ARGOS Trust Centre
Our Trust Centre provides you with the most up to date information on the security, compliance and privacy of ARGOS.
Security is front of mind of everything we do at ARGOS which is why we only work with the most trusted providers in the industry that are absolutely aligned to our own security expectations.
Security is not an extra feature that you pay for, it is standard to every ARGOS customer and we are very transparent about how we do things.
Security
Passwords / Single Sign On / Multi-Factor Authentication
When you register with ARGOS and / or log in to ARGOS you select an Identity Provider (Microsoft Entra ID or Google Identity). You log in to that Identity Provider via auth0 (see below at Identity). Neither us nor auth0 ever store your password and we do not want to know it. All we rely on are temporary tokens exchanged with your Identity Provider.
Also, if you have Multi-Factor Authentication (MFA) enabled on your user identity (you have, right?) then this automatically also applies to log in attempts to ARGOS.
Secrets
Communication with your Cloud
The way ARGOS communicates with your cloud depends on the Cloud Service Provider (CSP).
In general: ARGOS does not access customer data (PII) in your cloud. We only communicate with cloud APIs at the management plane layer. ARGOS will not attempt to access data like sensitive files in storage, or data within databases.
Microsoft Azure
When you provide ARGOS with an Azure App Registration / Service Principal (SPN) we use this SPN to exchange it for a temporary Bearer token from the Azure Active Directory platform and gain temporary access to your Azure Management Groups / Azure Subscriptions.
Each SPN is encrypted with its own nonce with a master key that is stored in a secrets manager (Azure Key Vault). What this means is the tokens for each SPN is encrypted with its own key+nonce pair.
Alternatively, for one-off scans, ARGOS will use the consultant’s Read-Only credentials to access Azure once. No SPN is required. The provided JWT does not have a refresh token (will be useless after a set period of time) and is not stored in the ARGOS database beyond the duration of a customer’s scan.
Amazon Web Services (AWS)
For AWS we assume an IAM Role (that you create) in your AWS Accounts using the AWS External ID pattern. This means we do not store any secrets relating to your AWS Accounts in our database. We only temporarily assume the IAM Role, retrieve a temporary STS Token and scan your AWS Accounts.
Encryption
All customer data is encrypted at rest using AES-256 encryption algorithms managed by Microsoft Azure.
In addition to this any credentials provided to ARGOS that are required for ARGOS’s functionality are additionally encrypted using AES-256 GCM with a Microsoft-managed and rotated HSM key. Customer credentials are never, at any time stored in clear text in the ARGOS database.
All user-to-ARGOS browser interaction uses industry standard HTTPS as the communication protocol.
All ARGOS-to-customer cloud environment communication uses secured API communication protocols.
Access Control
Access Control is always a difficult topic to get right. At ARGOS we do a multitude of things to ensure that a person can only ever access the data they are privileged to access.
ARGOS supports a simple Role-based-access (RBAC) model for all team members of an ARGOS customer. All ARGOS APIs check the access permissions of every request that is being made and checks internal user IDs against internally stored information.
Data
Customers are able to select one of the following regions to store their data in:
- Australia
- European Union
Our Partners
Compliance
ARGOS is largely hosted on Microsoft Azure, one of the largest and most trusted public cloud platforms.
In order to support customers on AWS a part of ARGOS is deployed on the AWS cloud.
Cloud Security Alliance
Read ARGOS’s CSA CAIQ assessment report here: https://cloudsecurityalliance.org/star/registry/argos-cloud-security-pty-ltd/