Argyle

Argyle is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Yes. Argyle's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Argyle hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Argyle's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Security isn't a single yes/no, but Argyle is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, PCI DSS, GDPR, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Argyle hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@argyle.com or via a /security page (Argyle lists a security contact).

Argyle lists 19 subprocessors on its trust center, including Google Cloud Platform, Confluent, Cloudflare, Looker, Ocrolus. Buyers use this for fourth-party risk review.

Argyle hosts on GCP, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Argyle's trust center is at https://trust.argyle.com;trustcenter.argyle.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Yes, Argyle has automated and manual controls in place to ensure any data anomalies are surfaced, triaged, and processed proactively. Argyle applies rigorous real-time data quality assurance through our internal integration quality assurance process, which applies rudimentary data typing, sanity and simple business rule checks; the checkpoints within the process are able to suppress and reject data that does not conform to our field description(s) in real time and alert our internal data quality team for further investigations and remediation.

Argyle is not subject to regulations, requirements, or regular review for regulatory compliance by a governmental or other regulatory authority that apply specifically to Argyle’s activities. Argyle is subject to various federal, state, and local laws and associated regulations generally applicable to the conduct of its business, including those relating to data privacy and unfair or deceptive trade practices. Accordingly, Argyle is subject to the jurisdiction of the governmental agencies and other regulatory authorities charged with enforcing those laws and regulations (e.g., the FTC with regards to unfair or deceptive trade practices).

Yes. Argyle utilizes a user-consent based model through which consumers permission Argyle to share their personal information with Argyle's Customers. For details on how Argyle works, please visit https://argyle.com/legal/consumers/how-it-works/.

Yes. All personnel are hired subject to a background check.

Yes. Argyle completes SOC 2 Type II audit, PCI-DSS questionnaire, and Penetration testing annually. Our ISO 27001 audit is performed at 3-year intervals with annual surveillance audits completed in the interim.

Data at rest is required to be encrypted with AES 256. Data in transit is required to have TLS 1.2+ encryption.

Argyle utilizes various controls to secure sensitive and non-public information, including encryption, multi-factor authentication, password protection, and limiting access to systems. For more specific information about Argyle’s data handling and use, please review our Data Protection and Handling Policy, available upon request.

Although Argyle has personnel in various locations globally, Argyle’s backbone information technology infrastructure is based in the United States. Argyle’s primary information technology infrastructure provider, and the only platform on which consumer data is stored, is the Google Cloud Platform, with all data hosted in the US Central region. Argyle personnel located outside the United States are, in many instances, engaged on an independent contractor basis, but subject to the same background check and policy and conduct compliance as Argyle’s direct employees. Personnel access to infrastructure or data by all Argyle personnel, regardless of whether such personnel is an employee or contractor, and regardless of their location, is strictly in accordance with audited Argyle’s SOC 2 Type 2 and ISO 27001 compliant controls.