HomeArgus
The digital evidence
intelligence engine.
Argus discovers, understands, correlates, and preserves digital assets at internet scale — and produces records your investigators can work from and your counsel can verify.
Four systems, one record.
Argus is not a monitoring tool with an evidence feature bolted on. It is four systems that write into a single asset record: an acquisition tier, an inference tier, an evidence tier, and a graph. Everything else — console, API, integrations — reads from that record.
Acquisition
Continuous, event-driven collection across 1,400+ surfaces and your own repositories, with the serving context captured alongside the bytes.
Inference
Vision transformers, detection heads, OCR, and synthetic-media analysis, ordered so cheap decisions run before expensive ones.
Evidence
Fingerprinting, write-once preservation, external timestamping, and a hash-linked custody ledger on every action.
Graph
Entity resolution and clustering across assets, sellers, domains, infrastructure, campaigns, and organisations.
Event-driven, cloud native, zero trust.
Each tier scales independently and communicates over an event bus, so acquisition spikes never stall inference and inference never blocks preservation. Security and observability are horizontal concerns, not a layer you reach at the end.
One asset. One identity.
Ten thousand disguises.
Change a single pixel and the file hash is worthless. Argus derives a perceptual identity from structure rather than bytes, so it survives cropping, resizing, recompression, rotation, watermarking, screenshots, and generative repainting. Transform the asset below and watch which identifier breaks.
- byte-identical to the reference
- hamming distance 0 / 64 bits
- provenance verified · metadata intact · no derivative signals
Computed in your browser: SHA-256 through the Web Crypto API over raw pixel data, and a content-normalised 64-bit perceptual hash. The same primitives run at ingest scale in Argus alongside pHash, dHash, wavelet, and learned embedding fingerprints.
Preservation is a pipeline stage, not an export button.
Evidence is created at observation time, because a capture reconstructed later is a reconstruction. Every asset is preserved with its serving context, hashed four ways, timestamped externally, and appended to a custody ledger before an analyst ever sees it.
What is preserved
- Original bytes, unmodified
- Full-page render at capture time
- DOM snapshot and HAR
- Response headers and TLS chain
- Extracted metadata and absences
How it is protected
- Write-once storage with object lock
- Legal-hold flag per bundle
- Per-tenant keys, envelope encryption
- RFC 3161 external countersignature
- Residency pinned at write time
How it is proven
- Hash-linked append-only ledger
- Actor, purpose, and authority on access
- Exports are themselves ledger events
- Offline verification against a manifest
- Signed integrity report on demand
The full ten-stage pipeline, with the output of every stage, is on the homepage pipeline explorer →
Know more than what you see.
One asset, every dimension: its history, its family, its hashes, its metadata, its owner, its network, and the confidence behind each claim. Everything an investigator needs on one surface, and everything counsel needs one click from it.
| Timestamp | Event | Detail |
|---|---|---|
| 03:11:42.318Z | OBSERVED | marketplace-B · listing live · price $41.00 |
| 03:11:42.530Z | CLASSIFIED | counterfeit_listing 0.957 · mark modified |
| 03:11:42.611Z | FINGERPRINTED | parent ast_meridian_mark_primary · d=7 |
| 03:11:43.002Z | SEALED | evd_01JQ8R4K2M9VTZX · countersigned |
| 03:11:43.219Z | CORRELATED | cluster CN-0117 · 41 sellers |
| 06-14 22:07Z | PRIOR SIGHTING | same fingerprint on marketplace-A · removed 06-19 |
| 06-02 04:18Z | INFRA CREATED | domain registered 52 days before the listing |
| Version | Transform | Distance | First seen |
|---|---|---|---|
| v0 origin | — | 0 | 2019-03-11 |
| v1 | crop 38% | 3 | 2026-06-14 |
| v2 | recompress q52 | 4 | 2026-06-14 |
| v3 | overlay + text | 6 | 2026-06-29 |
| v4 (this asset) | screenshot recapture | 7 | 2026-07-24 |
| v5 | diffusion repaint | 14 | 2026-07-11 |
Ordering is established by first-seen observations, each backed by a preserved bundle — not by file timestamps, which are trivially forged.
| Family | Identifier | Survives transform |
|---|---|---|
| SHA-256 | 9f2c41ab7d0e5583c1b9…a41f | no |
| BLAKE3 | 2ad7e91c4408f6b2de07…7c93 | no |
| Visual fingerprint | c3e1 9a70 f2b8 4d61 | yes · d=7/64 |
| pHash | e4a1 77c2 0b95 3d18 | yes · d=9/64 |
| dHash | a1c0 3e7f 9b22 d418 | partial |
| Embedding | emb_01JQ8R4K2M9VT | yes · cos 0.961 |
| Segment tiles | 16 tiles · 11 matched | yes · localises reuse |
| Field | Value | Signal |
|---|---|---|
| exif.make | stripped | evasion indicator |
| exif.datetime | stripped | evasion indicator |
| xmp.creator | studio-render-v2 | links 6 other sellers |
| content credentials | absent | no C2PA manifest |
| jpeg quant | adobe q78 → mobile q52 | 2 generation losses |
| http.server | nginx/1.24 · Cloudflare | — |
| asn | AS132203 Tencent · HK | 9 cluster domains |
| tls.ja3 | 771,4865-4866… | shared across cluster |
| Entity | Type | Link | Conf. |
|---|---|---|---|
| ast_meridian_mark_primary | Authorised asset | parent | 0.98 |
| SF-8841-QQ | Seller | publisher | 0.96 |
| meridian-outlet-store.shop | Domain | host | 0.99 |
| AS132203 /24 | Hosting block | shared infra | 0.94 |
| payment-handle-7741 | Payment handle | shared, 5 sellers | 0.94 |
| campaign-Q3-flash | Campaign | promoted asset | 0.88 |
| derivative-set-A | Cluster | member (8,412) | 0.91 |
| # | Actor | Action | Verify |
|---|---|---|---|
| 01 | argus-crawler/4.2 | OBSERVED | PASS |
| 02 | argus-vision-3.4.1 | CLASSIFIED | PASS |
| 03 | argus-hash-2.1 | FINGERPRINTED | PASS |
| 04 | argus-preserve | SEALED | PASS |
| 05 | j.okafor@meridian.com | VIEWED | PASS |
| 06 | legal-api-svc | EXPORTED | PASS |
The verification report is signed and downloadable, so counsel can validate the chain offline against the published manifest.
Interface concept shown with representative data.
Argus becomes part of your workflow.
Nobody needs another console to check. Argus pushes into the systems your teams already run, and accepts instructions from them, so brand protection stops being a silo.
Stream events and audit records into Splunk, Sentinel, Chronicle, or any HTTP event collector.
Trigger playbooks on seal, cluster detection, or authenticity threshold breach.
Two-way sync with ServiceNow, Jira, and Salesforce, including exhibit attachment.
Scheduled exports to Snowflake, BigQuery, or S3 in Parquet for your own analysis.
Slack, Teams, and email routing by brand, region, severity, or cluster.
Okta, Entra ID, Ping, and any SAML 2.0 or OIDC provider, with automated provisioning.
Monitoring scopes, policies, and thresholds declared as reviewable code.
Signed webhooks and a replayable event stream for anything not on this list.
Built for the teams that get audited.
Argus holds your most sensitive brand material and the evidence you will rely on when you enforce. The architecture assumes a hostile network and an eventual audit.
Every request authenticated and authorised independently. No implicit trust between services, regions, or tenants.
Logical isolation with per-tenant keys and customer-managed rotation. Single-tenant deployment available.
TLS 1.3 in transit, AES-256 envelope encryption at rest, optional mTLS and IP allowlists on the API.
Every access, query, and export is a signed ledger entry, exportable to your SIEM in real time.
Pin processing and storage to US, EU, UK, or APAC regions. Evidence stays in its assigned jurisdiction.
SSO and SCIM, role and attribute-based policy, just-in-time elevation with recorded justification.
Enterprise deployment
- Multi-tenant SaaS in four regions, or single-tenant in a dedicated account
- On-premises and air-gapped deployment for sovereign requirements
- Customer-managed keys with HSM backing
- Private connectivity over PrivateLink or equivalent
- Structured onboarding with asset enrolment and policy design
Scalability
- 12.4B assets fingerprinted and addressable
- 4.1M assets per hour sustained at peak acquisition
- Sub-second observation-to-sealed at the 95th percentile
- Independent scaling per tier, so a spike never stalls preservation
- Backfill of historical asset libraries without pausing live monitoring
Where Argus goes next.
Directional, not contractual. We publish the roadmap because customers deserve to plan against it, and we revise it in the open when evidence says we should.
Frame-level fingerprinting and scene understanding for short-form video, with the same custody guarantees as still imagery.
Link counterfeit clusters to logistics and fulfilment signals to identify production origin rather than just distribution.
Issue and verify content credentials for your own asset releases, so provenance travels with the file from creation.
Natural-language investigation over the graph, with every generated claim traced to the evidence that supports it.
Put Argus against your hardest asset.
Send us one mark and one image you believe has been altered beyond recognition. We will return the genealogy, the network, and the preserved evidence package.
Or email sales@cyberconclave.io