marchon/peergos-making-yourself-audit-ready-with-verae-datacubes
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
peergos-making-yourself-aud.../build/html/index.html
George Lambert da60402e88
Some checks are pending
ci / markdown (push) Waiting to run
Details
Sphinx HTML and 17-page LaTeX PDF for the audit-ready pack 
source/ is the Sphinx tree. Companion PDF hrefs are relative, not Markdown.
2026-09-15 23:59:54 -04:00

173 lines
No EOL
9.2 KiB
HTML
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

<!DOCTYPE html>
<html lang="en" data-content_root="./">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Making yourself audit-ready with Verae DataCubes &#8212; Making yourself audit-ready with Verae DataCubes</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
<link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
<link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=27fed22d" />
<script src="_static/documentation_options.js?v=5929fcd5"></script>
<script src="_static/doctools.js?v=fd6eb6e6"></script>
<script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="next" title="Peergos verification (what was actually audited)" href="verification.html" />
<link rel="stylesheet" href="_static/custom.css" type="text/css" />
</head><body>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<section id="making-yourself-audit-ready-with-verae-datacubes">
<h1>Making yourself audit-ready with Verae DataCubes<a class="headerlink" href="#making-yourself-audit-ready-with-verae-datacubes" title="Link to this heading"></a></h1>
<p>How to <strong>prepare an organization</strong> for HIPAA-aligned, SOC 2, or ISO 27001
work using Verae DataCubes on <strong>Peergos</strong> (encrypted cryptree + hashed
IPFS) and HPKE on an <strong>untrusted NATS</strong> broker.</p>
<p><strong>This document is not a HIPAA, SOC 2, or ISO certificate.</strong>
Peergos’s public pentests are <strong>not</strong> your Type II or ISO registrar
certificate. They are <strong>component security evaluations</strong> you can attach.</p>
<div class="toctree-wrapper compound">
<ul>
<li class="toctree-l1"><a class="reference internal" href="verification.html">Peergos verification (what was actually audited)</a><ul>
<li class="toctree-l2"><a class="reference internal" href="verification.html#claim-to-check">Claim to check</a></li>
<li class="toctree-l2"><a class="reference internal" href="verification.html#independent-security-audits-europe">Independent security audits (Europe)</a></li>
<li class="toctree-l2"><a class="reference internal" href="verification.html#eu-funding-nlnet">EU funding / NLnet</a></li>
<li class="toctree-l2"><a class="reference internal" href="verification.html#hosted-instance-location">Hosted instance location</a></li>
<li class="toctree-l2"><a class="reference internal" href="verification.html#encrypted-filesystem-hashed-ipfs-design">Encrypted filesystem + hashed IPFS (design)</a></li>
<li class="toctree-l2"><a class="reference internal" href="verification.html#not-verified-do-not-claim">Not verified / do not claim</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">Architecture (audit interview)</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">BAAs and DPAs when ciphertext has no host keys</a><ul>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#the-operator-statement">The operator statement</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#hipaa-us-business-associate">HIPAA (US) — Business Associate</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#gdpr-eu-uk-processor-vs-technical-measure">GDPR (EU/UK) — processor vs technical measure</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#nats-operators">NATS operators</a></li>
<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#what-making-yourself-audit-ready-means">What “making yourself audit-ready” means</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">Audit-ready checklist</a><ul>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#a-scope-and-data-map">A. Scope and data map</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#b-keys-and-encryption">B. Keys and encryption</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#c-access">C. Access</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#d-integrity-and-backup">D. Integrity and backup</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#e-logging">E. Logging</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#f-contracts-counsel">F. Contracts (counsel)</a></li>
<li class="toctree-l2"><a class="reference internal" href="checklist.html#g-independent-audit-of-you">G. Independent audit of <em>you</em></a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">How to use this pack</a></li>
</ul>
</div>
<section id="what-we-verified-about-peergos-eu">
<h2>What we verified about Peergos (EU)<a class="headerlink" href="#what-we-verified-about-peergos-eu" title="Link to this heading"></a></h2>
<p>See the full sourced table in <a class="reference internal" href="verification.html"><span class="doc">Peergos verification (what was actually audited)</span></a>.</p>
<ul class="simple">
<li><p>Encrypted client-side filesystem (cryptree); keys not on the storage
server — <strong>yes</strong> (Peergos book + Cure53 design review).</p></li>
<li><p>IPFS blocks content-addressed; Peergos verifies hashes — <strong>yes</strong>.</p></li>
<li><p>Independent <strong>EU</strong> security audits, reports published — <strong>yes, two:</strong>
Cure53 Berlin (2019); Radically Open Security Amsterdam (2024).</p></li>
<li><p>“Peergos is HIPAA/SOC 2/ISO certified” — <strong>no.</strong> Those audits are
pentest/code/design reviews, not management-system certificates.</p></li>
</ul>
<p>Peergos <strong>was designed as a trust-minimized encrypted filesystem</strong>,
<strong>evaluated in Europe</strong> by two specialist firms, with <strong>public reports</strong>.
That supports the <strong>at-rest / backup</strong> story. It does <strong>not</strong> finish
<em>your</em> audit.</p>
<p>Live technical surfaces:</p>
<ul class="simple">
<li><p><a class="reference external" href="https://pfc.georgelambert.org/health">https://pfc.georgelambert.org/health</a></p></li>
<li><p><a class="reference external" href="https://pfc.georgelambert.org/v1/npe/keys">https://pfc.georgelambert.org/v1/npe/keys</a></p></li>
<li><p><a class="reference external" href="https://docs.pfc.georgelambert.org/controls.html">https://docs.pfc.georgelambert.org/controls.html</a></p></li>
<li><p><a class="reference external" href="https://git.georgelambert.org/marchon/peergos-making-yourself-audit-ready-with-verae-datacubes">https://git.georgelambert.org/marchon/peergos-making-yourself-audit-ready-with-verae-datacubes</a></p></li>
</ul>
<p>Companion system docs (HTML): <a class="reference external" href="https://docs.pfc.georgelambert.org/">https://docs.pfc.georgelambert.org/</a></p>
</section>
</section>
</div>
</div>
</div>
<div class="sphinxsidebar" role="navigation" aria-label="Main">
<div class="sphinxsidebarwrapper">
<h1 class="logo"><a href="#">Making yourself audit-ready with Verae DataCubes</a></h1>
<search id="searchbox" style="display: none" role="search">
<div class="searchformwrapper">
<form class="search" action="search.html" method="get">
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" placeholder="Search"/>
<input type="submit" value="Go" />
</form>
</div>
</search>
<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
<ul>
<li class="toctree-l1"><a class="reference internal" href="verification.html">Peergos verification (what was actually audited)</a></li>
<li class="toctree-l1"><a class="reference internal" href="architecture.html">Architecture (audit interview)</a></li>
<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">BAAs and DPAs when ciphertext has no host keys</a></li>
<li class="toctree-l1"><a class="reference internal" href="checklist.html">Audit-ready checklist</a></li>
<li class="toctree-l1"><a class="reference internal" href="howto.html">How to use this pack</a></li>
</ul>
<div class="relations">
<h3>Related Topics</h3>
<ul>
<li><a href="#">Documentation overview</a><ul>
<li>Next: <a href="verification.html" title="next chapter">Peergos verification (what was actually audited)</a></li>
</ul></li>
</ul>
</div>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="footer">
&#169;2026, Verae.
|
Powered by <a href="https://www.sphinx-doc.org/">Sphinx 9.1.0</a>
&amp; <a href="https://alabaster.readthedocs.io">Alabaster 1.0.0</a>
|
<a href="_sources/index.rst.txt"
rel="nofollow">Page source</a>
</div>
</body>
</html>
Reference in a new issue View git blame Copy permalink