actually audited)</span></a>.</p>
+<ul class="simple">
+<li><p>Encrypted client-side filesystem (cryptree); keys not on the storage
+server — <strong>yes</strong> (Peergos book + Cure53 design review).</p></li>
+<li><p>IPFS blocks content-addressed; Peergos verifies hashes — <strong>yes</strong>.</p></li>
+<li><p>Independent <strong>EU</strong> security audits, reports published — <strong>yes, two:</strong>
+Cure53 Berlin (2019); Radically Open Security Amsterdam (2024).</p></li>
+<li><p>“Peergos is HIPAA/SOC 2/ISO certified” — <strong>no.</strong> Those audits are
+pentest/code/design reviews, not management-system certificates.</p></li>
+</ul>
+<p>Peergos <strong>was designed as a trust-minimized encrypted filesystem</strong>,
+<strong>evaluated in Europe</strong> by two specialist firms, with <strong>public reports</strong>.
+That supports the <strong>at-rest / backup</strong> story. It does <strong>not</strong> finish
+<em>your</em> audit.</p>
+<p>Live technical surfaces:</p>
+<ul class="simple">
+<li><p><a class="reference external" href="https://pfc.georgelambert.org/health">https://pfc.georgelambert.org/health</a></p></li>
+<li><p><a class="reference external" href="https://pfc.georgelambert.org/v1/npe/keys">https://pfc.georgelambert.org/v1/npe/keys</a></p></li>
+<li><p><a class="reference external" href="https://docs.pfc.georgelambert.org/controls.html">https://docs.pfc.georgelambert.org/controls.html</a></p></li>
+<li><p><a class="reference external" href="https://git.georgelambert.org/marchon/peergos-making-yourself-audit-ready-with-verae-datacubes">https://git.georgelambert.org/marchon/peergos-making-yourself-audit-ready-with-verae-datacubes</a></p></li>
+</ul>
+<p>Companion system docs (HTML): <a class="reference external" href="https://docs.pfc.georgelambert.org/">https://docs.pfc.georgelambert.org/</a></p>
+</section>
+</section>
+
+
+          </div>
+          
+        </div>
+      </div>
+      <div class="sphinxsidebar" role="navigation" aria-label="Main">
+        <div class="sphinxsidebarwrapper">
+<h1 class="logo"><a href="#">Making yourself audit-ready with Verae DataCubes</a></h1>
+
+
+
+
+
+
+
+
+
+<search id="searchbox" style="display: none" role="search">
+    <div class="searchformwrapper">
+    <form class="search" action="search.html" method="get">
+      <input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" placeholder="Search"/>
+      <input type="submit" value="Go" />
+    </form>
+    </div>
+</search>
+<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="verification.html">Peergos verification (what was actually audited)</a></li>
+<li class="toctree-l1"><a class="reference internal" href="architecture.html">Architecture (audit interview)</a></li>
+<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">BAAs and DPAs when ciphertext has no host keys</a></li>
+<li class="toctree-l1"><a class="reference internal" href="checklist.html">Audit-ready checklist</a></li>
+<li class="toctree-l1"><a class="reference internal" href="howto.html">How to use this pack</a></li>
+</ul>
+
+<div class="relations">
+<h3>Related Topics</h3>
+<ul>
+  <li><a href="#">Documentation overview</a><ul>
+      <li>Next: <a href="verification.html" title="next chapter">Peergos verification (what was actually audited)</a></li>
+  </ul></li>
+</ul>
+</div>
+
+
+
+
+
+
+
+
+        </div>
+      </div>
+      <div class="clearer"></div>
+    </div>
+    <div class="footer">
+      &#169;2026, Verae.
+      
+      |
+      Powered by <a href="https://www.sphinx-doc.org/">Sphinx 9.1.0</a>
+      &amp; <a href="https://alabaster.readthedocs.io">Alabaster 1.0.0</a>
+      
+      |
+      <a href="_sources/index.rst.txt"
+          rel="nofollow">Page source</a>
+    </div>
+
+    
+
+    
+  </body>
+</html>