George Lambert
da60402e88
Some checks are pending
ci / markdown (push) Waiting to run
source/ is the Sphinx tree. Companion PDF hrefs are relative, not Markdown.
181 lines
No EOL
8.8 KiB
HTML
181 lines
No EOL
8.8 KiB
HTML
<!DOCTYPE html>
|
||
|
||
<html lang="en" data-content_root="./">
|
||
<head>
|
||
<meta charset="utf-8" />
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
|
||
|
||
<title>BAAs and DPAs when ciphertext has no host keys — Making yourself audit-ready with Verae DataCubes</title>
|
||
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
|
||
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
|
||
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=27fed22d" />
|
||
<script src="_static/documentation_options.js?v=5929fcd5"></script>
|
||
<script src="_static/doctools.js?v=fd6eb6e6"></script>
|
||
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
|
||
<link rel="index" title="Index" href="genindex.html" />
|
||
<link rel="search" title="Search" href="search.html" />
|
||
<link rel="next" title="Audit-ready checklist" href="checklist.html" />
|
||
<link rel="prev" title="Architecture (audit interview)" href="architecture.html" />
|
||
|
||
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
|
||
|
||
|
||
|
||
|
||
|
||
</head><body>
|
||
|
||
|
||
<div class="document">
|
||
<div class="documentwrapper">
|
||
<div class="bodywrapper">
|
||
|
||
|
||
<div class="body" role="main">
|
||
|
||
<section id="baas-and-dpas-when-ciphertext-has-no-host-keys">
|
||
<h1>BAAs and DPAs when ciphertext has no host keys<a class="headerlink" href="#baas-and-dpas-when-ciphertext-has-no-host-keys" title="Link to this heading">¶</a></h1>
|
||
<p>This is <strong>guidance for an evidence pack</strong>, not legal advice.</p>
|
||
<section id="the-operator-statement">
|
||
<h2>The operator statement<a class="headerlink" href="#the-operator-statement" title="Link to this heading">¶</a></h2>
|
||
<p>Data at rest lives in the <strong>encrypted Peergos cryptree</strong>. Restore uses
|
||
<strong>distributed, hash-verified, encrypted IPFS blocks</strong>. Hosts and backup
|
||
media see <strong>opaque blobs</strong> (and random CHAMP labels), not filenames, not
|
||
PHI, not social graph — if keys never leave the client / customer HSM.</p>
|
||
<p>That is <strong>true of the Peergos design</strong> (see <a class="reference internal" href="verification.html"><span class="doc">Peergos verification (what was actually audited)</span></a>).
|
||
It <strong>changes the BAA/DPA conversation</strong>. It does <strong>not</strong> auto-delete the
|
||
need for contracts.</p>
|
||
</section>
|
||
<section id="hipaa-us-business-associate">
|
||
<h2>HIPAA (US) — Business Associate<a class="headerlink" href="#hipaa-us-business-associate" title="Link to this heading">¶</a></h2>
|
||
<p>A Business Associate is a person who <strong>creates, receives, maintains, or
|
||
transmits ePHI</strong> for a covered entity.</p>
|
||
<p><strong>Technical argument you can make (and should document):</strong></p>
|
||
<ol class="arabic simple">
|
||
<li><p>ePHI is encrypted <strong>before</strong> it leaves the endpoint (Peergos client /
|
||
DataCube writer).</p></li>
|
||
<li><p>The storage node, IPFS, disk, and backup hold <strong>ciphertext + hashes</strong>.</p></li>
|
||
<li><p>Private keys <strong>do not</strong> reside on the storage host (customer HSM /
|
||
client). Hash verification detects tampering.</p></li>
|
||
<li><p>Therefore the host <strong>cannot maintain ePHI in intelligible form</strong>.</p></li>
|
||
</ol>
|
||
<p>HHS distinguishes <strong>conduits</strong> and parties that never have access to
|
||
ePHI. Many programs still <strong>sign a BAA</strong> when a vendor touches
|
||
infrastructure, because misconfiguration, support exports, or logs could
|
||
later expose plaintext. OCR looks at <strong>your</strong> risk analysis.</p>
|
||
<p><strong>Practical pack:</strong> risk analysis memo citing cryptree + IPFS hash checks
|
||
+ key custody; BAA <strong>or</strong> written determination that the vendor is
|
||
<strong>not</strong> a BA because they cannot decrypt; list every party with
|
||
disk/backup (ns1, IPFS cluster, offsite replica).</p>
|
||
</section>
|
||
<section id="gdpr-eu-uk-processor-vs-technical-measure">
|
||
<h2>GDPR (EU/UK) — processor vs technical measure<a class="headerlink" href="#gdpr-eu-uk-processor-vs-technical-measure" title="Link to this heading">¶</a></h2>
|
||
<p>Encrypted data can still be <strong>personal data</strong> if it is reasonably
|
||
attributable (usernames, IPs, invoice identity). GDPR <strong>Art. 32</strong> lists
|
||
encryption as a security measure.</p>
|
||
<p>Peergos is designed so the <strong>server is an adversary</strong> for content and
|
||
most metadata. EU-based <strong>independent pentests</strong> (Cure53 DE, ROS NL)
|
||
evaluated that design. Processing location for <strong>self-host</strong> is <em>your</em>
|
||
ns1 / customer region, not peergos.net’s Germany hosting, unless you use
|
||
peergos.net.</p>
|
||
<p>You may still need a <strong>DPA (Art. 28)</strong> with anyone who <strong>processes</strong>
|
||
personal data (usernames, logs, billing). Ciphertext-only storage
|
||
<strong>narrows</strong> the DPA’s technical annex.</p>
|
||
</section>
|
||
<section id="nats-operators">
|
||
<h2>NATS operators<a class="headerlink" href="#nats-operators" title="Link to this heading">¶</a></h2>
|
||
<p>NATS is an <strong>untrusted broker</strong>. Content is HPKE; destinations and
|
||
subjects are in the clear. A NATS operator <strong>cannot</strong> read bodies without
|
||
endpoint private keys; <strong>can</strong> see routing metadata; <strong>can</strong> drop/delay
|
||
copy <strong>ciphertext</strong>. Treat like a transit provider: DPA/BAA depends on
|
||
whether routing metadata is personal data in your jurisdiction.</p>
|
||
</section>
|
||
<section id="what-making-yourself-audit-ready-means">
|
||
<h2>What “making yourself audit-ready” means<a class="headerlink" href="#what-making-yourself-audit-ready-means" title="Link to this heading">¶</a></h2>
|
||
<p>You are <strong>not</strong> buying Peergos’s Cure53/ROS reports as <em>your</em> SOC 2.
|
||
You are <strong>reusing</strong> those public evaluations as <strong>vendor/component
|
||
assurance</strong>, then adding your scope, RoPA, key-custody, inspect k-of-n,
|
||
admin-history, instance evidence, and contracts that match who can
|
||
actually see plaintext.</p>
|
||
</section>
|
||
</section>
|
||
|
||
|
||
</div>
|
||
|
||
</div>
|
||
</div>
|
||
<div class="sphinxsidebar" role="navigation" aria-label="Main">
|
||
<div class="sphinxsidebarwrapper">
|
||
<h1 class="logo"><a href="index.html">Making yourself audit-ready with Verae DataCubes</a></h1>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<search id="searchbox" style="display: none" role="search">
|
||
<div class="searchformwrapper">
|
||
<form class="search" action="search.html" method="get">
|
||
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" placeholder="Search"/>
|
||
<input type="submit" value="Go" />
|
||
</form>
|
||
</div>
|
||
</search>
|
||
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
|
||
<ul class="current">
|
||
<li class="toctree-l1"><a class="reference internal" href="verification.html">Peergos verification (what was actually audited)</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="architecture.html">Architecture (audit interview)</a></li>
|
||
<li class="toctree-l1 current"><a class="current reference internal" href="#">BAAs and DPAs when ciphertext has no host keys</a><ul>
|
||
<li class="toctree-l2"><a class="reference internal" href="#the-operator-statement">The operator statement</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#hipaa-us-business-associate">HIPAA (US) — Business Associate</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#gdpr-eu-uk-processor-vs-technical-measure">GDPR (EU/UK) — processor vs technical measure</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#nats-operators">NATS operators</a></li>
|
||
<li class="toctree-l2"><a class="reference internal" href="#what-making-yourself-audit-ready-means">What “making yourself audit-ready” means</a></li>
|
||
</ul>
|
||
</li>
|
||
<li class="toctree-l1"><a class="reference internal" href="checklist.html">Audit-ready checklist</a></li>
|
||
<li class="toctree-l1"><a class="reference internal" href="howto.html">How to use this pack</a></li>
|
||
</ul>
|
||
|
||
<div class="relations">
|
||
<h3>Related Topics</h3>
|
||
<ul>
|
||
<li><a href="index.html">Documentation overview</a><ul>
|
||
<li>Previous: <a href="architecture.html" title="previous chapter">Architecture (audit interview)</a></li>
|
||
<li>Next: <a href="checklist.html" title="next chapter">Audit-ready checklist</a></li>
|
||
</ul></li>
|
||
</ul>
|
||
</div>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
</div>
|
||
</div>
|
||
<div class="clearer"></div>
|
||
</div>
|
||
<div class="footer">
|
||
©2026, Verae.
|
||
|
||
|
|
||
Powered by <a href="https://www.sphinx-doc.org/">Sphinx 9.1.0</a>
|
||
& <a href="https://alabaster.readthedocs.io">Alabaster 1.0.0</a>
|
||
|
||
|
|
||
<a href="_sources/baa-dpa.rst.txt"
|
||
rel="nofollow">Page source</a>
|
||
</div>
|
||
|
||
|
||
|
||
|
||
</body>
|
||
</html> |