Data Privacy
Adopting Argyronix means letting an agent into a production database. The question that decides it is not whether we are careful — every vendor says that — but what the design makes possible in the first place. This page answers that, including the parts that are awkward.
Argyronix is pre-release. What follows is how the system is designed and what we commit to, not a report on a deployment history we do not yet have.
The detection and diagnosis algorithms operate on logs, performance metrics and system catalog metadata. Table contents are not an input to them. This is not a policy applied on top of a system that could read your rows — it is what the algorithms are built from.
One qualification, because you would find it yourself: a database’s diagnostic surfaces are not uniformly free of its data. Planner statistics hold samples of real column values by design, and the text of a currently executing statement carries its literal parameters. In PostgreSQL, the engine we instrumented first, that means most_common_vals on an email column contains real addresses. This is how databases expose their own internals rather than a defect in any one of them, and we will describe the equivalent for every engine we add. Anyone who tells you they read “only metadata” either has not looked or is hoping you will not. Our answer is architectural rather than verbal: those fragments stay on the agent, which runs inside your infrastructure, and object names are tokenized before anything leaves it.
Tokenization is only worth something if the key stays behind. The mapping between real object names and their tokens is held by the agent, on your side. What reaches us is tokens; what would turn them back into names never does. It is reversible only where the original data already lives.
Some diagnostics need more — a query text, a specific object. Where that is the case the system asks, explicitly, for read-only access. You set how long the grant lasts, what it covers, and what limits apply to it. You can withdraw it at any moment without notice or negotiation.
If a grant is refused or withdrawn, the capability that depended on it stops and says plainly that it has stopped. It does not degrade quietly, guess, or work around you. Everything not depending on that grant continues unaffected, at full confidence. A system that punishes you for withholding access has made the access mandatory in practice, whatever the documentation says.
We ask for the minimum needed for the signals you have agreed to, and we ask for it through a controlled interface rather than direct table access. You get the concrete grants. We do not ask for a superuser account. Monitoring permissions and remediation permissions are independent: granting one does not grant the other, and either can be withdrawn on its own.
Argyronix works through six levels of operational responsibility, published as an open specification. Levels 0 to 3 — structural awareness, observation, diagnostics, recommendations — never write to your database. Levels 4 and 5 are the only ones that execute change, they attach to individual capabilities rather than to the system, and every grant of level 5 carries an expiry. A capability is promoted by a human decision and demoted automatically on an incident, a rollback, a failed verification, or lost telemetry.
Maintenance operations are designed to run only when the target object is genuinely idle, to abort if activity rises, and to execute as atomic transactions, so that the remediation does not become the incident. Every finding carries the reasoning and confidence level behind it. Every automated action is recorded end to end.
The component with access to your database runs inside your infrastructure, not ours. We are committing to publishing it under an open license, so that what it reads and what it transmits can be read rather than taken on trust. That commitment is not yet an artifact — the repository is not public today — and we would rather state it as an intention you can hold us to than imply it is already done.
Because the sensitive fragments and the tokenization mapping remain on infrastructure you control, they are not transferred to us at all. We are not lawyers, and we will not tell you what that means under GDPR or any US regime. We are stating the architectural fact. That is the one your counsel will want, before your engineers get their turn.
We are not going to summarize our telemetry footprint. Which catalogs the agent reads, what is retained and for how long, and which of them you can switch off without losing the product are being documented catalog by catalog. We will publish that inventory rather than paraphrase it, and until then we will walk any reviewer through it directly.
Send a questionnaire, or ask for a walkthrough of the access model before you apply. Ask the hard version of the question — it is the one worth answering early.
contact@argyronix.com