Every data touch is read-only, encrypted, and scoped to the smallest possible blast radius. Below is exactly what happens between you clicking "Connect" and seeing your first health check.
You sign in to QuickBooks directly — Argus never sees your QuickBooks password. Intuit returns short-lived OAuth tokens scoped to read-only access on a single realm.
Tokens are immediately encrypted at the application layer with AES-256-GCM using a per-environment master key, then stored in our database. Decryption happens in-process, in-memory, only when Argus calls QuickBooks.
Argus pulls the QBO reports needed for the active checks — P&L, balance sheet, AR aging, GL detail. We store summaries (per-day snapshots) and check results, not the entire general ledger.
The 11 deterministic rule-based checks run first; the AI-augmented anomaly detection runs second. Both run inside our Canada Central deployment — data never leaves the region for processing.
Results stream over an authenticated SSE channel. All transport is TLS 1.2+ with HSTS. Sessions are signed with a rotating server-side secret and expire on inactivity.
Click "Disconnect" and Argus stops calling QBO that minute. Cached transaction snapshots are purged within 30 days. Account deletion (full tenant wipe) is honored within 7 days.
Argus uses Better Auth for self-managed authentication. Three sign-in methods are supported, with optional MFA on email/password. SSO via Google or Microsoft is available on Firm-tier plans.
Hashed with Argon2id. Optional TOTP MFA on every account. Rate-limited login with exponential backoff after failed attempts.
Standard OAuth 2.0 with OpenID Connect. We never see your Google password. MFA inherits from your Google account.
Azure AD / Entra ID via OAuth 2.0. SCIM provisioning available on Firm-tier plans. Conditional access policies inherited from your tenant.
Less is more for security. Argus runs in a single Azure region with a small attack surface, well-understood dependencies, and short data paths.
We won't claim certifications we don't have. Below is exactly where Argus stands today and what's on the roadmap.
Argus operates under Canadian privacy law (PIPEDA). Data minimization, consent, retention, and deletion practices follow PIPEDA principles. A signed DPA is available on request for any plan.
No SOC 2 audit at this stage. We may pursue Type I when customer demand justifies the cost. We will not claim "in progress" until an auditor is engaged and a window is scoped.
Not pursued. Our security posture mirrors many ISO 27001 controls in spirit, but we don't hold the certification and won't claim alignment we haven't earned.
Third-party penetration test scheduled annually. Latest summary report available on request under NDA for prospective enterprise customers.
Security disclosures go to security@argus.app. We commit to acknowledging within 24 hours, publishing a summary within 7 days of resolution, and crediting reporters who ask to be named. We don't currently run a paid bug bounty, but we do say thank you with real money.