ArgusLeaf
Transparency
About our scanner.
Data sources
Public logs, not your server.
ArgusLeaf reads public Certificate Transparency logs maintained by Google (Argon/Xenon), Cloudflare (Nimbus), DigiCert (Yeti/Nessie), and others. These logs are publicly accessible over HTTP — we do not scan private networks, internal services, or any server without a public CT entry.
In Phase 0 (current), we do not perform active scanning of discovered domains. We only read the CT log metadata: domain name, certificate serial, issuer, and issuance date.
Enrichment
When we do contact a domain.
For high-scoring matches, we perform a limited enrichment pass: a single HTTP HEAD request (or GET if HEAD is unsupported) to the root URL, and a DNS lookup. This is the same request a browser makes when you type a URL — it retrieves the HTTP status code, server headers, and page title to give our users context.
We do NOT: spider or crawl websites, submit forms, test for vulnerabilities, or perform any intrusive action.
Our user-agent string for these requests is:
ArgusLeaf/1.0 (+https://argusleaf.com/about-our-scanner)Any server seeing this string can identify the source immediately.
Respectful crawling
We don't hammer servers.
Enrichment requests are rate-limited to at most 1 request per domain per 24-hour window. We honor robots.txt for web crawling (though our primary data source — CT logs — doesn't involve web crawling at all).
We don't cache or store the full content of enriched pages — only extracted metadata: HTTP status code, page title, and redirect chain length.
Opt-out
Remove your domain from enrichment.
To opt out of ArgusLeaf enrichment requests entirely, email [email protected] with your domain name. We'll add it to our suppress-list within 48 hours.
Note: Opting out of enrichment doesn't remove your domain from CT log detection. CT log data is public and can't be "unlogged." If a domain matching a tenant's watch-list appears in a public CT log, they may still be alerted — we just won't make any HTTP requests to it.
Data
What we keep.
- CT log metadata (domain, serial, issuer, date)
- Retained indefinitely — it's public data already available to anyone.
- Enrichment results (HTTP status, title, DNS records)
- Retained 90 days, then purged.
- User watch-list data (brand terms, domains)
- Retained only for active monitoring relationships; deleted upon account closure.
- Third-party sharing
- We don't sell or share any data with third parties.