Architecture

Argus uses a split control-plane / data-plane design that satisfies strict data-residency reviews.

Control plane (SaaS)

Auth, dashboards, RBAC, audit log, alerts, and compliance mapping. Hosted by Argus.

Data plane (your VPC)

The Argus Agent runs where your data lives. It discovers datastores, samples and classifies content, and reports findings back over outbound HTTPS.

ARGUS CONTROL PLANE  (dashboards, alerts, compliance)
        ^ findings only, HTTPS (outbound from agent)
        |
CUSTOMER VPC
  Argus Agent --(read-only)--> S3 / RDS / DynamoDB / Redshift
  Your data stays here. Only insights leave.

Guarantees

• No inbound ports - outbound HTTPS only.
• Least-privilege, read-only access - scoped, rotatable, revocable.
• Insights, not data - only structured findings cross the boundary.