Using AI safely in your business comes down to selected access per employee, minimal permissions per connection, encrypted backups to a separate location in your network, and human approval for higher-risk actions. That keeps your business data inside boundaries you control.
Open-source Hermes. Independently supported by Voltti.
We configure access, backups, and review gates as part of the setup. Each needs to match the work the agent is allowed to do.
Give access to the employees you select. Grant each connection only the permissions it needs for the agreed task.
Automatic, encrypted backups to a separate location in your network.
Configure approval gates for higher-risk actions and retain logs of the work so people can review what happened.
Private access through the business network and VPN.
Access for selected employees, with the ability to revoke it.
Automatic, encrypted backups.
Selected systems with only the permissions the workflow needs.
The EU AI Act and the GDPR ask companies to manage risks, restrict which data an AI system may see, and be able to explain what the system does. The AI Act entered into force on August 1, 2024 and is being phased in. Since August 2, 2026, the transparency rules, among others, have applied. After an amendment (the Digital Omnibus), the rules for high-risk AI systems apply from December 2, 2027, and for AI in regulated products from August 2, 2028, as the European Commission’s timeline shows. The Act sorts AI systems by risk. According to the European Commission, the vast majority of AI systems currently used in the EU fall into the lowest category, with minimal or no risk. Since February 2, 2025, every business that uses AI must also take measures so its employees can work with it responsibly. That AI literacy obligation remains, although since the Digital Omnibus the law no longer prescribes a specific level of knowledge. For a small or medium-sized business, security and privacy come down to ordinary questions: who gets access, which data goes to a model, and what happens when something breaks. The four measures above line up with exactly those questions.
Under the GDPR, your business is usually the controller: you decide why and how personal data is processed. A party that only processes personal data on your instructions, such as a cloud service, is a processor, and you record those arrangements in a processing agreement. The Dutch Data Protection Authority explains the difference. We go over which party has which role with you for each setup.
Selected access and minimal permissions are data minimization in practice: the agent only sees what the task requires. That is also the core of privacy. For each connection, you decide which data the agent may read and which data may go to an external model provider.
Logging makes transparency concrete, because you can show afterward what the system did. It also lets you demonstrate that people review the work when someone asks how a result came about.
Encrypted backups to a separate location in your network limit the damage when something goes wrong.
Our safety checklist for AI and business data walks through seven points to review before installation. For the regulatory side, the European Commission’s overview of the AI rulebook and the official GDPR site are the authoritative sources.
Handled by the Voltti team, serving businesses in Belgium and the Netherlands.
| Measure | What it means | How Voltti sets it up |
|---|---|---|
Network access | The agent stays reachable inside your own network | Private access through the business network and VPN, not the open internet |
User access | You decide who gets in | Access per employee, revocable at any time |
Backup and recovery | Automatic and encrypted | Automatic, encrypted backups to a separate location in your network |
Integration boundaries | Every connection gets minimal permissions | Only the systems that add value, with only the rights the task needs |
The employees you select. Each employee gets their own access, which you can revoke at any time. Voltti does not have permanent access to your daily work; remote support is provided when you request it. We agree on the access needed for that support. Use our practical safety checklist for AI and business data as a reference.
No. Voltti does not monitor your use of Hermes or read your prompts for its own purposes. Our role is installing Hermes Agent and providing support afterward. If support does require access, we agree on that access with you in advance and use it only for the task you asked us to handle. Your data stays yours.
You choose the provider and what data may be sent to it. We advise on the setup, but you remain responsible for the provider agreements and how the service fits your processing obligations. Review its retention and data-use terms before sending business data. If certain data should not leave your network at all, a local model can handle those tasks. Also read about local and hybrid AI setups for businesses.
We put 4 practical safeguards in place: selected access, encrypted backups, limited permissions, and logging. These measures do not make every use case automatically GDPR-compliant. We discuss the processing, responsibilities, and required agreements for your situation. Under the AI Act, you also need to take measures so your employees can work with AI responsibly (AI literacy). Our checklist for safe AI use summarizes the practical measures.
On February 12, 2026, the Dutch Data Protection Authority (AP) warned about the security risks of AI agents like OpenClaw. The AP points to plug-ins containing malware, hidden commands in websites, emails, and chat messages, remote takeover, and data breaches caused by a misconfigured installation. The regulator calls on organizations not to use such agents on systems with privacy-sensitive or confidential data, and advises caution with external plug-ins and strict access controls.
This is how we limit those risks in a Hermes installation. It never runs on a publicly reachable system, but behind a firewall. Your team reaches the agent through the business network or a VPN such as Tailscale, and a channel like Microsoft Teams connects through a secured intermediate layer. Only selected employees get access, each connection gets minimal permissions, and higher-risk actions need human approval first. Hermes itself denies unknown users by default and scans skills for suspicious patterns before installation; see the Hermes security model.
These measures reduce the risk; they do not remove it. You remain responsible for GDPR compliance, and this is not legal advice.
The environment is backed up, encrypted, to a separate location in your network, never on the node itself. You agree with Voltti on how often, or you handle the backups yourself with your own IT team. If an incident occurs, Voltti helps with recovery and analysis within the agreed support scope; the logs show which actions the agent took. Read how we handle backups and recovery for an AI environment, or see our approach from pilot to support.
Your cloud model can stop mid-task because of a filter, an outage, or a limit. Here is how a local model as a fallback takes over, from our own practice.
See how Sisu runs Hermes and Home Assistant on a Raspberry Pi 5, uses local device APIs, and charges the car on surplus solar power.
See when Hermes on your own computer is enough and when a managed Linux computer is a better fit for your team and recurring tasks.
AI backup and recovery for a local AI agent: encrypted backups off the node, what happens when hardware fails, and what you can prepare.
Running AI locally? Match the computer to your model: RAM, graphics card or unified memory, NVMe offload, and current prices, with our own tests.
In a hybrid AI setup, the environment runs locally while language processing can use an external provider. See exactly what stays with you and what leaves.
A practical AI safety checklist for businesses: nine checks for tools, access, permissions, backups, and human oversight before you connect data.
Local AI, cloud AI, or hybrid? Compare where your data goes, which model a task needs, and what you pay, then pick the setup that fits your business.
