Most AI-vendor reviews are about what happens to your data on their side. Self-hosted Hedy ends that conversation: there is no our side. Managed Hedy narrows it to exactly one path — model traffic through our gateway — and the table below says precisely what that means. Every control lives in code, and your auditors can read it.
Hedy runs in one of two model modes, and several claims on this page depend on which one you choose. Self-hosted / BYO is the flagship: the full stack runs on your infrastructure, with your model keys or local models. Managed exists for zero-configuration speed — and it changes the data-residency facts, so we state them per mode rather than in fine print.
| Self-hosted / BYO | Managed | |
|---|---|---|
| Model calls | Your keys, direct to your provider — or local vLLM / Ollama with no external calls | Routed through Hedy's model gateway to the model provider |
| Sub-processors | None | Hedy (gateway) and the underlying model provider — for model traffic only |
| What Hedy's side stores | Nothing — there is no Hedy side | Metering metadata (token counts, cost, model name, latency) and your credit ledger. Never prompt or response content. |
| Knowledge base, memory, audit logs | Your PostgreSQL, on your machines | Your PostgreSQL, on your machines — unchanged |
| Air-gap | Supported, with local models | Not available — the gateway needs a network path |
Hedy deploys as containers in your VPC via Docker Compose or Helm — or fully air-gapped with local models. There is no multi-tenant cloud and no shared database. In Self-hosted / BYO mode there is no Hedy-operated backend at all; in Managed mode the one Hedy-operated component is the model gateway described above.
Self-hosted / BYO: none — the list is empty because there is no list. Your data is processed by your machines under your existing agreements, and model calls go to providers you choose with your keys, or to local models with no external calls at all. Managed: two, for model traffic only — Hedy's gateway and the model provider behind it. The gateway records metering metadata and your credit ledger; it never stores prompt or response content.
Application services bind to loopback by default; only your reverse proxy is exposed. Images are version-pinned (semver, never latest).
Knowledge base, embeddings, conversation memory and audit logs live in your PostgreSQL in both modes. Backups are your scripts writing to your storage. In Self-hosted / BYO mode token metering lives there too; in Managed mode the gateway additionally keeps a metering record — token counts, cost, model name, latency — to bill credits. That record contains no content.
Credentials enter through deployment environment injection, full stop. The repository ships an example file; the agent is hard-ruled never to store credential values in memory, files or logs.
In Self-hosted / BYO mode nothing is collected by us, so nothing can be trained on; if you use external model APIs, your own provider agreement governs — and air-gapped mode removes even that. In Managed mode the gateway stores no prompt or response content, so there is nothing of yours on our side to train on. Model traffic is routed only to providers whose commercial API terms exclude training on inputs and outputs by default (Anthropic's Commercial Terms state it verbatim; provider DPA available on request) — never through opaque relay gateways, and never to providers that train on API data.
Every API — including internal service-to-service — requires authentication. Console access is role-based (admin / approver / member).
Retrieval is filtered by the asker’s clearance tags before ranking. Filtered documents are not summarized, hinted at, or counted into answers.
External-facing employees are hard-capped to the public knowledge layer and stripped of internal data tools — enforced in code, verified in tests.
Agent data queries use a database-level read-only role — not a session flag that can be toggled.
Every sensitive action class carries a tier stored in the database: L0 auto, L1 requires human approval, L2 forbidden. Prompts cannot change tiers.
Repository writes require explicitly listed projects. Code ships as draft PRs; merging is reserved for humans.
Scheduled jobs must name their destination. "Send to whoever asked last" is structurally impossible.
Every action is recorded with actor, object and reasoning. The schema has no update or delete path — not for the agent, not for admins.
Write-operation statistics aggregate what the employee did and where, so "what has it been doing?" is a dashboard, not an investigation.
Release gates include adversarial probes: salary questions from unprivileged askers, credential requests, injection-style prompts. A leak is a failed release, not a footnote.
Knowledge answers must quote their source passage verbatim; a machine check verifies the quote exists. Judges that hallucinate get overruled.
Security-relevant calls never fall back to weaker models under quota pressure — they refuse instead. Weaker models are easier to inject.
Fetched web pages, emails and documents are data, never instructions. The runtime treats embedded commands as content to report, not orders to follow.
Licences are Ed25519-signed and validate offline. No licence server phone-home.
Found something? security@hedy.one. We respond fast and credit researchers. We are a young product: we publish controls instead of badges, and your auditors can read the code.