Technical controls (not a certificate)

This document maps implemented technical controls to common HIPAA / SOC 2 / ISO 27001 themes. It is not a HIPAA, SOC 2, or ISO certificate and must not be presented as one.

NATS is the untrusted broker. Production end-to-end is NPE / HPKE. Passthrough means destination (and subject) may be in the clear so routers work; the body is ciphertext. Encrypted processing is used on every NATS hop we control so a compromised broker cannot read PHI.

Access control

  • PFC_REQUIRE_AUTH=1 on the console. TOTP for hipaa cubes.

  • Console login is a separate identity plane from Peergos Drive.

  • Inspect is k-of-n officer share names (not Google accounts).

  • Author cannot be an inspect officer.

Cryptography

  • Production: NPE HPKE (ChaCha20-Poly1305) via npe send; fail-closed (never falls back to lab-xor when crypto.mode=npe or PFC_REQUIRE_NPE=1).

  • Lab bus: pfc-lab-xor with host PSK (PFC_NATS_KEY). PFC_FORBID_PLAIN=1 refuses alg=plain.

  • Signed Ed25519 config wrapper; unsigned files rejected.

  • Dual hash (SHA-256 + BLAKE2b/BLAKE3) on cube objects.

Audit and logging

  • Log-before-reveal on inspect.

  • Admin-history cube: previous file, new file, unified diff, actor, hashes.

  • verae.sm.log.summary: codes + lookup_id + dest class — never ciphertext or recipient payload.

  • Network Error Bundle: ct_sender (sender-only) + ct_system (ops).

Key custody

See the Custody chapter in this PDF. Lab PEMs are 0600 on the host. Production is customer HSM / PKCS#11.

Integrity

  • Hash registry: first SHA-256 and first receipt win; copies keep original timestamp.

  • Chain JSONL per cube; stamp unregistered hashes to the timestamp leaf.