peergos-making-yourself-audit-ready-with-verae-datacubes/source/what-verae-provides.rst

What Verae provides --- and what it does not
============================================

The boundary
------------

Verae sells and operates **software infrastructure** and a
**timestamping service**. Customers use that infrastructure to store
objects, to send messages, to register hashes, to verify receipts,
and to produce an audit trail of what their own systems did.

Verae does **not** sell a HIPAA certificate. HIPAA is a United
States **statute** (and implementing regulations), not a product
seal. A covered entity or business associate becomes "HIPAA
compliant" only in the ordinary-language sense that it has performed
a risk analysis, implemented the Security Rule's required and
addressable controls as reasonable and appropriate, executed
Business Associate Agreements where required, trained its workforce,
and can respond to OCR. No software vendor can substitute for that
work.

Verae does **not** sell a SOC 2 report covering the customer's
organization. SOC 2 is an **attestation** by a licensed CPA firm
against the AICPA Trust Services Criteria, for a named entity, over
a named period, with a named system description. The customer's
auditor must still walk the customer's controls.

Verae does **not** sell an ISO 27001 certificate covering the
customer's organization. ISO 27001 is a **management-system**
standard. A registrar certifies that a named organization operates
an Information Security Management System (ISMS) over a named
scope. Installing a DataCube does not create an ISMS.

The tools
---------

Within that boundary, the Verae DataCube Solution is built to make
the **technical** work of those programs less painful. Concretely,
it gives the organization the ability to:

**Store.** Digital objects --- messages, images, documents, logs,
model prompts, model outputs, attachments --- can be written into an
encrypted DataCube. The cube is a customer-controlled container.
Verae is designed so that the **contents stay in the customer's
storage**. What leaves the customer's perimeter for sealing is a
**fingerprint** (a cryptographic hash), not the object.

**Communicate.** Endpoints exchange messages with point-to-point
encryption. The body is unreadable to the router. Destination and
subject remain visible because a network that cannot see a
destination cannot route.

**Timestamp.** The first time a hash is registered, Verae records
that registration against a time and a sequence. Later, anyone with
the receipt and the object (or the object hash) can check that the
object existed, in that exact bit pattern, no later than that time.

**Verify.** Verification does not require trusting Verae's word, the
customer's archive administrator, or a hosting vendor. It requires
recomputing a hash, checking a receipt, and --- for stored objects
--- checking IPFS content identifiers. A regulator can be handed
proof rather than a vendor assurance letter.

**Audit.** Admin history, inspect events, and message-handling
summaries are written so that an examiner can see *that* an action
occurred, *who* authorized it, and *which* object it touched,
without the log itself becoming a second copy of the sensitive
payload.

What the organization must still do
-----------------------------------

Those five verbs --- store, communicate, timestamp, verify, audit
--- are the technical portion. The rest of a certification or
attestation program is organizational:

**Policies.** Acceptable use, encryption, key custody, access
control, retention, legal hold, incident response, vendor
management, change management, and (where HIPAA applies) a
sanctions policy and a named Privacy Officer and Security Officer.

**Procedures.** How a new hire is provisioned, how a leaver is
deprovisioned, how a restore is tested, how a key is rotated, how a
legal hold is placed on a cube, how an inspector is authorized
under k-of-n, how a SOC evidence request is answered.

**Internal controls.** Dual control on inspect. Separation of the
author of a change from the officers who approve it. Signed
configuration so an unsigned file is rejected. Log-before-reveal so
an inspect cannot happen in the dark. Hash-registry "first write
wins" so a later rewrite cannot pretend to be the original.

**Independent examination.** A CPA firm (SOC 2), a registrar
(ISO 27001), OCR or a HIPAA assessor, FINRA or SEC examination
staff, or an internal audit function that is actually independent.
They will ask for evidence that the controls ran during the period,
not that a vendor has a nice architecture diagram.

Why the distinction matters in an exam
--------------------------------------

Examiners are trained to notice category errors. If a firm says
"we are SOC 2 because our storage vendor was pentested in Berlin,"
the next hour of the meeting is spent unwinding that claim. If a
firm says "we use a component that was independently evaluated in
the EU; here is the public report, labeled as a component
evaluation; here is *our* system description, *our* key-custody
procedure, *our* restore test from last quarter, and *our* Type II
report," the meeting can proceed.

This chapter exists so that nobody using this briefing makes the
first speech. Verae provides tools, background, and software
infrastructure. The organization provides the program. The auditor
provides the opinion. Those three roles do not collapse into one
product SKU.