%% Generated by Sphinx. \def\sphinxdocclass{report} \documentclass[letterpaper,11pt,english]{sphinxmanual} \ifdefined\pdfpxdimen \let\sphinxpxdimen\pdfpxdimen\else\newdimen\sphinxpxdimen \fi \sphinxpxdimen=.75bp\relax \ifdefined\pdfimageresolution \pdfimageresolution= \numexpr \dimexpr1in\relax/\sphinxpxdimen\relax \fi \newdimen\sphinxremdimen\sphinxremdimen = 11pt %% let collapsible pdf bookmarks panel have high depth per default \PassOptionsToPackage{bookmarksdepth=5}{hyperref} \PassOptionsToPackage{booktabs}{sphinx} \PassOptionsToPackage{colorrows}{sphinx} \PassOptionsToPackage{warn}{textcomp} \usepackage[utf8]{inputenc} \ifdefined\DeclareUnicodeCharacter % support both utf8 and utf8x syntaxes \ifdefined\DeclareUnicodeCharacterAsOptional \def\sphinxDUC#1{\DeclareUnicodeCharacter{"#1}} \else \let\sphinxDUC\DeclareUnicodeCharacter \fi \sphinxDUC{00A0}{\nobreakspace} \sphinxDUC{2500}{\sphinxunichar{2500}} \sphinxDUC{2502}{\sphinxunichar{2502}} \sphinxDUC{2514}{\sphinxunichar{2514}} \sphinxDUC{251C}{\sphinxunichar{251C}} \sphinxDUC{2572}{\textbackslash} \fi \usepackage{cmap} \usepackage[T1]{fontenc} \usepackage{amsmath,amssymb,amstext} \usepackage{babel} \usepackage{tgtermes} \usepackage{tgheros} \renewcommand{\ttdefault}{txtt} \usepackage[Bjarne]{fncychap} \usepackage{sphinx} \fvset{fontsize=auto} \usepackage{geometry} % Include hyperref last. \usepackage{hyperref} % Fix anchor placement for figures with captions. \usepackage{hypcap}% it must be loaded after hyperref. % Set up styles of URL: it should be placed after hyperref. \urlstyle{same} \usepackage{sphinxmessages} \setcounter{tocdepth}{1} \usepackage{hyperref} \title{Making yourself audit-ready with Verae DataCubes} \date{Sep 16, 2026} \release{} \author{Verae} \newcommand{\sphinxlogo}{\vbox{}} \renewcommand{\releasename}{} \makeindex \begin{document} \ifdefined\shorthandoff \ifnum\catcode`\=\string=\active\shorthandoff{=}\fi \ifnum\catcode`\"=\active\shorthandoff{"}\fi \fi \pagestyle{empty} \sphinxmaketitle \pagestyle{plain} \sphinxtableofcontents \pagestyle{normal} \phantomsection\label{\detokenize{index::doc}} \sphinxAtStartPar How to \sphinxstylestrong{prepare an organization} for HIPAA\sphinxhyphen{}aligned, SOC 2, or ISO 27001 work using Verae DataCubes on \sphinxstylestrong{Peergos} (encrypted cryptree + hashed IPFS) and HPKE on an \sphinxstylestrong{untrusted NATS} broker. \sphinxAtStartPar \sphinxstylestrong{This document is not a HIPAA, SOC 2, or ISO certificate.} Peergos’s public pentests are \sphinxstylestrong{not} your Type II or ISO registrar certificate. They are \sphinxstylestrong{component security evaluations} you can attach. \sphinxstepscope \chapter{Peergos verification (what was actually audited)} \label{\detokenize{verification:peergos-verification-what-was-actually-audited}}\label{\detokenize{verification::doc}} \sphinxAtStartPar This chapter records \sphinxstylestrong{sourced} facts. It does \sphinxstylestrong{not} turn Peergos, Verae, or DataCubes into a HIPAA, SOC 2, or ISO 27001 certificate. \section{Claim to check} \label{\detokenize{verification:claim-to-check}} \sphinxAtStartPar Data at rest is stored in an encrypted append\sphinxhyphen{}only Peergos filesystem; backup/restore is managed via a distributed, hashed, encrypted Peergos IPFS system, designed and evaluated in the EU as an audited secure filesystem. \section{Independent security audits (Europe)} \label{\detokenize{verification:independent-security-audits-europe}} \sphinxAtStartPar \sphinxstylestrong{2019 — Cure53 (Berlin, Germany).} Pentest, source\sphinxhyphen{}code audit, \sphinxstylestrong{crypto/design review} (May\textendash{}June 2019). No fundamental architectural or cryptographic problems; issues fixed. Cure53: the platform \sphinxstylestrong{passed this evaluation}. \sphinxAtStartPar \sphinxstylestrong{2024 — Radically Open Security B.V. (Amsterdam, Netherlands).} Crystal\sphinxhyphen{}box pentest + code audit of Peergos web\sphinxhyphen{}ui (Sep\textendash{}Nov 2024). \sphinxstylestrong{0} extreme / high / elevated; \sphinxstylestrong{2} moderate, \sphinxstylestrong{6} low; Peergos states all fixed; no data exposure or integrity compromise (mostly UI crashes). \sphinxAtStartPar Both firms are \sphinxstylestrong{EU\sphinxhyphen{}based}. Both full reports are \sphinxstylestrong{public}. That is a \sphinxstylestrong{security evaluation of the Peergos protocol/implementation}, not a HIPAA/SOC 2/ISO management\sphinxhyphen{}system certificate. \section{EU funding / NLnet} \label{\detokenize{verification:eu-funding-nlnet}}\begin{itemize} \item {} \sphinxAtStartPar Peergos received funding from the \sphinxstylestrong{European Union Horizon 2020} programme under \sphinxstylestrong{NGI\sphinxhyphen{}POINTER}, grant \sphinxstylestrong{871528} (stated on the 2024 audit post). \item {} \sphinxAtStartPar The 2024 audit was supported by \sphinxstylestrong{NLnet} (Netherlands). \end{itemize} \section{Hosted instance location} \label{\detokenize{verification:hosted-instance-location}} \sphinxAtStartPar Peergos’s hosted privacy notice states peergos.net uses servers in \sphinxstylestrong{Germany}. \sphinxstylestrong{Self\sphinxhyphen{}hosted ns1 / customer cryptree is a different processing location} and must be documented in \sphinxstyleemphasis{your} RoPA / BAA pack. \section{Encrypted filesystem + hashed IPFS (design)} \label{\detokenize{verification:encrypted-filesystem-hashed-ipfs-design}}\begin{itemize} \item {} \sphinxAtStartPar \sphinxstylestrong{Cryptree}: tree of symmetric keys; fine\sphinxhyphen{}grained read/write caps; sibling names hidden; writes \sphinxstylestrong{signed}. \item {} \sphinxAtStartPar \sphinxstylestrong{Chunks}: up to 5 MiB, padded, independently encrypted (Salsa20\sphinxhyphen{}Poly1305); random 256\sphinxhyphen{}bit keys (not convergent). \item {} \sphinxAtStartPar \sphinxstylestrong{IPFS}: content\sphinxhyphen{}addressed blocks. Peergos \sphinxstylestrong{verifies the hash} of every block read from or written to IPFS. Clients verify hashes and signatures from a Peergos server. \item {} \sphinxAtStartPar \sphinxstylestrong{CHAMP}: encrypted cryptree nodes under \sphinxstylestrong{random 32\sphinxhyphen{}byte labels}. \item {} \sphinxAtStartPar Sharing: hybrid \sphinxstylestrong{X25519 + ML\sphinxhyphen{}KEM\sphinxhyphen{}1024}. \end{itemize} \sphinxAtStartPar “Append\sphinxhyphen{}only” in Verae DataCubes is the \sphinxstylestrong{cube chain JSONL} (application integrity). Peergos uses signed updates and immutable blocks. Do not conflate the two layers in an audit interview. \section{Not verified / do not claim} \label{\detokenize{verification:not-verified-do-not-claim}}\begin{itemize} \item {} \sphinxAtStartPar “Peergos is HIPAA certified” — \sphinxstylestrong{false.} HIPAA is not a product certificate. \item {} \sphinxAtStartPar “Peergos is SOC 2 / ISO 27001 certified” — \sphinxstylestrong{not shown.} Published work is pentest/code audit, not Type II or ISO registrar. \item {} \sphinxAtStartPar “EU certified Peergos as a government\sphinxhyphen{}standard filesystem” — \sphinxstylestrong{overstated.} What exists: EU grant funding, NLNet\sphinxhyphen{}funded ROS pentest, Cure53 Berlin design+code audit. \item {} \sphinxAtStartPar “Hosts with disk/backup never need a BAA/DPA” — \sphinxstylestrong{legal conclusion, not a technical fact.} See {\hyperref[\detokenize{baa-dpa::doc}]{\sphinxcrossref{\DUrole{doc}{BAAs and DPAs when ciphertext has no host keys}}}}. \end{itemize} \sphinxstepscope \chapter{Architecture (audit interview)} \label{\detokenize{architecture:architecture-audit-interview}}\label{\detokenize{architecture::doc}} \begin{sphinxVerbatim}[commandchars=\\\{\}] Endpoint (keys stay here / HSM) │ HPKE content (NPE suite) │ routing: dest + subject in the clear ▼ Untrusted NATS (cannot read bodies) │ ▼ Verae DataCube chain (append\PYGZhy{}only hashes) │ written through Peergos client ▼ Peergos cryptree (encrypted names, sizes, graph) │ chunks \(\rightarrow\) CID / hash ▼ IPFS (distributed, hash\PYGZhy{}verified ciphertext) \end{sphinxVerbatim} \begin{itemize} \item {} \sphinxAtStartPar \sphinxstylestrong{At rest:} Peergos cryptree + IPFS. Hosts with disk/backup see \sphinxstylestrong{opaque hashed ciphertext}, not PHI, if they lack keys. \item {} \sphinxAtStartPar \sphinxstylestrong{In transit (NATS):} HPKE\sphinxhyphen{}Base to directory public keys. Broker is honest\sphinxhyphen{}but\sphinxhyphen{}curious: destinations yes, bodies no. \item {} \sphinxAtStartPar \sphinxstylestrong{Integrity:} cube JSONL chain + dual hash + IPFS CID check on restore (re\sphinxhyphen{}fetch blocks, re\sphinxhyphen{}verify hashes — not a plaintext tape). \end{itemize} \sphinxAtStartPar NATS remains an untrusted router. Production E2E is NPE/HPKE. Passthrough means destination in the clear; the body is ciphertext. \sphinxAtStartPar See companion \sphinxcode{\sphinxupquote{peergos\sphinxhyphen{}for\sphinxhyphen{}compliance.pdf}} (same folder) for controls, custody, and variables chapters. \href{peergos-for-compliance.pdf}{peergos-for-compliance.pdf} \sphinxstepscope \chapter{BAAs and DPAs when ciphertext has no host keys} \label{\detokenize{baa-dpa:baas-and-dpas-when-ciphertext-has-no-host-keys}}\label{\detokenize{baa-dpa::doc}} \sphinxAtStartPar This is \sphinxstylestrong{guidance for an evidence pack}, not legal advice. \section{The operator statement} \label{\detokenize{baa-dpa:the-operator-statement}} \sphinxAtStartPar Data at rest lives in the \sphinxstylestrong{encrypted Peergos cryptree}. Restore uses \sphinxstylestrong{distributed, hash\sphinxhyphen{}verified, encrypted IPFS blocks}. Hosts and backup media see \sphinxstylestrong{opaque blobs} (and random CHAMP labels), not filenames, not PHI, not social graph — if keys never leave the client / customer HSM. \sphinxAtStartPar That is \sphinxstylestrong{true of the Peergos design} (see {\hyperref[\detokenize{verification::doc}]{\sphinxcrossref{\DUrole{doc}{Peergos verification (what was actually audited)}}}}). It \sphinxstylestrong{changes the BAA/DPA conversation}. It does \sphinxstylestrong{not} auto\sphinxhyphen{}delete the need for contracts. \section{HIPAA (US) — Business Associate} \label{\detokenize{baa-dpa:hipaa-us-business-associate}} \sphinxAtStartPar A Business Associate is a person who \sphinxstylestrong{creates, receives, maintains, or transmits ePHI} for a covered entity. \sphinxAtStartPar \sphinxstylestrong{Technical argument you can make (and should document):} \begin{enumerate} \sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% \item {} \sphinxAtStartPar ePHI is encrypted \sphinxstylestrong{before} it leaves the endpoint (Peergos client / DataCube writer). \item {} \sphinxAtStartPar The storage node, IPFS, disk, and backup hold \sphinxstylestrong{ciphertext + hashes}. \item {} \sphinxAtStartPar Private keys \sphinxstylestrong{do not} reside on the storage host (customer HSM / client). Hash verification detects tampering. \item {} \sphinxAtStartPar Therefore the host \sphinxstylestrong{cannot maintain ePHI in intelligible form}. \end{enumerate} \sphinxAtStartPar HHS distinguishes \sphinxstylestrong{conduits} and parties that never have access to ePHI. Many programs still \sphinxstylestrong{sign a BAA} when a vendor touches infrastructure, because misconfiguration, support exports, or logs could later expose plaintext. OCR looks at \sphinxstylestrong{your} risk analysis. \sphinxAtStartPar \sphinxstylestrong{Practical pack:} risk analysis memo citing cryptree + IPFS hash checks + key custody; BAA \sphinxstylestrong{or} written determination that the vendor is \sphinxstylestrong{not} a BA because they cannot decrypt; list every party with disk/backup (ns1, IPFS cluster, offsite replica). \section{GDPR (EU/UK) — processor vs technical measure} \label{\detokenize{baa-dpa:gdpr-eu-uk-processor-vs-technical-measure}} \sphinxAtStartPar Encrypted data can still be \sphinxstylestrong{personal data} if it is reasonably attributable (usernames, IPs, invoice identity). GDPR \sphinxstylestrong{Art. 32} lists encryption as a security measure. \sphinxAtStartPar Peergos is designed so the \sphinxstylestrong{server is an adversary} for content and most metadata. EU\sphinxhyphen{}based \sphinxstylestrong{independent pentests} (Cure53 DE, ROS NL) evaluated that design. Processing location for \sphinxstylestrong{self\sphinxhyphen{}host} is \sphinxstyleemphasis{your} ns1 / customer region, not peergos.net’s Germany hosting, unless you use peergos.net. \sphinxAtStartPar You may still need a \sphinxstylestrong{DPA (Art. 28)} with anyone who \sphinxstylestrong{processes} personal data (usernames, logs, billing). Ciphertext\sphinxhyphen{}only storage \sphinxstylestrong{narrows} the DPA’s technical annex. \section{NATS operators} \label{\detokenize{baa-dpa:nats-operators}} \sphinxAtStartPar NATS is an \sphinxstylestrong{untrusted broker}. Content is HPKE; destinations and subjects are in the clear. A NATS operator \sphinxstylestrong{cannot} read bodies without endpoint private keys; \sphinxstylestrong{can} see routing metadata; \sphinxstylestrong{can} drop/delay copy \sphinxstylestrong{ciphertext}. Treat like a transit provider: DPA/BAA depends on whether routing metadata is personal data in your jurisdiction. \section{What “making yourself audit\sphinxhyphen{}ready” means} \label{\detokenize{baa-dpa:what-making-yourself-audit-ready-means}} \sphinxAtStartPar You are \sphinxstylestrong{not} buying Peergos’s Cure53/ROS reports as \sphinxstyleemphasis{your} SOC 2. You are \sphinxstylestrong{reusing} those public evaluations as \sphinxstylestrong{vendor/component assurance}, then adding your scope, RoPA, key\sphinxhyphen{}custody, inspect k\sphinxhyphen{}of\sphinxhyphen{}n, admin\sphinxhyphen{}history, instance evidence, and contracts that match who can actually see plaintext. \sphinxstepscope \chapter{Audit\sphinxhyphen{}ready checklist} \label{\detokenize{checklist:audit-ready-checklist}}\label{\detokenize{checklist::doc}} \sphinxAtStartPar Use this as a working list. Check items only when \sphinxstylestrong{evidence exists} (screenshot, log export, signed policy, ticket). This list is not a certificate. \section{A. Scope and data map} \label{\detokenize{checklist:a-scope-and-data-map}}\begin{itemize} \item {} \sphinxAtStartPar Named legal entity and systems in scope (console, Drive, NATS, IPFS, ns1) \item {} \sphinxAtStartPar Data\sphinxhyphen{}flow diagram: endpoint \(\rightarrow\) HPKE/NATS \(\rightarrow\) cryptree/IPFS \item {} \sphinxAtStartPar What is PHI / personal data vs ciphertext vs routing metadata \item {} \sphinxAtStartPar Peergos verification chapter attached ({\hyperref[\detokenize{verification::doc}]{\sphinxcrossref{\DUrole{doc}{Peergos verification (what was actually audited)}}}}) \end{itemize} \section{B. Keys and encryption} \label{\detokenize{checklist:b-keys-and-encryption}}\begin{itemize} \item {} \sphinxAtStartPar Customer holds Peergos/Drive keys; not on storage host \item {} \sphinxAtStartPar NPE/HPKE endpoint keys in directory; private 0600; no xor content \item {} \sphinxAtStartPar Signed Ed25519 config; unsigned rejected; admin\sphinxhyphen{}history prev+new+diff \item {} \sphinxAtStartPar HSM or documented lab\sphinxhyphen{}to\sphinxhyphen{}HSM path \end{itemize} \section{C. Access} \label{\detokenize{checklist:c-access}}\begin{itemize} \item {} \sphinxAtStartPar Console \sphinxcode{\sphinxupquote{PFC\_REQUIRE\_AUTH=1}}, TOTP; Drive login separate \item {} \sphinxAtStartPar Inspect k\sphinxhyphen{}of\sphinxhyphen{}n; author is not an officer; log\sphinxhyphen{}before\sphinxhyphen{}reveal \item {} \sphinxAtStartPar Joiner / mover / leaver for console users \item {} \sphinxAtStartPar Google SSO does \sphinxstylestrong{not} unwrap cubes \end{itemize} \section{D. Integrity and backup} \label{\detokenize{checklist:d-integrity-and-backup}}\begin{itemize} \item {} \sphinxAtStartPar Cube chain append\sphinxhyphen{}only JSONL; dual hash \item {} \sphinxAtStartPar Hash registry: first SHA\sphinxhyphen{}256 and receipt win \item {} \sphinxAtStartPar Peergos/IPFS: hash\sphinxhyphen{}verified encrypted blocks (restore = re\sphinxhyphen{}fetch CIDs) \item {} \sphinxAtStartPar Restore test: recover a cube from content\sphinxhyphen{}addressed ciphertext without plaintext backup tapes \end{itemize} \section{E. Logging} \label{\detokenize{checklist:e-logging}}\begin{itemize} \item {} \sphinxAtStartPar Inspect audit events \item {} \sphinxAtStartPar SM summaries: codes + lookup\_id only (no bodies) \item {} \sphinxAtStartPar Admin\sphinxhyphen{}history cube for config \end{itemize} \section{F. Contracts (counsel)} \label{\detokenize{checklist:f-contracts-counsel}}\begin{itemize} \item {} \sphinxAtStartPar Written BA / not\sphinxhyphen{}a\sphinxhyphen{}BA determination for disk, VM, backup, IPFS \item {} \sphinxAtStartPar DPA Art. 28 where usernames/logs/IPs are processed \item {} \sphinxAtStartPar NATS operator: metadata vs content in the annex \item {} \sphinxAtStartPar Peergos component assurance: attach Cure53 2019 + ROS 2024 PDFs (public; not your org’s ISO/SOC report) \end{itemize} \section{G. Independent audit of \sphinxstyleemphasis{you}} \label{\detokenize{checklist:g-independent-audit-of-you}}\begin{itemize} \item {} \sphinxAtStartPar SOC 2 Type I/II engagement \sphinxstylestrong{or} ISO 27001 registrar \sphinxstylestrong{or} HIPAA risk analysis + policies (pick the program you actually need) \item {} \sphinxAtStartPar Evidence window (Type II / surveillance) if applicable \end{itemize} \sphinxstepscope \chapter{How to use this pack} \label{\detokenize{howto:how-to-use-this-pack}}\label{\detokenize{howto::doc}}\begin{enumerate} \sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% \item {} \sphinxAtStartPar Read {\hyperref[\detokenize{verification::doc}]{\sphinxcrossref{\DUrole{doc}{Peergos verification (what was actually audited)}}}} so you do not over\sphinxhyphen{}claim Peergos audits. \item {} \sphinxAtStartPar Fill {\hyperref[\detokenize{checklist::doc}]{\sphinxcrossref{\DUrole{doc}{Audit\sphinxhyphen{}ready checklist}}}} with \sphinxstylestrong{your} instance evidence (ns1, keys, users). \item {} \sphinxAtStartPar Give {\hyperref[\detokenize{baa-dpa::doc}]{\sphinxcrossref{\DUrole{doc}{BAAs and DPAs when ciphertext has no host keys}}}} to counsel with the data\sphinxhyphen{}flow from {\hyperref[\detokenize{architecture::doc}]{\sphinxcrossref{\DUrole{doc}{Architecture (audit interview)}}}}. \item {} \sphinxAtStartPar Point auditors at live technical surfaces (do not give them private keys). \end{enumerate} \begin{enumerate} \sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% \setcounter{enumi}{4} \item {} \sphinxAtStartPar Attach the two \sphinxstylestrong{public} Peergos pentest PDFs from the Peergos \sphinxcode{\sphinxupquote{audits/}} tree as \sphinxstylestrong{vendor security evaluations}, labeled “not our SOC 2 / ISO certificate”. \end{enumerate} \sphinxAtStartPar Companion system PDF (same folder): \href{peergos-for-compliance.pdf}{peergos-for-compliance.pdf} \chapter{What we verified about Peergos (EU)} \label{\detokenize{index:what-we-verified-about-peergos-eu}} \sphinxAtStartPar See the full sourced table in {\hyperref[\detokenize{verification::doc}]{\sphinxcrossref{\DUrole{doc}{Peergos verification (what was actually audited)}}}}. \begin{itemize} \item {} \sphinxAtStartPar Encrypted client\sphinxhyphen{}side filesystem (cryptree); keys not on the storage server — \sphinxstylestrong{yes} (Peergos book + Cure53 design review). \item {} \sphinxAtStartPar IPFS blocks content\sphinxhyphen{}addressed; Peergos verifies hashes — \sphinxstylestrong{yes}. \item {} \sphinxAtStartPar Independent \sphinxstylestrong{EU} security audits, reports published — \sphinxstylestrong{yes, two:} Cure53 Berlin (2019); Radically Open Security Amsterdam (2024). \item {} \sphinxAtStartPar “Peergos is HIPAA/SOC 2/ISO certified” — \sphinxstylestrong{no.} Those audits are pentest/code/design reviews, not management\sphinxhyphen{}system certificates. \end{itemize} \sphinxAtStartPar Peergos \sphinxstylestrong{was designed as a trust\sphinxhyphen{}minimized encrypted filesystem}, \sphinxstylestrong{evaluated in Europe} by two specialist firms, with \sphinxstylestrong{public reports}. That supports the \sphinxstylestrong{at\sphinxhyphen{}rest / backup} story. It does \sphinxstylestrong{not} finish \sphinxstyleemphasis{your} audit. \sphinxAtStartPar Companion PDFs in the \sphinxstylestrong{same directory} as this file (relative PDF links, not Markdown): \begin{itemize} \item \href{peergos-for-compliance.pdf}{peergos-for-compliance.pdf} \item \href{nats-service-endpoints.pdf}{nats-service-endpoints.pdf} \item \href{secure-messaging.pdf}{secure-messaging.pdf} \end{itemize} \renewcommand{\indexname}{Index} \printindex \end{document}