Getting started with your agent.

Welcome

Your AI agent is a small, persistent presence in the messenger you already use. You'll talk to it like you'd talk to a thoughtful colleague — in full sentences, in fragments, sometimes with one word.

It learns gradually. The first day it knows almost nothing about you. By the second week, it knows your tone, your team, your routines. By the second month, you'll wonder how you went without it.

Your first 5 minutes

Once your invite arrives, you'll click a link in the email and see this:

What to fill in

Pick a name you'll actually use. It can be a name you like, a character you grew up with, or just a word you find comforting. There's no “right” answer.

Pick the persona that matches how you'd like to be spoken to. You can change everything later without losing memory — so don't agonize.

For your first messenger, pick wherever you already spend the most time. Telegram is the smoothest path right now; WhatsApp is supported but takes one extra screen.

Your first day

After setup, you'll get a “your agent is ready” notification in the messenger you chose. Open the chat. Say hi. It'll introduce itself.

Tell it three things about your day. Anything. A meeting you're dreading. A friend you owe a reply. A project you keep avoiding. Watch how it responds.

By the end of day one, your agent will remember what you told it, how you tend to phrase things, and what time of day you reach out. None of this is shared with us, or with other agents.

Your first week

This is the most important week. Here's what we recommend:

• Talk to it daily, even briefly. A “morning” message is enough.
• Correct it when it gets your tone wrong. A short “more casual” or “shorter, please” is plenty.
• Save one routine — “every Friday at 16:30, do a weekly review with me”.
• Trust one action — let it book a recurring meeting, say.
• Read the privacy page once, calmly. Trust takes input.

Naming your agent

The name is yours. It will be the word you type or say most often for the next year. Pick something you don't mind hearing in your own head.

Some people choose familiar archetypes — Alfred, Watson, Jarvis, Atlas. Some choose people in their own lineage — a grandfather's name, a friend who'd be amused. Some choose nouns — Compass, Beacon, Bureau.

You can rename later. The agent's memory and playbooks stay; only the name changes.

Picking a persona

The persona is a starting voice and bias-for-action. There are four:

• Alfred · calm, proactive, discreet. Best for organization and the quiet things.
• Watson · analytical, thoughtful, patient. Best for thinking out loud.
• Nova · fast, action-first. Best for momentum.
• Ada · precise, structured, literal. Best for technical work.

Pick one. Try it for a week. If the voice doesn't feel like yours, switch — your memory comes with you.

Connecting a messenger

Telegram and WhatsApp at launch. We handle the connection for you — no bots to set up, no tokens to copy, no plumbing to learn. Click “Connect”, confirm in the messenger app, done.

If something goes wrong

• You'll see a clear error message, not a stack trace.
• The “retry” button always works. If it doesn't, write to [email protected].

Choosing a private home

Your AI agent lives at a web address: by default yourname.getermes.ai. You can use any name that isn't taken.

If you'd rather use your own domain — say, agent.yourcompany.com — we walk you through it. It's one DNS record. We tell you what to copy where.

Your dedicated VPS

This is the part that sounds technical. It isn't — because you don't do it.

Every Ermes subscription includes a dedicated private server, allocated to you alone. We provision it, install your agent on it, link your subdomain, configure secure connections, and keep it updated. You watch a progress bar.

For the 3-day trial, your agent runs on the same dedicated VPS in the region you picked — we provision it from day one. Memory and playbooks are yours from the first message.

How to talk to it

Like a thoughtful colleague. You don't have to phrase things carefully. You don't have to use commands. “What's on for tomorrow?” works. So does “remind me later”. So does “I need a no for LightLab — kindly”.

If your agent gets it wrong, say so. “More direct” or “less”, “shorter”, “send this in my voice, not yours” — these all work. Corrections stick.

Memory & what it remembers

Your agent remembers the things you tell it. The names you mention. The decisions you make. The patterns in how you phrase things.

You can see its memory at any time: “show me what you know about me”. You can edit anything. You can delete a single fact, a whole topic, or everything.

Playbooks · creating & running

A “playbook” is a repeatable task your agent can run by name. Some playbooks come built-in: morning brief, Friday review, polite no. Some you'll create yourself.

To create one: do the thing two or three times, then say “remember this as ‘name’”. Your agent will confirm and start running it on the cadence you set.

Routines & nudges

A routine is a playbook that runs on time. “Every Friday at 16:30.” “Every morning at 07:30.” “Mon/Wed/Fri at 17:45.”

A nudge is a short, kind reminder — not a notification. “Drink water.” “The walk you said you'd take.” “Joon's birthday is tomorrow.” Set them once, edit any time.

Permissions

Your agent will ask before doing anything irreversible. Sending an email, paying an invoice, accepting a meeting — these are all “ask first” by default.

If a recurring action is safe, you can promote it to “trusted”. You can demote it back any time.

Read the privacy & security page for the full permission model, or jump to the long version below.

The engine · the Ermes runtime

The thing that makes your agent feel like a person — that remembers, plans, asks a clarifying question, types a reply — is the Ermes runtime. It's the software that actually does the thinking. Ermes is also the platform around it: the setup of your VPS, your dashboard, your messenger connections, billing, and the human support at [email protected].

In practice, you write to your agent and the runtime is on the other end. It reads the message, decides what to do (answer, ask back, take an action, set a reminder), picks which memories and tools are relevant, calls the language model for the words, and writes the response. All of that happens on your own dedicated VPS, not in a shared multi-tenant cluster.

The runtime is the orchestrator, not the model

The model — the part that generates the language — comes from a provider. By default that's Ermes's managed account; optionally it's your own subscription or API key (see Bring your own AI). The runtime decides what to send to the model and what to do with what comes back. The model doesn't see anything the runtime doesn't choose to send.

That separation matters for two reasons. First, you can change models without changing your agent — the runtime stays the same, your memory and routines stay the same. Second, the trust boundary is clearer: the provider never holds your full memory, only the small slices the runtime forwards for the message at hand.

The memory store · vector DB

When you tell your agent something — a name, a preference, a decision — it has to be stored somewhere so the agent can find it again next week. That somewhere is called a vector database. The name is mostly jargon; what it actually does is store ideas in a way that makes them searchable by meaning, not just by exact keywords.

A regular search finds documents that contain the word you typed. A vector database finds memories that mean what you asked about, even if the words are different. If in February you said “I hate calls before 11”, and in May you ask “can you push the partnership thing earlier?”, your agent can connect those — because “early call” and “calls before 11” land near each other on the map of meaning.

What gets stored

• Facts you tell it about yourself (“I'm in Berlin”, “my co-founder is Joon”).
• Decisions it watches you make — patterns it can repeat or check before repeating.
• Tone corrections (“more direct”, “drop the exclamation marks”).
• The text of past conversations, so it can refer back (“you mentioned this in March”).
• Notes from routines — what they did, when, what you said about the result.

What stays local

The vector database lives on your dedicated VPS. Not in a shared pool with other customers' memories, not in a central datastore. When your agent searches its memory, the search runs on your machine. When the language model needs context for a reply, only the few memory snippets the agent picks for this message are sent — typically three to ten short paragraphs — not the whole store.

You can inspect everything that's in there: ask “show me what you know about me” and the agent reads its memory back. You can delete a single fact, a topic, or wipe the store from your dashboard. Deletion is real — we don't keep a shadow copy.

Where your data lives

Every Ermes subscription includes a dedicated VPS — a private server that runs your agent, holds the vector database, and stores your conversations. It is yours. There is no shared multi-tenant database where every customer's rows sit in the same table separated only by a customer-id column.

Why that matters: when a multi-tenant system has a leak, every customer in that system is potentially affected — the blast radius is “everyone”. On a dedicated VPS the blast radius for a problem with your data is one: you.

You pick a region during sign-up (EU, US, Asia). That's where your server runs and where your data sits. We don't move it without telling you, and you can request a move to a different region by writing to support.

Encryption

• In transit — every connection to your agent runs over TLS. Messenger traffic uses the messenger's own end-to-end encryption to our edge; from there it travels over TLS to your VPS. The web dashboard and API are TLS-only with HSTS.
• At rest — the disk on your VPS is encrypted. Database files, vector store, conversation logs, secrets — all on encrypted storage. Off-VPS backups (when you enable them) are encrypted before they leave your machine.
• Keys — VPS disk keys are managed by Ermes so we can restore your agent if you can't log in. Customer-held keys for the dashboard export path are on the roadmap so encrypted backups can be opened only by you. Secrets your agent uses to talk to third parties (messenger tokens, BYO model keys) live in a per-VPS secret store, never in plain text.

Who can read your conversations

The honest list, ordered by access level:

• You. Full access, always. The whole memory store, every conversation, every routine log, exportable as a single JSON file.
• Your agent. Full access. That's the point.
• The language model provider. Sees only the specific message and memory snippets your agent forwards for each reply. Not the whole vector store, not other conversations. We use zero-retention API agreements where the provider offers them; the current matrix is on the privacy page.
• Ermes support. No read access by default. If you write to [email protected] with a problem that needs us to look at your VPS, you'll see an explicit “grant support access for 24 hours” toggle. Access expires automatically; every read is logged and visible to you.
• Ermes staff outside support. No access. Engineering and ops do not have a back door into customer VPSs. We debug production issues by adding fixes to the runtime and rolling them out — not by reading individual customers' conversations.

Memory boundaries · vector DB vs model

A common worry: “if my agent has years of memory, does the model see all of it on every message?” No. The model only sees what your agent chooses to forward for the current reply.

For a given message, the agent typically forwards:

• The recent conversation window on this thread.
• A small set of memories the vector DB matched as relevant — usually 3 to 10 short snippets.
• Your persona, tone preferences, and any active routine the agent is currently running.

Everything else stays on your VPS. If a model provider were ever compelled to hand over what they hold on you, they'd have a stack of small context windows — not your memory store, not your conversation history.

Permissions & approvals · the long version

Your agent is ask-first for anything irreversible. The short summary is in Permissions above; here's the longer one.

Always asks before

• Sending a message to anyone other than you.
• Paying an invoice, making a transfer, or any kind of payment.
• Accepting a meeting or commitment on your behalf.
• Connecting a new messenger, account, or third-party service.
• Deleting anything — memory, files, scheduled events.
• Granting another human or another agent access to your data.

You can trust an action

After your agent has asked five times in a row about the same action with the same shape — “send the morning brief”, “reply ‘noted’ to John on customer threads” — you can promote it to trusted. It runs without asking, and every run is logged on your dashboard.

You can revoke trust

One tap. Trust is reversible by you at any time, for any reason, with no support ticket required. Pausing the whole agent is also one tap — it stops reading messengers and running routines until you re-enable it.

What the agent cannot do without asking, ever

• Connect a new payment method.
• Send money to a new recipient (even if you've trusted “pay invoices”, new payees still ask).
• Share your memory or conversations with another agent or human.
• Disable its own approval prompts.

Account security

• Sign-in. Passkey or email magic link. We don't store passwords, so they can't leak from us.
• Messenger linking. Pairing Telegram or WhatsApp uses a one-time code that expires in five minutes. We never see your messenger credentials and we don't store the pairing code after use.
• Recovery. If you lose your email, contact support. You'll be asked to verify ownership through the messenger account already linked to your agent. We don't use security questions — they're a known weak recovery channel.
• Revoking access. Every linked messenger, every connected service, every “trusted” action — listed in your dashboard with a one-tap revoke.
• Active sessions. See every browser that has an active dashboard session, with the rough location and last-used time. Sign them out individually or all at once.
• Audit log. Sensitive actions (memory deletes, trust grants, support-access grants, sign-ins) are written to an append-only log you can read. Useful both for spotting something wrong and for remembering “wait when did I tell it to do that?”

What we don't do

The negatives, stated explicitly so you don't have to read terms-of-service tea leaves:

• We don't train models on your data. Your conversations, your memory, your routines — none of it is used to train Ermes models, our runtime itself, or shipped to a provider for their training. Where a model provider's API has a “use for training” flag, we keep it off.
• We don't share memory across customers. One customer's agent cannot see another customer's vector DB. There is no cross-tenant context bleed because there is no shared tenant — each agent runs on its own VPS.
• We don't sell or rent your data. Not to advertisers, not to data brokers, not to anyone. Ermes makes its money on subscriptions.
• We don't read your conversations for analytics. Aggregate metrics — number of messages, latency, error rates — come from operational logs that don't carry message contents.
• We don't build profiles for ad targeting. There is no ad business and no plan for one.
• We don't hand-over to law enforcement without a court order. If we receive a lawful request, we comply with what the order specifically requires and we tell you, unless the order itself forbids us from telling you (in which case we publish that fact in our annual transparency report once we're allowed to).

If something goes wrong

Incident response

If an incident affects your data — a confirmed leak, a service compromise, a security bug we discover that could have exposed your VPS — we notify you within 72 hours of confirming the scope, by email and dashboard banner. EU customers get the GDPR-required notification regardless of severity; for other regions we apply the same 72-hour bar voluntarily.

What you'll get

• What happened, in plain language.
• What data of yours was — or might have been — affected.
• What we've done about it and what we're still doing.
• What, if anything, you should do (rotate something, check something, or nothing).

Status & outages

Operational issues that don't involve customer data — “the messenger gateway is slow”, “the dashboard is down in EU” — go on our status page, with a running incident timeline. The dashboard banner also reflects the live status of your specific VPS.

Responsible disclosure

Found a security issue? Email [email protected]. We publish a post-incident write-up of resolved issues within thirty days of fix unless the reporter asks otherwise. We don't sue researchers who work in good faith.

Tuning the voice

If your agent's voice feels too stiff or too breezy, say so. Try: “Be more direct.” Or: “Less formal, more like how I'd write.” Or: “Stop using exclamation marks.”

Tone instructions stick. You can see them under Settings → Voice, edit there, or just say “forget that” in chat.

Multiple messengers

One agent can live in several places. Telegram in the morning, WhatsApp on the road, Signal for the sensitive things. Same memory, same persona, same playbooks — wherever you are.

Bring your own AI · early access

Ermes comes with a managed model account out of the box — you don't need to think about model providers to use it. But if you're already paying for AI somewhere, you can point your agent at that instead.

Two paths

API key (live today) — drop an OpenAI, Anthropic, Google, or Mistral API key into your settings. Your agent uses your account; you pay the provider directly. Zero-retention agreements carry over.

Developer subscription (priority beta access) — if you already pay for ChatGPT Plus, Pro, Business, Edu, or Enterprise, or for GitHub Copilot, we can wire your agent into that subscription. No extra model bill, no markup. We handle the OAuth handshake with you on a call during the early-access period; once we've walked you through it, your agent quietly runs on what you already pay for.

What works, what doesn't (and why)

• ChatGPT Plus / Pro / Business / Edu / Enterprise — works via OpenAI's subscription CLI flow, where eligible. OpenAI documents Plus and above as eligible for that path.
• GitHub Copilot (individual or business) — works. Your Copilot subscription routes the model traffic; we add the agent on top.
• Claude API key (any tier) — works. Standard pay-per-token billing against your Anthropic org.
• Claude Max + extra usage credits via the Claude Code OAuth path — works for advanced setups. Requires a Max plan and pre-purchased usage credits; the base Max allowance is not consumed.
• Claude Pro — does not work, on purpose. Anthropic's consumer terms (§3(7), §11) prohibit third-party tools from accessing Claude through a consumer subscription. We won't build a path that puts your Anthropic account at risk.
• Google Gemini API key — works. Standard pay-per-token.
• Google Gemini via gemini-cli OAuth — on the roadmap behind ChatGPT Plus and Copilot.

The reliability tradeoff (please read)

Consumer subscriptions are sized for one human typing into a chat window. Your agent will do more than that: routines, reactive replies, tool calls. On heavy days you'll hit your subscription's rate limits before you'd hit ours. Providers can also disable accounts they think are being automated.

We keep Ermes's managed model account as the default for that reason. Use a subscription when it makes sense, fall back to managed when it doesn't — your agent doesn't care which one carries the conversation.

How to get on it

Self-serve sign-up isn't live yet — this ships first as a guided setup for priority beta customers. Add yourself to the waitlist (link below) and mention “bring my own subscription” in the form's last field. We'll reach out, walk you through the OAuth step on a short call, and confirm everything once you're running.

Exporting your data

Everything your agent has — memory, playbooks, conversation history — exports as a single, machine-readable JSON file from your dashboard. Use it to back up, switch providers, or just see what's there.

Troubleshooting

Your agent went quiet

Open the dashboard. The status line will tell you which leg is down (messenger, VPS, engine). Most of the time, hitting “reconnect” fixes it. If not — write to [email protected] and a real human responds within four hours during the beta.

Your agent is saying weird things

Tell it. Honest correction works better than any system prompt. If the weird thing is privacy-sensitive — a wrong fact about you — you can delete the offending memory in one tap.

Your VPS is showing red

Refresh the dashboard. If it's still red, hit “Reprovision” — it's safe; memory survives. Worst case, our team takes over with your permission.