HHermes Explained

Memory

Privacy

The boundary around what Hermes may store, retrieve, expose, or send to providers.

Importance 5/53 backlinks1 source refs

Privacy

What it is

The boundary around what Hermes may store, retrieve, expose, or send to providers.

In plain terms

Imagine a courier who blacks out your home address on the envelope before handing it to a stranger for inspection, while quietly keeping the real address on file so your package still arrives. Hermes can do something similar with what reaches the model versus what stays local: an identifier gets hashed or a phone number gets stripped before it ever enters the LLM’s context, even though the underlying data is unchanged.

Why it matters

Memory and retention policy both operate inside a boundary privacy defines: what’s allowed to be stored at all, what’s eligible for retrieval later, and — critically — what actually gets sent to an external model provider versus kept local. That boundary becomes concrete the moment someone runs a local model specifically to avoid sending sensitive project data to a hosted API. Team-facing workflows like a Slack second brain put extra pressure here, since a pool of curated knowledge can reveal more collectively than any one message ever did on its own.

How it works

A privacy.redact_pii config flag, off by default, is read per message in the gateway (gateway/run.py) and passed into build_session_context_prompt() (gateway/session.py): on platforms marked PII-safe, phone numbers are stripped and user or chat IDs are swapped for deterministic hashes before that context reaches the LLM, while the real values keep routing messages correctly behind the scenes. Separately, anything written to memory is scanned for injection or exfiltration patterns before being accepted (tools/memory_tool.py); if a stored entry is later found to match a threat pattern, it is swapped for a “[BLOCKED: …]” placeholder in what actually reaches the model’s system prompt, while the raw entry stays visible in the file itself so a person can find and delete it.

A concrete example

With privacy.redact_pii turned on over a PII-safe messaging platform, the model sees a hashed identifier in place of the sender’s real phone number - it can still tell who is who across a conversation, but the real number never leaves the local session layer. If a memory file somehow picked up a hidden instruction from a poisoned source, the system prompt shows “[BLOCKED: MEMORY.md entry contained threat pattern…]” instead of the dangerous text, while the original entry stays on disk for the user to inspect and remove.

How it connects

This note belongs to the Memory family. Its closest neighboring concepts are: Retention, Memory Tools, Agent Runtime, Personal OS.

Source evidence

  • vendor/hermes-agent/agent/memory_manager.py:505-515#MemoryManager.prefetch_all — Verified Source Map evidence for MemoryManager. MemoryManager calls prefetch on each registered provider in order, skips empty results, isolates individual provider failures, and merges the remaining text.

Workflows

  • Slack Second Brain
  • Mastering Hermes Desktop: From Local Chat App to an Always-On Agent Control Center