# Making yourself audit-ready with Verae DataCubes

How to **prepare an organization** for HIPAA-aligned, SOC 2, or ISO 27001
work using Verae DataCubes on **Peergos** (encrypted cryptree + hashed
IPFS) and HPKE on an **untrusted NATS** broker.

**This repository is not a HIPAA, SOC 2, or ISO certificate.**  
Peergos’s public pentests are **not** your Type II or ISO registrar
certificate. They are **component security evaluations** you can attach.

## What we verified about Peergos (EU)

Full sources: [`PEERGOS-VERIFICATION.md`](PEERGOS-VERIFICATION.md).

| Fact | Verified? |
|---|---|
| Encrypted client-side filesystem (cryptree); keys not on the storage server | Yes — Peergos book + Cure53 design review |
| IPFS blocks content-addressed; Peergos verifies hashes (tamper-evident restore) | Yes — [trust-free layers](https://book.peergos.org/security/trust.html) |
| Independent **EU** security audits, reports published | **Yes — two:** Cure53 **Berlin** (2019); Radically Open Security **Amsterdam** (2024, NLnet; EU Horizon 2020 NGI-POINTER mentioned on the post) |
| “Peergos is HIPAA/SOC 2/ISO certified” | **No.** Those audits are pentest/code/design reviews, not management-system certificates |

So: Peergos **was designed as a trust-minimized encrypted filesystem**,
**evaluated in Europe** by two specialist firms, with **public reports**.
That supports the **at-rest / backup** story. It does **not** finish
*your* audit.

## Architecture (audit interview in one page)

```
Endpoint (keys stay here / HSM)
    │  HPKE content (NPE suite)
    │  routing: dest + subject in the clear
    ▼
Untrusted NATS (cannot read bodies)
    │
    ▼
Verae DataCube chain (append-only hashes)
    │  written through Peergos client
    ▼
Peergos cryptree (encrypted names, sizes, graph)
    │  chunks → CID / hash
    ▼
IPFS  (distributed, hash-verified ciphertext)
```

- **At rest:** Peergos cryptree + IPFS. Hosts with disk/backup see
  **opaque hashed ciphertext**, not PHI, if they lack keys.
- **In transit (NATS):** HPKE-Base to directory public keys. Broker is
  honest-but-curious: destinations yes, bodies no.
- **Integrity:** cube JSONL chain + dual hash + IPFS CID check on
  restore (re-fetch blocks, re-verify hashes — not a plaintext tape).

## BAAs / DPAs

Ciphertext-without-keys **narrows** who is a Business Associate or
GDPR processor for **content**. It does **not** automatically delete
contracts for VMs, usernames, or logs. See [`BAA-DPA.md`](BAA-DPA.md).

## Pack

| File | Use |
|---|---|
| `PEERGOS-VERIFICATION.md` | Sourced Peergos/EU audit facts |
| `BAA-DPA.md` | Counsel briefing |
| `CHECKLIST.md` | Evidence list |
| `HOWTO.md` | How to hand this to an auditor |
| `MODULE.md` | Callers / non-runtime |

Live technical surfaces (ns1): https://pfc.georgelambert.org/health ·
https://pfc.georgelambert.org/v1/npe/keys ·
https://docs.pfc.georgelambert.org/controls.html

Related: https://git.georgelambert.org/marchon/system-git-sync

## Sphinx (HTML + LaTeX PDF)

Sources live in ``source/`` (Sphinx). Build:

```
make html
make latexpdf
```

* HTML: ``build/html/index.html``
* PDF: ``build/latex/peergos-making-yourself-audit-ready-with-verae-datacubes.pdf``

LaTeX companion links are **relative PDFs** (not Markdown). Live HTML:
https://docs.pfc.georgelambert.org/audit-ready/