peergos-making-yourself-audit-ready-with-verae-datacubes/source/peergos-eu-evaluations.rst

Peergos security evaluations in Europe
======================================

What was evaluated
------------------

The offline storage and replication system used with Verae
DataCubes is **Peergos**: an encrypted, peer-to-peer filesystem
whose blocks live on IPFS. Peergos was designed as a
trust-minimized store --- the server is treated as an adversary
for content and for most metadata --- and that design was
submitted to independent European security firms **twice**.

Those engagements are **security evaluations of the Peergos
protocol and implementation**. They are pentests, source-code
audits, and (in 2019) a cryptographic and design review. They
are **not**:

* a HIPAA certification of Peergos, Verae, or any customer;
* a SOC 2 Type I or Type II report;
* an ISO 27001 certificate of an ISMS;
* a government "certified filesystem" designation.

Both firms are **EU-based**. Both full reports are **public**.
That combination --- independent, European, public, repeat ---
is unusual and is worth attaching to a vendor-assurance file,
**labeled correctly**.

2019 --- Cure53, Berlin, Germany
--------------------------------

* **Firm:** Cure53
* **Location:** Berlin, Germany
* **When:** May--June 2019
* **Scope:** pentest, source-code audit, and
  **crypto / design review**
* **Outcome:** no fundamental architectural or cryptographic
  problems were identified. Issues that were identified were
  fixed. Cure53 stated that the platform **passed this
  evaluation**.

A crypto/design review is a stronger statement than a
black-box pentest of a web form. It is an expert reading of
whether the cryptree, the chunk encryption, the identity
model, and the threat model hang together. "Passed" in
Cure53's language is not an ISO mark. It is a specialist
firm saying: we looked at the cryptography and the
architecture, we did not find a fatal flaw, and the issues we
did find were addressed.

Primary sources (public):

* https://peergos.org/posts/security-audit
* https://cure53.de/pentest-report_peergos.pdf
* https://github.com/Peergos/Peergos/tree/master/audits

2024 --- Radically Open Security B.V., Amsterdam
------------------------------------------------

* **Firm:** Radically Open Security B.V.
* **Location:** Amsterdam, Netherlands
* **When:** September--November 2024
* **Scope:** crystal-box pentest plus code audit of the
  Peergos **web UI**
* **Funding context:** the 2024 audit post states support
  from **NLnet** (Netherlands) and refers to European Union
  Horizon 2020 **NGI-POINTER**, grant **871528**.
* **Outcome:** **0** findings rated extreme, high, or
  elevated; **2** moderate; **6** low. Peergos states that
  all were fixed. There was **no data exposure** and **no
  integrity compromise**. The issues were described as
  mostly UI crashes.

A crystal-box (clear-box) engagement means the testers had
source. A web-UI scope is narrower than the 2019
crypto/design review: it is evidence about the interface
that humans actually click, which is where many "encrypted
backend" products fail in practice. Zero high-severity
findings, no data exposure, no integrity compromise, and a
public report are the facts. They are good facts. They are
still not a customer's Type II.

Primary sources (public):

* https://peergos.org/posts/security-audit-2024
* https://github.com/Peergos/Peergos/tree/master/audits

How to present these reports to an auditor
------------------------------------------

Correct:

   "Our at-rest layer is Peergos. Peergos was independently
   evaluated in Berlin in 2019 (crypto and design) and in
   Amsterdam in 2024 (web UI, crystal box). Both reports are
   public. We attach them as **component security
   evaluations**. They are not our SOC 2, not our ISO 27001,
   and not a HIPAA certification. Our own controls, our own
   period of examination, and our own auditor are separate."

Incorrect:

   "We are HIPAA certified because Peergos was audited in
   Europe."

   "Peergos is ISO 27001."

   "The EU certified this filesystem."

EU funding is not a certification. NGI-POINTER grant 871528
is a research-and-innovation funding fact. It is worth
listing under "provenance." It is not a registrar's mark.

Hosted Peergos versus self-hosted DataCubes
-------------------------------------------

Peergos's hosted privacy notice has stated that peergos.net
uses servers in **Germany**. A **self-hosted** organizational
DataCube is a **different processing location**. The
customer's Record of Processing, BAA pack, and ISO scope
must name *that* location --- the customer's ns1, region, or
chosen host --- not peergos.net's Germany, unless the
customer actually uses peergos.net.

The evaluations still apply to the **protocol and
implementation**. Location of processing is an
organizational fact on top.

What "designed under funding from Cure53 / ROS" is not
------------------------------------------------------

The 2019 Cure53 work and the 2024 ROS work are **evaluations**
of a system that was designed by the Peergos authors. They
are not a claim that Cure53 or Radically Open Security
designed Peergos. The accurate statement is: the storage and
replication system was **independently audited twice in
Europe**, by Cure53 in Berlin (2019) and by Radically Open
Security in Amsterdam (2024), with public reports, and the
2019 work included a cryptographic and design review of the
architecture that Verae DataCubes rely on for data at rest.