Security & Privacy
Local-first by default. Your assistant runs on hardware you own. Your conversations and documents stay on the device by default — this page explains exactly what that means, and exactly when data can leave.
What stays on the device
- Your conversations with Hermes using local models
- Documents, notes, and files you load onto the appliance
- The assistant's memory and preferences
- Local voice processing, where configured
What leaves the device — only with your approval
- Bring-your-own-key providers — if you connect Claude, GPT, Gemini, or another provider, the prompts you route to them are processed under that provider's terms. You choose when.
- Messaging connections — messages you exchange through connected apps pass through those platforms, as they normally would.
- Managed Care — if you subscribe, the care service sees device health signals and update status, not your conversations.
- Encrypted backups — designed so only you can restore them.
- Archive import — approved documents you send before shipment are processed privately, loaded onto your appliance, and then removed from our systems, with a written scope and deletion confirmation.
- Large private jobs — approved oversized jobs can be processed privately and returned to your appliance.
Deletion and ownership
The appliance is yours. Delete conversations and documents at any time from your dashboard; a factory reset removes everything. If you return the device under the 15-day guarantee, we wipe returned hardware as part of processing.
What we never do
- We do not sell your data.
- We do not train shared models on your private content.
- We do not connect your appliance to outside services without your action.
Digital Twin Pro can generate inaccurate or incomplete outputs — always review important information. It does not provide legal, medical, financial, or tax advice.