George Lambert
8496ef8338
Some checks are pending
ci / markdown (push) Waiting to run
The cover stays page 1. Numbered chapters now start at What Verae provides. The TOC lists Executive summary at page 2.
234 lines
No EOL
12 KiB
HTML
234 lines
No EOL
12 KiB
HTML
<!DOCTYPE html>
|
||
|
||
<html lang="en" data-content_root="./">
|
||
<head>
|
||
<meta charset="utf-8" />
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
|
||
|
||
<title>10. BAAs, DPAs, and ciphertext without host keys — Making yourself audit-ready with Verae DataCubes</title>
|
||
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
|
||
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
|
||
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
|
||
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
|
||
<script src="_static/documentation_options.js?v=250a654d"></script>
|
||
<script src="_static/doctools.js?v=fd6eb6e6"></script>
|
||
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
|
||
<link rel="icon" href="_static/VeraeFullLogo.png"/>
|
||
<link rel="index" title="Index" href="genindex.html" />
|
||
<link rel="search" title="Search" href="search.html" />
|
||
<link rel="next" title="11. Audit-ready checklist" href="checklist.html" />
|
||
<link rel="prev" title="9. Architecture for an audit interview" href="architecture.html" />
|
||
|
||
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
|
||
|
||
|
||
|
||
|
||
|
||
</head><body>
|
||
<div class="document">
|
||
|
||
<div class="sphinxsidebar" role="navigation" aria-label="Main">
|
||
<div class="sphinxsidebarwrapper">
|
||
<p class="logo"><a href="index.html">
|
||
<img class="logo" src="_static/VeraeFullLogo.png" alt="Logo of Making yourself audit-ready with Verae DataCubes"/>
|
||
</a></p>
|
||
<p class="logo">
|
||
<a href="index.html">
|
||
<img class="logo" src="_static/VeraeFullLogo.png" alt="Logo" />
|
||
|
||
</a>
|
||
</p>
|
||
|
||
|
||
|
||
<p class="blurb">Tools for storage, communications, timestamping, verification, and audit — not a certificate.</p>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<search id="searchbox" style="display: none" role="search">
|
||
<div class="searchformwrapper">
|
||
<form class="search" action="search.html" method="get">
|
||
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" placeholder="Search"/>
|
||
<input type="submit" value="Go" />
|
||
</form>
|
||
</div>
|
||
</search>
|
||
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
|
||
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
|
||
<ul class="current">
|
||
<li class="toctree-l1"><a class="reference internal" href="what-verae-provides.html">1. What Verae provides — and what it does not</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
|
||
<li class="toctree-l1 current"><a class="current reference internal" href="#">10. BAAs, DPAs, and ciphertext without host keys</a><ul>
|
||
<li class="toctree-l2"><a class="reference internal" href="#the-technical-fact">10.1. The technical fact</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#hipaa-business-associate">10.2. HIPAA — Business Associate</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#gdpr-processor-versus-technical-measure">10.3. GDPR — processor versus technical measure</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#nats-operators">10.4. NATS operators</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#verae-as-timestamping-service">10.5. Verae as timestamping service</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#component-assurance-versus-the-organization-s-report">10.6. Component assurance versus the organization’s report</a></li>
|
||
</ul>
|
||
</li>
|
||
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
|
||
</ul>
|
||
|
||
<div class="relations">
|
||
<h3>Related Topics</h3>
|
||
<ul>
|
||
<li><a href="index.html">Documentation overview</a><ul>
|
||
<li>Previous: <a href="architecture.html" title="previous chapter"><span class="section-number">9. </span>Architecture for an audit interview</a></li>
|
||
<li>Next: <a href="checklist.html" title="next chapter"><span class="section-number">11. </span>Audit-ready checklist</a></li>
|
||
</ul></li>
|
||
</ul>
|
||
</div>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="documentwrapper">
|
||
<div class="bodywrapper">
|
||
|
||
|
||
<div class="body" role="main">
|
||
|
||
<section id="baas-dpas-and-ciphertext-without-host-keys">
|
||
<h1><span class="section-number">10. </span>BAAs, DPAs, and ciphertext without host keys<a class="headerlink" href="#baas-dpas-and-ciphertext-without-host-keys" title="Link to this heading">¶</a></h1>
|
||
<p>This chapter is <strong>guidance for an evidence pack</strong>. It is not
|
||
legal advice. Counsel has to sign the actual determination.</p>
|
||
<section id="the-technical-fact">
|
||
<h2><span class="section-number">10.1. </span>The technical fact<a class="headerlink" href="#the-technical-fact" title="Link to this heading">¶</a></h2>
|
||
<p>Data at rest lives in the <strong>encrypted Peergos cryptree</strong>.
|
||
Restore uses <strong>distributed, hash-verified, encrypted IPFS
|
||
blocks</strong>. Hosts and backup media see <strong>opaque blobs</strong> (and
|
||
random CHAMP labels), not filenames, not PHI, not the share
|
||
graph — <strong>if</strong> private keys never leave the client or the
|
||
customer’s HSM.</p>
|
||
<p>That fact is true of the Peergos design and is the design
|
||
Cure53 reviewed in Berlin. It <strong>changes</strong> the Business
|
||
Associate and GDPR-processor conversation. It does <strong>not</strong>
|
||
automatically delete the need for contracts.</p>
|
||
</section>
|
||
<section id="hipaa-business-associate">
|
||
<h2><span class="section-number">10.2. </span>HIPAA — Business Associate<a class="headerlink" href="#hipaa-business-associate" title="Link to this heading">¶</a></h2>
|
||
<p>A Business Associate is a person who <strong>creates, receives,
|
||
maintains, or transmits ePHI</strong> for a covered entity.</p>
|
||
<p>A technical argument the organization can document:</p>
|
||
<ol class="arabic simple">
|
||
<li><p>ePHI is encrypted <strong>before</strong> it leaves the endpoint.</p></li>
|
||
<li><p>The storage node, IPFS, disk, Iceberg archive, and backup
|
||
hold <strong>ciphertext plus hashes</strong>.</p></li>
|
||
<li><p>Private keys <strong>do not</strong> reside on the storage host.
|
||
Hash verification detects substitution.</p></li>
|
||
<li><p>Therefore the host <strong>cannot maintain ePHI in intelligible
|
||
form</strong>.</p></li>
|
||
</ol>
|
||
<p>HHS has distinguished <strong>conduits</strong> and parties that never
|
||
have access to ePHI. Many programs still <strong>sign a BAA</strong>
|
||
whenever a vendor touches infrastructure, because
|
||
misconfiguration, a support export, or a log could later
|
||
expose plaintext. OCR will look at <strong>the organization’s</strong>
|
||
risk analysis, not at Verae’s architecture diagram.</p>
|
||
<p>Practical pack:</p>
|
||
<ul class="simple">
|
||
<li><p>a risk-analysis memo citing cryptree, IPFS hash checks,
|
||
key custody, and the two public Peergos evaluations;</p></li>
|
||
<li><p>a BAA <strong>or</strong> a written determination that a named vendor
|
||
is <strong>not</strong> a BA because they cannot decrypt;</p></li>
|
||
<li><p>a list of every party with disk, VM, backup, IPFS, or
|
||
Iceberg credentials.</p></li>
|
||
</ul>
|
||
</section>
|
||
<section id="gdpr-processor-versus-technical-measure">
|
||
<h2><span class="section-number">10.3. </span>GDPR — processor versus technical measure<a class="headerlink" href="#gdpr-processor-versus-technical-measure" title="Link to this heading">¶</a></h2>
|
||
<p>Encrypted data can still be <strong>personal data</strong> if it is
|
||
reasonably attributable (usernames, IPs, invoice identity).
|
||
GDPR Article 32 lists encryption as a security measure, not
|
||
as an exemption from Article 28.</p>
|
||
<p>Peergos is designed so the <strong>server is an adversary</strong> for
|
||
content and most metadata. EU-based independent pentests
|
||
evaluated that design. Processing location for <strong>self-host</strong>
|
||
is the customer’s region, not peergos.net’s Germany, unless
|
||
the customer uses peergos.net.</p>
|
||
<p>A DPA may still be required with anyone who <strong>processes</strong>
|
||
usernames, logs, or billing. Ciphertext-only storage
|
||
<strong>narrows</strong> the technical annex. It does not always
|
||
eliminate the DPA.</p>
|
||
</section>
|
||
<section id="nats-operators">
|
||
<h2><span class="section-number">10.4. </span>NATS operators<a class="headerlink" href="#nats-operators" title="Link to this heading">¶</a></h2>
|
||
<p>NATS is an untrusted broker. Content is HPKE. Destinations
|
||
and subjects are in the clear. A NATS operator <strong>cannot</strong>
|
||
read bodies without endpoint private keys. They <strong>can</strong> see
|
||
routing metadata. They <strong>can</strong> drop, delay, or copy
|
||
ciphertext. Treat them like a transit provider: whether a
|
||
DPA or BAA is needed depends on whether routing metadata is
|
||
personal data in the relevant jurisdiction.</p>
|
||
</section>
|
||
<section id="verae-as-timestamping-service">
|
||
<h2><span class="section-number">10.5. </span>Verae as timestamping service<a class="headerlink" href="#verae-as-timestamping-service" title="Link to this heading">¶</a></h2>
|
||
<p>If Verae receives <strong>only fingerprints</strong>, Verae’s role for
|
||
<strong>content</strong> is not “stores the records.” Verae’s role is
|
||
“registers hashes and issues receipts.” That is a narrower
|
||
processing. Counsel still has to decide whether the
|
||
fingerprint, plus whatever account data exists (company
|
||
name, billing, operator emails), requires a DPA or a BAA.
|
||
Do not let a sales sentence skip that memo.</p>
|
||
</section>
|
||
<section id="component-assurance-versus-the-organization-s-report">
|
||
<h2><span class="section-number">10.6. </span>Component assurance versus the organization’s report<a class="headerlink" href="#component-assurance-versus-the-organization-s-report" title="Link to this heading">¶</a></h2>
|
||
<p>Attaching Cure53 2019 and ROS 2024 is <strong>vendor / component
|
||
assurance</strong>. It is appropriate. It is <strong>not</strong> the
|
||
organization’s SOC 2, ISO 27001, or HIPAA program. Those
|
||
still require the organization’s scope, Record of
|
||
Processing, key-custody, inspect k-of-n, admin-history,
|
||
instance evidence, restore tests, and the contracts that
|
||
match who can actually see plaintext.</p>
|
||
</section>
|
||
</section>
|
||
|
||
|
||
</div>
|
||
|
||
</div>
|
||
</div>
|
||
<div class="clearer"></div>
|
||
</div>
|
||
<div class="verae-page-footer">
|
||
<strong>Verae Inc</strong>
|
||
· <a href="https://www.verae.com">https://www.verae.com</a>
|
||
· Book a call at <a href="https://www.verae.com">verae.com</a>
|
||
· <a href="https://app.verae.com">app.verae.com</a>
|
||
</div>
|
||
|
||
<div class="footer">
|
||
©2026, Verae Inc.
|
||
|
||
</div>
|
||
|
||
|
||
|
||
|
||
|
||
</body>
|
||
</html> |