Peergos security evaluations in Europe ====================================== What was evaluated ------------------ The offline storage and replication system used with Verae DataCubes is **Peergos**: an encrypted, peer-to-peer filesystem whose blocks live on IPFS. Peergos was designed as a trust-minimized store --- the server is treated as an adversary for content and for most metadata --- and that design was submitted to independent European security firms **twice**. Those engagements are **security evaluations of the Peergos protocol and implementation**. They are pentests, source-code audits, and (in 2019) a cryptographic and design review. They are **not**: * a HIPAA certification of Peergos, Verae, or any customer; * a SOC 2 Type I or Type II report; * an ISO 27001 certificate of an ISMS; * a government "certified filesystem" designation. Both firms are **EU-based**. Both full reports are **public**. That combination --- independent, European, public, repeat --- is unusual and is worth attaching to a vendor-assurance file, **labeled correctly**. 2019 --- Cure53, Berlin, Germany -------------------------------- * **Firm:** Cure53 * **Location:** Berlin, Germany * **When:** May--June 2019 * **Scope:** pentest, source-code audit, and **crypto / design review** * **Outcome:** no fundamental architectural or cryptographic problems were identified. Issues that were identified were fixed. Cure53 stated that the platform **passed this evaluation**. A crypto/design review is a stronger statement than a black-box pentest of a web form. It is an expert reading of whether the cryptree, the chunk encryption, the identity model, and the threat model hang together. "Passed" in Cure53's language is not an ISO mark. It is a specialist firm saying: we looked at the cryptography and the architecture, we did not find a fatal flaw, and the issues we did find were addressed. Primary sources (public): * https://peergos.org/posts/security-audit * https://cure53.de/pentest-report_peergos.pdf * https://github.com/Peergos/Peergos/tree/master/audits 2024 --- Radically Open Security B.V., Amsterdam ------------------------------------------------ * **Firm:** Radically Open Security B.V. * **Location:** Amsterdam, Netherlands * **When:** September--November 2024 * **Scope:** crystal-box pentest plus code audit of the Peergos **web UI** * **Funding context:** the 2024 audit post states support from **NLnet** (Netherlands) and refers to European Union Horizon 2020 **NGI-POINTER**, grant **871528**. * **Outcome:** **0** findings rated extreme, high, or elevated; **2** moderate; **6** low. Peergos states that all were fixed. There was **no data exposure** and **no integrity compromise**. The issues were described as mostly UI crashes. A crystal-box (clear-box) engagement means the testers had source. A web-UI scope is narrower than the 2019 crypto/design review: it is evidence about the interface that humans actually click, which is where many "encrypted backend" products fail in practice. Zero high-severity findings, no data exposure, no integrity compromise, and a public report are the facts. They are good facts. They are still not a customer's Type II. Primary sources (public): * https://peergos.org/posts/security-audit-2024 * https://github.com/Peergos/Peergos/tree/master/audits How to present these reports to an auditor ------------------------------------------ Correct: "Our at-rest layer is Peergos. Peergos was independently evaluated in Berlin in 2019 (crypto and design) and in Amsterdam in 2024 (web UI, crystal box). Both reports are public. We attach them as **component security evaluations**. They are not our SOC 2, not our ISO 27001, and not a HIPAA certification. Our own controls, our own period of examination, and our own auditor are separate." Incorrect: "We are HIPAA certified because Peergos was audited in Europe." "Peergos is ISO 27001." "The EU certified this filesystem." EU funding is not a certification. NGI-POINTER grant 871528 is a research-and-innovation funding fact. It is worth listing under "provenance." It is not a registrar's mark. Hosted Peergos versus self-hosted DataCubes ------------------------------------------- Peergos's hosted privacy notice has stated that peergos.net uses servers in **Germany**. A **self-hosted** organizational DataCube is a **different processing location**. The customer's Record of Processing, BAA pack, and ISO scope must name *that* location --- the customer's ns1, region, or chosen host --- not peergos.net's Germany, unless the customer actually uses peergos.net. The evaluations still apply to the **protocol and implementation**. Location of processing is an organizational fact on top. What "designed under funding from Cure53 / ROS" is not ------------------------------------------------------ The 2019 Cure53 work and the 2024 ROS work are **evaluations** of a system that was designed by the Peergos authors. They are not a claim that Cure53 or Radically Open Security designed Peergos. The accurate statement is: the storage and replication system was **independently audited twice in Europe**, by Cure53 in Berlin (2019) and by Radically Open Security in Amsterdam (2024), with public reports, and the 2019 work included a cryptographic and design review of the architecture that Verae DataCubes rely on for data at rest.