Security
What your security team asks before they approve the vendor
Argus is a compliance product selling to compliance buyers. This page states where data lives, which external sources we call, how reports get approved, and why control scores require corroboration.
Residency
Canada Central and single-tenant options
SaaS runs on Azure. Enterprise clients can deploy single-tenant when residency or network isolation is non-negotiable. Ask us for the architecture diagram that matches your contract tier.
Multi-tenant SaaS
Default deployment on Azure with Canada Central available for buyers who need Canadian residency in contract.
Single-tenant enterprise
Dedicated Azure environment for one customer when OSFI, Law 25, or internal policy requires isolated infrastructure.
Tenant isolation
Every database row carries tenant_id. Repository queries enforce scope. Cross-tenant access is tested in CI.
Threat intel
Outside-in sources Recon and Surface call
Argus does not invent scan results. Each signal names the source, the timestamp, and the raw observation stored with the assessment for auditor replay.
| Source | Used for |
|---|---|
| Shodan | Internet-wide exposure and service fingerprinting on vendor IPs |
| NVD | CVE metadata and severity for detected software versions |
| CISA KEV | Known exploited vulnerability matches on open services |
| HIBP | Breached credential domain checks where keys are configured |
| Mozilla Observatory | HTTP security header posture scoring |
| crt.sh | Certificate transparency history and subdomain discovery |
Approval gate
Publish only after human sign-off
Scribe drafts the customer report. An approver must accept or reject on the server. There is no client-side bypass, no auto-send toggle, and every decision writes to the audit log with actor and timestamp.
States
- Draft Scribe output awaiting review
- Approved Cleared for delivery channels
- Revision requested Returned to analysts with notes
No hallucination path
Corroboration before a control scores as met
Scorer treats vendor PDFs and portal copy as claims, not proof. A control moves to met only when Librarian extracted a specific statement from evidence and Recon or Surface returned an external signal that matches it. Conflicts surface as open findings with both citations attached.
Legal and compliance language in reports is hedged and dated. Argus supports your judgment; it does not replace counsel or issue formal compliance rulings.
View Argus sub-processorsNeed a security questionnaire answered?
Request our architecture summary and sub-processor list on a demo call.