We are a security product. The bar we set on our own posture is the bar we hold our customers to. Here is how Argus handles data, what we request access to, where it runs, and how to report an issue.
Argus is a security product — we hold ourselves to the standard we sell.
Connectors use scoped OAuth and request only the permissions a check needs. No standing keys sit in your dashboard, and access can be revoked in a click.
Data is encrypted in transit and at rest. Findings and evidence are isolated per organisation, with role-based access across your team.
Every action — every scan, rule and automated response — is logged with a full audit trail you can export as evidence for SOC 2, ISO 27001 and GDPR reviews.
AI runs on a metered, prepaid allowance with provenance on every verdict. Enterprise can bring its own AI key so prompts and outputs never leave your provider.
Auto-Protect acts within operator-gated limits and supports one-click undo on every automated change — automation never means loss of control.
Found something? We run a coordinated vulnerability disclosure process. Email security@argusmesh.app and we will respond quickly.
Every connector requests read scopes by default — discovery and findings only. Write scopes are requested only when you turn on a specific feature that needs them (PR-based fixes on GitHub, edge-rule pushes on Cloudflare, remote remediation on WordPress). Disruptive actions surface a plain-language approval card; nothing high-blast-radius happens silently.
Argus runs on Google Cloud Platform, primarily in us-central1. Customer data is stored in Firestore and Cloud Storage with platform-managed encryption at rest (AES-256). All traffic is encrypted in transit over TLS 1.2 or higher. Secrets we store on your behalf live in Google Secret Manager, access-controlled per service account.
Customer data is partitioned by organisation ID at the application layer. Storage paths and Firestore collections are scoped per organisation. Session tokens are signed and validated on every request. No customer reads across the tenant boundary — including agency accounts, which see only their own clients.
Findings, configuration metadata and the narrative of security events are passed to language models for triage, enrichment and response drafting. We use Anthropic, DeepSeek and Groq through enterprise APIs that do not train on customer data. The cost router picks the cheapest sufficient model per task, so most routine triage runs on the smaller models and frontier models handle the harder calls.
The protective-actions ledger logs every decision the AI contributed to — including which model produced which judgement — so you can audit what happened, by whom (or by what), with full reasoning.
SOC 2 Type I readiness is in progress. ISO 27001 alignment is in design. We will publish reports as they close. In the meantime, the protective-actions ledger and the controls mapping produced by the platform are designed to be evidence-ready under the control families those frameworks share.
Email security@argusmesh.app. We aim to acknowledge within one business day and triage within three. PGP keys are available on first contact for sensitive material. A coordinated bounty programme is in design and will be announced here when it launches.
Trust is built by the controls you can see — read them, then connect a platform.
