The design decision everything else follows from
Argus splits into a control plane we operate and a data planeyou operate. The data plane is the scanning agent, and it runs inside your own cloud account.
Objects are read, classified and discarded in your environment. What leaves is a structured finding: counts, categories, confidence scores, resource identifiers and configuration facts such as whether encryption is enabled. File contents, sampled bytes and the matched values themselves never reach us. This is not a policy we apply to data we hold; it is data we never receive.
Network posture
- The agent makes outbound HTTPS only. There is no inbound listener, no port to open, no public endpoint of ours inside your perimeter.
- No VPN, no peering, no firewall changes required.
- All traffic between the agent and the control plane is TLS encrypted.
- Scanning is throttled with automatic backoff so it does not degrade production workloads.
Permissions
The agent runs under an IAM role you create in your own account. We publish the policy; you can read it, narrow it and revoke it. There are no static access keys and no shared secrets between tenants.
Discovery and scanning need read permissions only: S3 list and get, RDS describe and limited query, DynamoDB scan with throttling, and Redshift read. Automated remediation requires aseparate, additional grant covering only the actions its workflows perform, and is disabled until an administrator turns it on. The deployment module is documented in thedeployment guide.
Making changes to your infrastructure
Remediation is the one place Argus writes rather than reads, so it is gated deliberately:
- Off by default per tenant; an administrator must enable it.
- Human approval required by default, with the approver recorded.
- Dry run available on every workflow, reporting what would change while changing nothing.
- A run is not treated as successful until a verification rescan re-derives the resource's posture. The API call returning 200 is not sufficient.
- Pre-execution state is snapshotted; a successful run can be rolled back for 24 hours.
- Every approval, rejection, run and rollback is written to the audit log.
Tenant isolation
Argus is multi-tenant. Every query is scoped to a tenant at the data-access layer, and cloud credentials, findings and configuration are partitioned per tenant. One customer cannot read another's data.
Access control and authentication
- Multi-factor authentication is enforced on all accounts. It is not an option a user can decline.
- SSO and SAML are supported for customers using an identity provider.
- Role-based access control is granular to the individual action, not just to the page, and permission checks are enforced server-side rather than by hiding buttons.
- Sessions are JWT-based with token revocation, so a logout or a forced sign-out takes effect immediately rather than at token expiry.
- Passwords are stored hashed. We cannot read them and cannot tell you what yours is.
Encryption
- In transit: TLS for all traffic, including agent to control plane.
- At rest: the platform database is encrypted, and stored cloud credentials are additionally encrypted at the application layer with a separate key.
- Your data in your environment stays under your keys. We never hold them.
Audit logging
Every mutating action records the actor, the target, what changed, and the before and after values. Secrets and credentials are excluded from log payloads. Logs are retained for 400 days, which is deliberately longer than a year so an annual review can look across a full previous period.
Third parties
We keep the number of providers with access to anything small, and list each one with what it processes on the sub-processors page.
One case is worth calling out because it involves an AI service. Argus can use a language model to phrase remediation recommendations. The prompt contains aggregate figures only: how many resources were scanned, counts by risk level, the names of data-type categories found, and which frameworks are implicated. It contains no resource names, no account identifiers, no sampled content and no matched values. Where a self-hosted model is configured, nothing leaves our infrastructure at all. If no model is available the product falls back to a fixed template library, so this path is optional rather than load-bearing.
This website
The marketing site is static, serves no third-party scripts, sets no cookies and runs no analytics or advertising trackers. It ships a Content-Security-Policy, HSTS,X-Frame-Options: DENY, X-Content-Type-Options: nosniff and a restrictive Permissions-Policy.
Reporting a vulnerability
If you believe you have found a security issue, emailhello@argusdspm.com with enough detail to reproduce it. Please do not open a public issue or disclose it publicly until we have had a chance to fix it.
We will acknowledge within 3 business days, keep you updated, and credit you if you would like us to. We will not pursue legal action against researchers acting in good faith who test only their own tenant, avoid privacy violations and service degradation, and give us reasonable time to remediate. We do not currently run a paid bounty programme.
What we have not done yet
A security page that lists only strengths is not useful for evaluating a vendor, so:
- Argus does not currently hold a SOC 2 attestation or an ISO 27001 certificate. When the product maps your findings to SOC 2 or ISO 27001 controls, that is analysis of your posture; it is not a claim about ours.
- We have not yet completed an independent third-party penetration test.
- We do not yet operate a paid vulnerability disclosure programme.
- Formal sub-processor change notifications are handled by email to administrators rather than an automated subscription feed.
If any of these is a blocker for your procurement process, tell us athello@argusdspm.com and we will give you an honest answer about timing rather than a roadmap slide.