What does the Hermes Haven platform manage for a Hermes Agent?
Hermes Agent is the open-source agent runtime. Hermes Haven is the service you use; HermesHaven is the platform behind that service, responsible for deployment, authentication, routing and day-to-day operation. The HermesHaven platform itself must not be described as open-source. [A-D6][C12]
That boundary matters: the runtime defines how an agent works, while the hosting platform supplies the operational layer around it.
What is included in the managed operational layer?
| Capability | What the evidence supports | Evidence |
|---|---|---|
| HTTPS access | nginx terminates TLS and routes traffic to the agent instead of exposing it through a raw public IP. | [C22] |
| Persistent storage | Agent files are held on Ceph/RBD-backed persistent storage with storage-layer redundancy. | [C25] |
| Backups | Managed daily, hourly and manual backup policies exist; availability depends on plan or add-on. The audit noted pending concurrency work. | [C18] |
| Authentication | The platform operates its own OIDC identity provider for agent dashboards; 2FA is enforced in the default account flow. | [C09][C17] |
| Search and extraction | Hosted agents are configured with SearXNG and Firecrawl without requiring the customer to supply keys for those services. | [C24] |
| Model routing | Qwen 3.6 35B is included in every current plan, and the proxy implements fallback to Qwen when paid credit is exhausted. | [C13][C16] |
A managed service reduces the infrastructure work you must perform yourself; it does not turn implementation details into guarantees. Backup recovery objectives, support response targets and service availability must be taken from current contractual documents, not inferred from this page.
What remains part of the Hermes Agent workspace?
The agent's configuration, personality, memory and skills use standard Hermes file formats. The audit found no proprietary platform format, but it also found no self-service “export everything” endpoint. Describe portability at the file-format level, not as an instant export feature. [C19]
For model behaviour and provider choices, see Models. For available connections, see Integrations.
How does traffic reach an agent?
Inbound browser traffic reaches the platform HTTPS gateway, which terminates TLS and routes the request to the appropriate agent. Agents are not presented through a raw public IP. This is an inbound-access statement: agents still have outbound internet connectivity for tools and external providers. [C07][C22]
Each agent receives its own overlay network. The supported security statement is that agents cannot communicate directly with one another; “zero cross-traffic” or “no internet access” would overstate the evidence. [C06][C07]
Read the qualified controls and limitations on Security.
When is managed hosting a better fit than a VPS?
Choose managed hosting when you want the platform to coordinate deployment, ingress, persistent storage, backups and built-in services. Choose self-hosting when you want to own those operational decisions and can maintain them yourself. The right answer depends on your required control, operational capacity and provider policy; see the factual checklist in Compare self-hosting and VPS.
What should you verify before choosing a plan?
- Check the current model catalogue and where your selected provider processes inference data. [C03]
- Confirm the backup policy included in the plan or add-on. [C18]
- Review the documented security limitations, including the absence of demonstrated disk-level encryption. [C05]
- Check current limits and prices on Pricing; do not rely on uncited promotional or SLA claims. [C10][C11]