Data Privacy
Adopting Argyronix means letting an agent into a production database. The question that decides it is not whether we are careful — every vendor says that — but what the design makes possible in the first place. This page answers that, including the parts that are awkward.
Argyronix is pre-release. What follows is how the system is designed and what we commit to, not a report on a deployment history we do not yet have.
The detection and diagnosis algorithms operate on logs, performance metrics and system catalogue metadata. Table contents are not an input to them. This is not a policy applied on top of a system that could read your rows — it is what the algorithms are built from.
One qualification, because you would find it yourself: PostgreSQL’s own diagnostic surfaces are not uniformly free of your data. Planner statistics hold samples of real column values by design — most_common_vals on an email column contains real addresses. The text of a currently executing statement carries its literal parameters. Anyone who tells you they read “only metadata” either has not looked or is hoping you will not. Our answer is architectural rather than verbal: those fragments stay on the agent, which runs inside your infrastructure, and object names are tokenised before anything leaves it.
Tokenisation is only worth something if the key stays behind. The mapping between real object names and their tokens is held by the agent, on your side. What reaches us is tokens; what would turn them back into names never does. It is reversible only where the original data already lives.
Some diagnostics need more — a query text, a specific object. Where that is the case the system asks, explicitly, for read-only access. You set how long the grant lasts, what it covers, and what limits apply to it. You can withdraw it at any moment without notice or negotiation.
If a grant is refused or withdrawn, the capability that depended on it stops and says plainly that it has stopped. It does not degrade quietly, guess, or work around you. Everything not depending on that grant continues unaffected, at full confidence. A system that punishes you for withholding access has made the access mandatory in practice, whatever the documentation says.
We ask for the minimum needed for the signals you have agreed to, through a controlled interface rather than direct table access, and we hand over the concrete grants rather than asking for a superuser account. Monitoring permissions and remediation permissions are independent: granting one does not grant the other, and either can be withdrawn on its own.
Argyronix works through six levels of operational responsibility, published as an open specification. Levels 0 to 3 — structural awareness, observation, diagnostics, recommendations — never write to your database. Levels 4 and 5 are the only ones that execute change, they attach to individual capabilities rather than to the system, and every grant of level 5 carries an expiry. A capability is promoted by a human decision and demoted automatically on an incident, a rollback, a failed verification, or lost telemetry.
Maintenance operations are designed to run only when the target object is genuinely idle, to abort if activity rises, and to execute as atomic transactions, so that the remediation does not become the incident. Every finding carries the reasoning and confidence level behind it. Every automated action is recorded end to end.
The component with access to your database runs inside your infrastructure, not ours. We are committing to publishing it under an open licence, so that what it reads and what it transmits can be read rather than taken on trust. That commitment is not yet an artefact — the repository is not public today — and we would rather state it as an intention you can hold us to than imply it is already done.
Because the sensitive fragments and the tokenisation mapping remain on infrastructure you control, they are not transferred to us at all. We are not lawyers and will not tell you what that means under GDPR or any US regime; we are telling you the architectural fact, which is the one your counsel will want before your engineers get their turn.
We are not going to summarise our telemetry footprint. Which catalogues the agent reads, what is retained and for how long, and which of them you can switch off without losing the product is being documented catalogue by catalogue. We will publish that inventory rather than paraphrase it, and until then we will walk any reviewer through it directly.
Send a questionnaire, or ask for a walkthrough of the access model before you apply. We would rather answer the hard version of the question early.
contact@argyronix.com