Argos · Documentation

Everything you need
to get started.

From installation to advanced configuration, the documentation covers every layer of the Argos stack. Each guide includes step-by-step instructions and working examples.
Setupsetup · install · config

Quick Start Guide

Install the agent, configure the proxy, connect to the executive portal, and start monitoring in under five minutes.
  • System requirements & prerequisites
  • Agent installation (macOS, Linux, Windows)
  • Proxy certificate setup
  • First scan walkthrough
Detectionpatterns · AI · k-anonymity

Detection Engine

How Argos finds sensitive data: from exact patterns to AI-based context, then catching the dangerous combinations that re-identify people. Runs end-to-end in under 50ms, entirely on-device.
  • Layer 01, pattern matching: structured PII (SSNs, cards, keys)
  • Layer 02, semantic detection: names & medical terms patterns miss
  • Layer 03, k-anonymity: re-identification risk & HIPAA Safe Harbor
  • Custom pattern configuration
See more+
Layer 01
Pattern matching
Deterministic and sub-millisecond. Out of the box it covers SSNs, credit cards, IBANs, ICD-10 diagnosis codes, API keys, JWTs, private keys, database connection strings and email addresses.
Layer 02
Semantic detection
Not everything sensitive fits a pattern: a name, a role, a project codename, a phrase like "the CFO's home address" won't match a regex. This layer runs a lightweight on-device model that reads for context and catches what pattern matching alone would miss, still entirely on-device and still inside the same sub-50ms budget.
Layer 03
K-anonymity
"John Smith" is safe. "94304" is safe. "1987-03-12" is safe. Put them in one prompt and 87% of the US population is uniquely identifiable. Layer 03 models this re-identification risk using k-anonymity and HIPAA Safe Harbor principles, and blocks the dangerous combinations that pattern matching and semantic detection alone would miss. Worked example:
# prompt: "patient John Smith, DOB 1987-03-12, ZIP 94304, ICD F32.1"
findings: 4 · re-identification risk: HIGH
combination: name + DOB + ZIP + diagnosis
verdict: CRITICAL → action: BLOCK

Detection runs both ways. The central reporter only ever receives anonymized metadata, counts, scores, categories and timestamps; the matched text itself never crosses the network. Every model response is independently rescanned too, since models can hallucinate emails or paraphrase names, and any findings are logged as separate model-generated PII events.

APIREST · webhooks · auth

API Reference

REST endpoints for ingest, dashboard queries, device management, and webhook integrations. Schema-validated, rate-limited, fully documented.
  • Authentication: token hashing & sessions
  • Ingest API: scan event submission
  • Dashboard queries: scans, devices, departments
  • Webhook configuration & payloads
See more+

Every surface ships hardened by default with the OWASP API Top-10 mitigations most self-hosted tools skip: adaptive per-IP and per-identity rate limiting on ingest, dashboard, login and admin independently; strict schema validation that rejects unexpected fields and never echoes raw input back; authentication tokens stored only as cryptographic hashes; and session cookies inaccessible to client-side scripts, auto-secured, and rotated on privilege changes.

Deploydocker · cloud · TLS

Deployment Guide

Docker Compose, bare-metal, and cloud deployment options. TLS configuration, environment variables, and production hardening checklist.
  • Docker Compose single-command deploy
  • Bare-metal: systemd, nginx reverse proxy
  • Cloud: AWS, GCP, Azure templates
  • TLS certificates & environment vars
Portalportal · dashboard · views

Executive Portal

Navigate the seven dashboard views: overview, devices, departments, scan log, monitoring, executive reports, and server-level settings.
  • Overview: total scans, devices, blocked, redacted, risk distribution & 7-day trend
  • Devices: per-agent peak risk, blocked count, last seen, sortable across every agent
  • Departments: Engineering vs. Sales vs. Data Science, where the leaks live
  • Scan Log: every intercepted request with domain, model, regulations & action
  • Monitoring: outbound traffic, alert rules, flagged events & SMTP notifications
  • Executive Report: board-ready compliance posture, key findings & recommendations
  • Server Settings: ingest keys, retention, digest email & agent install commands
See more+

The portal is a separate, optional service: it aggregates only anonymized metadata, counts, risk scores, categories, timestamps, reported by every installed agent. Raw prompt text and PII findings never leave the device, so the portal never sees what triggered an event, only that one did.

Every view updates from the same live feed, so a scan blocked on one device shows up in Overview, Departments and the org-wide Scan Log within seconds. The Executive Report view rolls this into a board-ready PDF: posture score, top regulations triggered, and department-level breakdowns, ready to export without manual assembly.

Server Settings controls ingest keys, the metadata retention window, and digest email recipients, everything needed to run the portal as the single source of truth for compliance reporting across the fleet.

Frequently asked questions.

Quick answers. For full walkthroughs and worked examples, see the guides above.
What is Argos and how does it work?

Argos is a transparent proxy that runs on every device. It intercepts outbound LLM requests, detects and tokenizes PII before the prompt leaves the machine, forwards the sanitized payload to the model, and rehydrates the response with original values. The user sees a coherent answer; the model never sees raw PII.

Does Argos send my data to a third-party service?

No. Detection runs entirely on-device. The only data sent to the central executive portal is anonymized metadata: counts, scores, categories, and timestamps. The raw PII findings are dropped before the report is queued. The matched text never crosses the network.

What LLM providers does Argos support?

Argos monitors 16 endpoints out of the box: OpenAI, Anthropic, Gemini, Mistral, Cohere, Groq, Together, Perplexity, OpenRouter, Bedrock, Azure, Vertex, HuggingFace, Replicate, DeepSeek, and xAI. Custom endpoints can be added via configuration.

What is k-anonymity and why does it matter?

K-anonymity measures re-identification risk: no single field is dangerous alone, but combine a name, a ZIP code and a date of birth in one prompt and 87% of the US population becomes uniquely identifiable. See the Detection guide above for the full three-layer walkthrough and a worked example.

How fast is the detection pipeline?

P50 detection latency is under 50ms. The pipeline is engineered for imperceptible overhead with optimized caching and compilation strategies. Users don't notice any perceptible delay when interacting with their LLM tools.

What regulations does Argos help with?

Argos tracks 6 regulatory frameworks: GDPR, HIPAA, PCI-DSS, SOC2, CCPA, and FERPA. Each scan event is tagged with applicable regulations based on the PII categories detected. The executive report generates board-ready compliance summaries.

Can I deploy Argos on-premise?

Yes. Argos supports containerized, bare-metal, and cloud deployment. For enterprise deployments, we offer dedicated support with SLA guarantees and custom configuration.

What security hardening does the platform itself have?

Argos ships with the OWASP API Top-10 mitigations most self-hosted tools skip, on by default across every surface. See the API guide above for the full breakdown.

Does Argos scan model responses too?

Yes. Models can hallucinate emails, paraphrase names, and generate plausible PII. Argos independently rescans the model's output stream and logs any findings as separate model-generated PII events, giving you visibility into what the model is producing.

What operating systems are supported?

The Argos agent runs on macOS, Linux, and Windows. The Executive Portal server supports both x86_64 and ARM architectures and runs on all major platforms.

How does pricing work?

Argos is priced per device with volume discounts. Contact us for a quote tailored to your fleet size. We offer plans for teams of 1-10, 11-50, 51-200, and 200+ devices. Enterprise plans include dedicated support, SLAs, and custom integrations.

Questions the docs don't answer? Ask us.
CONTACT →