12. Audit-ready checklist

Use this as a working list. Check an item only when evidence exists (screenshot, log export, signed policy, ticket, receipt). This list is not a certificate. Software having been installed does not tick these boxes.

12.1. A. Scope and honesty

  • Named legal entity and systems in scope (console, Drive, message fabric, IPFS, timestamping link, Iceberg archive)

  • Written sentence in the system description: software is not our HIPAA / SOC 2 / ISO 27001 certificate

  • Data-flow diagram: endpoint → HPKE → DataCube → Peergos/IPFS → receipt → Iceberg

  • PHI / personal data vs ciphertext vs routing metadata, named

  • Peergos evaluation chapter attached, labeled component security evaluation

12.2. B. Data in transit

  • Production algorithm is HPKE (or documented successor), not a lab construction

  • Destinations and subjects documented as visible by design

  • Error paths carry codes and lookup ids, not bodies

  • Public-key directory lists public keys only; private keys mode 0600 or HSM

  • Broker operator named; metadata vs content in the annex

12.3. C. Data at rest

  • Customer holds Peergos / Drive keys; not on storage host

  • Peergos hash verification on write and on read, evidenced

  • Restore test: recover a cube from content-addressed ciphertext without a plaintext tape

  • Dual-hash cube chain; first-hash-wins registry

12.4. D. Timestamping

  • First-registration rule documented and tested (second submit returns original receipt)

  • Organizational node linked to central Verae, or direct sync, named in the diagram

  • Sample bundle: receipt + private metadata + attachment pointer, redacted for the evidence pack

  • Verae receives fingerprints, not objects — stated in the data map

12.5. E. Write-once archive

  • Iceberg (or equivalent) export job exists and has a dated last-run

  • Object-lock / dual-control / separate account — evidence that no single party can delete a committed snapshot

  • Retention schedule written by records/counsel, not by engineering folklore

  • Legal-hold procedure extends retention; ticket example

12.6. F. Access and change

  • Console requires authentication (TOTP or equivalent); Drive login is a separate plane

  • Inspect is k-of-n; author is not an officer; log-before-reveal

  • Joiner / mover / leaver for console users

  • Signed configuration; unsigned rejected; admin-history prev + new + diff

  • HSM or a dated plan to move lab keys to HSM

12.7. G. Contracts (counsel)

  • Written BA / not-a-BA determination for disk, VM, backup, IPFS, Iceberg

  • DPA Article 28 where usernames, logs, or IPs are processed

  • NATS operator: metadata vs content

  • Verae timestamping: fingerprint-only processing described

  • Peergos PDFs attached and labeled “not our Type II / ISO”

12.8. H. Independent examination of this organization

  • SOC 2 Type I/II engagement, or ISO 27001 registrar, or HIPAA risk analysis plus policies — the program actually chosen, not all three as wallpaper

  • Evidence window (Type II / surveillance) if applicable

  • Named internal owner who will sit in the meeting and not claim the software is the certificate