Overall risk · high
jurisdictionhigh
US-incorporated entity fully exposed to CLOUD Act compulsion and likely FISA §702 orders. No EU legal entity or EU data-processing infrastructure identified, and no SCCs or adequacy-based transfer mechanism published.
compliancehigh
No EU AI Act compliance statement, GPAI Code of Practice signature, or structured Article 53 transparency template found, despite GPAI obligations having been enforceable since 2 August 2025.
privacyhigh
The Nous Portal privacy policy has previously stated that user conversation data is collected and used to train models, with no GDPR lawful basis, DPO, or opt-out mechanism described. EU enterprises using the hosted portal (as opposed to self-hosted weights) face direct data-transfer risk.
compliancehigh
Hermes models are deliberately designed with minimal content guardrails, scoring far higher than mainstream aligned models on the RefusalBench benchmark. EU regulated-sector deployers must add their own content-governance and output-filtering layer.
securitymedium
No SOC 2, ISO 27001, or equivalent security certification, and no formal bug bounty or responsible disclosure programme found published anywhere on the official site.
compliancelow
Hermes 4 fine-tunes are subject to the Meta Llama Community Licence (restricting training of competing foundation models and imposing a commercial MAU threshold); Hermes 4.3 and NousCoder-14B carry separate ByteDance Seed and Qwen licence terms respectively, creating a fragmented licensing landscape for redistribution or fine-tuning.
Stav’s assessment
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.