We are a security product. The bar we set on our own posture is the bar we hold our customers to. Here is how Argus handles data, what we request access to, where it runs, and how to report an issue.
Every connector requests read scopes by default — discovery and findings only. Write scopes are requested only when you turn on a specific feature that needs them (PR-based fixes on GitHub, edge-rule pushes on Cloudflare, remote remediation on WordPress). Disruptive actions surface a plain-language approval card; nothing high-blast-radius happens silently.
Argus runs on Google Cloud Platform, primarily in us-central1. Customer data is stored in Firestore and Cloud Storage with platform-managed encryption at rest (AES-256). All traffic is encrypted in transit over TLS 1.2 or higher. Secrets we store on your behalf live in Google Secret Manager, access-controlled per service account.
Customer data is partitioned by organisation ID at the application layer. Storage paths and Firestore collections are scoped per organisation. Session tokens are signed and validated on every request. No customer reads across the tenant boundary — including agency accounts, which see only their own clients.
Findings, configuration metadata and the narrative of security events are passed to language models for triage, enrichment and response drafting. We use Anthropic, DeepSeek and Groq through enterprise APIs that do not train on customer data. The cost router picks the cheapest sufficient model per task, so most routine triage runs on the smaller models and frontier models handle the harder calls.
The protective-actions ledger logs every decision the AI contributed to — including which model produced which judgement — so you can audit what happened, by whom (or by what), with full reasoning.
SOC 2 Type I readiness is in progress. ISO 27001 alignment is in design. We will publish reports as they close. In the meantime, the protective-actions ledger and the controls mapping produced by the platform are designed to be evidence-ready under the control families those frameworks share.
Email security@argusmesh.app. We aim to acknowledge within one business day and triage within three. PGP keys are available on first contact for sensitive material. A coordinated bounty programme is in design and will be announced here when it launches.
Trust is built by the controls you can see — read them, then connect a platform.
