George Lambert
8496ef8338
Some checks are pending
ci / markdown (push) Waiting to run
The cover stays page 1. Numbered chapters now start at What Verae provides. The TOC lists Executive summary at page 2.
237 lines
No EOL
12 KiB
HTML
237 lines
No EOL
12 KiB
HTML
<!DOCTYPE html>
|
||
|
||
<html lang="en" data-content_root="./">
|
||
<head>
|
||
<meta charset="utf-8" />
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
|
||
|
||
<title>1. What Verae provides — and what it does not — Making yourself audit-ready with Verae DataCubes</title>
|
||
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
|
||
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
|
||
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=2a97f0c7" />
|
||
<link rel="stylesheet" type="text/css" href="_static/verae.css?v=2d7b7068" />
|
||
<script src="_static/documentation_options.js?v=250a654d"></script>
|
||
<script src="_static/doctools.js?v=fd6eb6e6"></script>
|
||
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
|
||
<link rel="icon" href="_static/VeraeFullLogo.png"/>
|
||
<link rel="index" title="Index" href="genindex.html" />
|
||
<link rel="search" title="Search" href="search.html" />
|
||
<link rel="next" title="2. The Verae DataCube Server Solution" href="datacube-server.html" />
|
||
<link rel="prev" title="Making yourself audit-ready with Verae DataCubes" href="index.html" />
|
||
|
||
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
|
||
|
||
|
||
|
||
|
||
|
||
</head><body>
|
||
<div class="document">
|
||
|
||
<div class="sphinxsidebar" role="navigation" aria-label="Main">
|
||
<div class="sphinxsidebarwrapper">
|
||
<p class="logo"><a href="index.html">
|
||
<img class="logo" src="_static/VeraeFullLogo.png" alt="Logo of Making yourself audit-ready with Verae DataCubes"/>
|
||
</a></p>
|
||
<p class="logo">
|
||
<a href="index.html">
|
||
<img class="logo" src="_static/VeraeFullLogo.png" alt="Logo" />
|
||
|
||
</a>
|
||
</p>
|
||
|
||
|
||
|
||
<p class="blurb">Tools for storage, communications, timestamping, verification, and audit — not a certificate.</p>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<search id="searchbox" style="display: none" role="search">
|
||
<div class="searchformwrapper">
|
||
<form class="search" action="search.html" method="get">
|
||
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" placeholder="Search"/>
|
||
<input type="submit" value="Go" />
|
||
</form>
|
||
</div>
|
||
</search>
|
||
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
|
||
<p class="caption" role="heading"><span class="caption-text">Contents</span></p>
|
||
<ul class="current">
|
||
<li class="toctree-l1 current"><a class="current reference internal" href="#">1. What Verae provides — and what it does not</a><ul>
|
||
<li class="toctree-l2"><a class="reference internal" href="#the-boundary">1.1. The boundary</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#the-tools">1.2. The tools</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#what-the-organization-must-still-do">1.3. What the organization must still do</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#why-the-distinction-matters-in-an-exam">1.4. Why the distinction matters in an exam</a></li>
|
||
</ul>
|
||
</li>
|
||
<li class="toctree-l1"><a class="reference internal" href="datacube-server.html">2. The Verae DataCube Server Solution</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="data-in-transit.html">3. Secure communications — data in transit</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="data-at-rest.html">4. Encryption at rest — IPFS blocks and Peergos</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="timestamped-receipts.html">5. Global timestamped receipts</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="peergos-eu-evaluations.html">6. Peergos security evaluations in Europe</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="global-timestamping.html">7. Verae global timestamping — a cross-blockchain receipt</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="iceberg-archive.html">8. Write-once Iceberg archive</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="architecture.html">9. Architecture for an audit interview</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">10. BAAs, DPAs, and ciphertext without host keys</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="checklist.html">11. Audit-ready checklist</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="howto.html">12. How to use this briefing</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="bio-james-garfinkel.html">13. James H. Garfinkel</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="bio-stuart-haber.html">14. Stuart Haber</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="bio-george-lambert.html">15. George Lambert</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="contact.html">16. Verae Inc — contact</a></li>
|
||
</ul>
|
||
|
||
<div class="relations">
|
||
<h3>Related Topics</h3>
|
||
<ul>
|
||
<li><a href="index.html">Documentation overview</a><ul>
|
||
<li>Previous: <a href="index.html" title="previous chapter">Making yourself audit-ready with Verae DataCubes</a></li>
|
||
<li>Next: <a href="datacube-server.html" title="next chapter"><span class="section-number">2. </span>The Verae DataCube Server Solution</a></li>
|
||
</ul></li>
|
||
</ul>
|
||
</div>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="documentwrapper">
|
||
<div class="bodywrapper">
|
||
|
||
|
||
<div class="body" role="main">
|
||
|
||
<section id="what-verae-provides-and-what-it-does-not">
|
||
<h1><span class="section-number">1. </span>What Verae provides — and what it does not<a class="headerlink" href="#what-verae-provides-and-what-it-does-not" title="Link to this heading">¶</a></h1>
|
||
<section id="the-boundary">
|
||
<h2><span class="section-number">1.1. </span>The boundary<a class="headerlink" href="#the-boundary" title="Link to this heading">¶</a></h2>
|
||
<p>Verae sells and operates <strong>software infrastructure</strong> and a
|
||
<strong>timestamping service</strong>. Customers use that infrastructure to store
|
||
objects, to send messages, to register hashes, to verify receipts,
|
||
and to produce an audit trail of what their own systems did.</p>
|
||
<p>Verae does <strong>not</strong> sell a HIPAA certificate. HIPAA is a United
|
||
States <strong>statute</strong> (and implementing regulations), not a product
|
||
seal. A covered entity or business associate becomes “HIPAA
|
||
compliant” only in the ordinary-language sense that it has performed
|
||
a risk analysis, implemented the Security Rule’s required and
|
||
addressable controls as reasonable and appropriate, executed
|
||
Business Associate Agreements where required, trained its workforce,
|
||
and can respond to OCR. No software vendor can substitute for that
|
||
work.</p>
|
||
<p>Verae does <strong>not</strong> sell a SOC 2 report covering the customer’s
|
||
organization. SOC 2 is an <strong>attestation</strong> by a licensed CPA firm
|
||
against the AICPA Trust Services Criteria, for a named entity, over
|
||
a named period, with a named system description. The customer’s
|
||
auditor must still walk the customer’s controls.</p>
|
||
<p>Verae does <strong>not</strong> sell an ISO 27001 certificate covering the
|
||
customer’s organization. ISO 27001 is a <strong>management-system</strong>
|
||
standard. A registrar certifies that a named organization operates
|
||
an Information Security Management System (ISMS) over a named
|
||
scope. Installing a DataCube does not create an ISMS.</p>
|
||
</section>
|
||
<section id="the-tools">
|
||
<h2><span class="section-number">1.2. </span>The tools<a class="headerlink" href="#the-tools" title="Link to this heading">¶</a></h2>
|
||
<p>Within that boundary, the Verae DataCube Solution is built to make
|
||
the <strong>technical</strong> work of those programs less painful. Concretely,
|
||
it gives the organization the ability to:</p>
|
||
<p><strong>Store.</strong> Digital objects — messages, images, documents, logs,
|
||
model prompts, model outputs, attachments — can be written into an
|
||
encrypted DataCube. The cube is a customer-controlled container.
|
||
Verae is designed so that the <strong>contents stay in the customer’s
|
||
storage</strong>. What leaves the customer’s perimeter for sealing is a
|
||
<strong>fingerprint</strong> (a cryptographic hash), not the object.</p>
|
||
<p><strong>Communicate.</strong> Endpoints exchange messages with point-to-point
|
||
encryption. The body is unreadable to the router. Destination and
|
||
subject remain visible because a network that cannot see a
|
||
destination cannot route.</p>
|
||
<p><strong>Timestamp.</strong> The first time a hash is registered, Verae records
|
||
that registration against a time and a sequence. Later, anyone with
|
||
the receipt and the object (or the object hash) can check that the
|
||
object existed, in that exact bit pattern, no later than that time.</p>
|
||
<p><strong>Verify.</strong> Verification does not require trusting Verae’s word, the
|
||
customer’s archive administrator, or a hosting vendor. It requires
|
||
recomputing a hash, checking a receipt, and — for stored objects
|
||
— checking IPFS content identifiers. A regulator can be handed
|
||
proof rather than a vendor assurance letter.</p>
|
||
<p><strong>Audit.</strong> Admin history, inspect events, and message-handling
|
||
summaries are written so that an examiner can see <em>that</em> an action
|
||
occurred, <em>who</em> authorized it, and <em>which</em> object it touched,
|
||
without the log itself becoming a second copy of the sensitive
|
||
payload.</p>
|
||
</section>
|
||
<section id="what-the-organization-must-still-do">
|
||
<h2><span class="section-number">1.3. </span>What the organization must still do<a class="headerlink" href="#what-the-organization-must-still-do" title="Link to this heading">¶</a></h2>
|
||
<p>Those five verbs — store, communicate, timestamp, verify, audit
|
||
— are the technical portion. The rest of a certification or
|
||
attestation program is organizational:</p>
|
||
<p><strong>Policies.</strong> Acceptable use, encryption, key custody, access
|
||
control, retention, legal hold, incident response, vendor
|
||
management, change management, and (where HIPAA applies) a
|
||
sanctions policy and a named Privacy Officer and Security Officer.</p>
|
||
<p><strong>Procedures.</strong> How a new hire is provisioned, how a leaver is
|
||
deprovisioned, how a restore is tested, how a key is rotated, how a
|
||
legal hold is placed on a cube, how an inspector is authorized
|
||
under k-of-n, how a SOC evidence request is answered.</p>
|
||
<p><strong>Internal controls.</strong> Dual control on inspect. Separation of the
|
||
author of a change from the officers who approve it. Signed
|
||
configuration so an unsigned file is rejected. Log-before-reveal so
|
||
an inspect cannot happen in the dark. Hash-registry “first write
|
||
wins” so a later rewrite cannot pretend to be the original.</p>
|
||
<p><strong>Independent examination.</strong> A CPA firm (SOC 2), a registrar
|
||
(ISO 27001), OCR or a HIPAA assessor, FINRA or SEC examination
|
||
staff, or an internal audit function that is actually independent.
|
||
They will ask for evidence that the controls ran during the period,
|
||
not that a vendor has a nice architecture diagram.</p>
|
||
</section>
|
||
<section id="why-the-distinction-matters-in-an-exam">
|
||
<h2><span class="section-number">1.4. </span>Why the distinction matters in an exam<a class="headerlink" href="#why-the-distinction-matters-in-an-exam" title="Link to this heading">¶</a></h2>
|
||
<p>Examiners are trained to notice category errors. If a firm says
|
||
“we are SOC 2 because our storage vendor was pentested in Berlin,”
|
||
the next hour of the meeting is spent unwinding that claim. If a
|
||
firm says “we use a component that was independently evaluated in
|
||
the EU; here is the public report, labeled as a component
|
||
evaluation; here is <em>our</em> system description, <em>our</em> key-custody
|
||
procedure, <em>our</em> restore test from last quarter, and <em>our</em> Type II
|
||
report,” the meeting can proceed.</p>
|
||
<p>This chapter exists so that nobody using this briefing makes the
|
||
first speech. Verae provides tools, background, and software
|
||
infrastructure. The organization provides the program. The auditor
|
||
provides the opinion. Those three roles do not collapse into one
|
||
product SKU.</p>
|
||
</section>
|
||
</section>
|
||
|
||
|
||
</div>
|
||
|
||
</div>
|
||
</div>
|
||
<div class="clearer"></div>
|
||
</div>
|
||
<div class="verae-page-footer">
|
||
<strong>Verae Inc</strong>
|
||
· <a href="https://www.verae.com">https://www.verae.com</a>
|
||
· Book a call at <a href="https://www.verae.com">verae.com</a>
|
||
· <a href="https://app.verae.com">app.verae.com</a>
|
||
</div>
|
||
|
||
<div class="footer">
|
||
©2026, Verae Inc.
|
||
|
||
</div>
|
||
|
||
|
||
|
||
|
||
|
||
</body>
|
||
</html> |