ARGOS Trust Centre
Our Trust Centre provides you with the most up to date information on the security, compliance and privacy of ARGOS.
Security is standard to every ARGOS customer, not an extra you pay for. Here we're transparent about what we do, what we store, and what we do not have yet.
Last reviewed: 30 October 2026
At a glance
Six facts a security reviewer asks for first.
-
01
Hosting
Microsoft Azure, in Australia East and North Europe. The components that scan AWS accounts run in AWS.
-
02
Data region
You choose where your data lives: Australia or the European Union. It stays there.
-
03
Sign-in
No passwords stored. Single sign-on through Auth0 with Microsoft Entra ID or Google identity. Your MFA policy carries over.
-
04
Credentials
Encrypted with AES-256-GCM, a random nonce per secret, and a key held in Azure Key Vault. Never stored in clear text.
-
05
Cloud access
Read-only, management-plane API access. ARGOS never reads files, blobs, database rows or object contents.
-
06
Audit log
Every user action is recorded in the dashboard audit log, across 86 event types.
How ARGOS reaches your cloud
Agentless, read-only, and at the management plane only.
ARGOS is agentless. Nothing is installed in your environment. ARGOS calls the cloud management APIs with read-only permissions, builds an inventory, and assesses it.
ARGOS never reads data-plane content. It does not open files or blobs, query databases, or read object contents. This is a design choice, not a permission setting: an assessment tool that can read your data is itself a risk, and the findings ARGOS produces do not need it. The trade-off is that ARGOS cannot see object-level state such as the encryption of an individual object, and the report says so where it matters.
Microsoft Azure
For continuous assessment you give ARGOS an Entra ID app registration with a client secret, a certificate or a federated credential, and the Reader role on each subscription. Reader at management-group scope is optional and adds Azure Policy and PIM visibility. ARGOS exchanges the credential for a short-lived bearer token on each scan. Each stored credential is encrypted with its own random nonce under a key held in Azure Key Vault.
Alternatively you can consent to the ARGOS multi-tenant Entra ID application through Microsoft's application consent flow, if the use of tokens is not desired or not technically possible, for example because of Token Protection policies.
For a one-off scan no app registration is needed. You sign in with your own Entra ID identity, or paste an access token. The credential lives in an encrypted envelope for the scan only, for at most 24 hours, and is never written to the customer record. A pasted token is used until it expires and is never refreshed or exchanged.
Microsoft Entra ID and Microsoft 365
Continuous assessment uses an app registration with read-only Microsoft Graph application permissions. A one-off assessment uses your own delegated sign-in with read-only scopes. The full permission lists are in the FAQ.
Amazon Web Services
For AWS, ARGOS assumes an IAM role that you create in each account, using the external ID pattern with an ARGOS-generated external ID. ARGOS stores no AWS secrets. On each scan it assumes the role, receives temporary STS credentials, and scans the account with the read-only policies attached to the role.
Data handling
Where your data lives, what we keep, and how it leaves.
Region
ARGOS is hosted on Microsoft Azure. You select the region your data is stored in when you sign up:
- Australia (Australia East)
- European Union (North Europe)
Your data is stored and processed in that region. The one exception is AI processing, described below.
What is stored
ARGOS stores the inventory it collects from your cloud (configuration, not content), the findings and attack paths it derives from it, the graphs behind the diagrams, scan history and the audit log, and the reports you generate. Report files are kept for 7 days after generation.
Encryption
All customer data is encrypted at rest with AES-256, managed by Microsoft Azure.
Credentials you provide to ARGOS are additionally encrypted in our code with AES-256-GCM, using a random nonce per secret and your customer id as associated data. The key is held in Azure Key Vault. Customer credentials are never stored in clear text.
Browser-to-ARGOS traffic uses HTTPS. ARGOS-to-cloud traffic uses the providers' authenticated HTTPS APIs.
Backups
Platform backups exist. In Australia, the database is backed up every 4 hours and each backup is kept for 8 days, zone-redundant. In the European Union, the Azure default backup policy applies. A removal is honoured when the backup expires.
Removing data
Removing a connection runs a staged, verified purge of that connection's inventory, findings, graphs, snapshots and reports. The same connection can be added again once the first pass has finished.
When a subscription ends, the account's scans, findings and inventory are deleted promptly.
AI
What ARGOS AI runs on, where, and what it sees.
ARGOS AI runs on Azure OpenAI only, reached over private endpoints.
Your data is not used to train models. This follows from Azure OpenAI data handling: prompts and completions are not used to train, retrain or improve Microsoft's or any third party's models.
What is sent is the context of a finding and the configuration it was derived from. Credentials are never sent. ARGOS AI is used for finding explanations, the report's executive summary and recommendations, the network assessment, the agentic AI summary, choke-point fix guidance and the Conditional Access remediation plan.
Application security
How ARGOS itself is built and controlled.
Access control
ARGOS uses role-based access control with four roles: Reader, Contributor, Cloud Admin and Account Admin. The first three see only the cloud connections assigned to them. Account Admin sees everything. Every API request is checked against the caller's role and connection scope.
API access is per user, through Azure API Management with a key issued to that user. Documentation is at dev.argos-security.io.
Secrets
ARGOS's own internal secrets are stored in Azure Key Vault, so access to them can be monitored and controlled in one place.
Security headers
The ARGOS APIs send the full baseline set of security headers. One known limitation: the dashboard sets its Content Security Policy through a meta tag, so frame-ancestors, HSTS and Permissions-Policy are not enforced on the dashboard yet. This is documented and on the list.
Subprocessors
The third parties that handle customer data on our behalf.
| Provider | Purpose |
|---|---|
| Microsoft Azure | Hosting and data storage, in Australia East and North Europe |
| Auth0 by Okta | Identity and single sign-on |
| Stripe | Credit card payments and billing |
| SendGrid by Twilio | Transactional email |
| HubSpot | Website forms |
| AWS | Components used to scan AWS customer accounts |
Compliance and assurance
What has been assessed, what has not, and how to report a problem.
What we do not have yet
ARGOS holds no SOC 2 report and no ISO 27001 certification today. We would rather say so than imply otherwise. If one of these is a hard requirement for you, tell us and we will tell you where we are.
Responsible disclosure
If you find a security issue in ARGOS, email support@argos-security.io. We read every report and reply to the ones that describe a real issue. Please give us reasonable time to fix it before disclosing it publicly, and do not access, change or delete data that is not yours while testing. Our contact details are also published at /.well-known/security.txt (RFC 9116).
If your review needs more than this page, ask. We answer security questionnaires, and under NDA we share the architecture diagram and completed questionnaires.
