Trust center
ArgusMinds handles your company's confidential information. This page sets out the standards it meets and the measures that protect it.
Standards
| Standard | Status |
|---|---|
| GDPR (EU) | Complies, as processor for its clients |
| Chile's Law 19.628, as amended by Law 21.719 | Complies; the amendment applies from 1 December 2026 |
| EU AI Act | Meets the obligations that apply to it: transparency (art. 50) and training (art. 4). Its functions are not high-risk |
| ISO/IEC 27001:2022 | Management system in place; in the process of certification |
| SOC 2 | Controls in place under the Security, Availability and Confidentiality criteria; Type II report planned for 2027 |
Controls
Access
- Phishing-resistant second factor for privileged profiles.
- Short sessions.
- Staff access to the cloud with a second factor and no static keys.
- Access granted with approval, and removed the same day a person leaves.
- Access reviewed every six months.
- Each person sees only the data their roles allow.
Data
- Read-only access to the client's systems.
- Isolation and encryption per client, with its own key.
- TLS on every connection.
- Continuous and daily backups, locked.
- Deletion when the service ends, including deletion of the client's key.
- Each company's knowledge stays in ArgusMinds: its functions, its data model, its agents' results and its people's explanations.
Evidence and logs
- Every finding keeps its original document, sealed.
- Activity logs that cannot be altered, kept for 365 days.
- Every result can be traced: which function produced it and in which version, which data it read, who answered or reviewed it, and which model took part when AI was involved.
Functions and agents
- AI agents and automations read data only through approved functions: named, reviewed calculations that respect the permissions of whoever runs them.
- Every function run is logged.
- Creating or approving a company function is a superuser's task.
- A company can connect its own agents over MCP. They sign in with credentials issued by ArgusMinds, act on behalf of a person from that company, and read only through approved functions and read-only tools.
Network and application
- Web application firewall and rate limits.
- Services not directly exposed to the internet.
- Security headers.
- DNS filtering.
Changes and vulnerabilities
- Every change approved by another person and covered by automated tests.
- Deployment only from the main branch.
- Vulnerability scanning before deploying.
- Internal security review every month.
AI
- The models are not trained on the data.
- People's identifiers pseudonymised.
- Every AI text marked and logged.
- Option to use the client's Anthropic account, with the key stored encrypted and visible to no one.
Organisation
- Policies approved and signed.
- Annual training in security, privacy and AI.
- Incident response plan, with notice to the client within 24 hours.
- Continuity, with recovery within 24 hours and at most 1 hour of data lost.
- Annual supplier assessment.
Documents
We provide them on request to each client's security team, under ArgusMinds' mutual confidentiality agreement.
- Information security policy
- Conduct, acceptable use and remote work policy
- Secure development and change management policy
- Incident and continuity policy
- Supplier policy
- Privacy and personal data protection policy
- Artificial intelligence use policy
- ArgusMinds system description
- Impact assessment and international transfers
- Data processing agreement
To request them, write to seguridad@argusminds.com.
Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Hosting and operation of the service, backups and sending the service's emails | European Union (Sweden). The content delivery network has points of presence in other countries |
| Amazon Web Services (Amazon Bedrock) | Language models for the AI functions | European Union. Global, only when the client's contract authorises processing outside the European Union |
| Anthropic, PBC | Language models for the AI functions, through its API, only when the client's contract authorises processing outside the European Union | Global |
| Google LLC (Google Workspace) | Communications with the client: email and documents | Google data centres |
ArgusMinds notifies the contact that each client named in its contract by email, at least 30 days in advance, before adding or replacing a subprocessor, and updates this list.
Last updated: 30-10-2026. Contact: privacidad@argusminds.com.
Your data
To request access to your data, or its correction, erasure, portability or blocking, or to object to its processing, write to privacidad@argusminds.com. If ArgusMinds processes your data on behalf of your company, the request is handled together with your company.
More information in the privacy notice.
This is a translation of the Spanish page. If they differ, the Spanish version prevails.