Vellum Assistant: A Personal AI With Eight Memory Types and a Deny-by-Default Security Model

What Vellum Assistant Actually Solves

The README targets people who have tried setting up a personal AI on OpenClaw, Hermes Agent, or Claude Code and found the process slow and repetitive. Vellum Assistant claims to deliver a working assistant in one download, without the need to 'hatch a new one' repeatedly to get the behavior right. The core promise is that memory is not a SQLite file or a Markdown document you maintain yourself. Instead, the assistant extracts structured items like identity, preferences, projects, and events from conversations, with source attribution and deduplication. It is for individuals who want an assistant that remembers across multiple channels, and for developers who want a self-hostable alternative to managed personal AI products. The eight memory types are the headline feature, but the real value is that these memories are isolated per user and per channel, and each has its own staleness window.

The Eight Memory Types and How Retrieval Works

The README lists eight memory types: episodic, semantic, procedural, emotional, prospective, behavioral, narrative, and shared. Each has its own staleness window, which means the assistant treats a memory from yesterday differently from one from last year. Retrieval uses hybrid dense plus sparse methods. Dense retrieval typically means embeddings, and sparse retrieval means keyword or lexical matching. The README states that embeddings run locally by default, using ONNX, and fall back to cloud providers automatically. That fallback is a key detail: if you want strict privacy, you need to ensure the fallback is disabled or that your local setup never triggers it. The structured extraction from conversations is what turns raw chat logs into usable memory items, and source attribution means the assistant can trace a preference back to the conversation where it was stated. This is a more sophisticated approach than a simple key-value store, but it also means the system depends on the quality of the extraction model.

Identity and Proactivity: SOUL.md and the Hourly Loop

The assistant's behavior is defined in a file called SOUL.md. During onboarding, it observes how you communicate and writes its own personality files. It also keeps a per-user journal of reflections and uses NOW.md as a scratchpad for current focus and active threads. This is similar to how some agent frameworks use a persona file, but Vellum writes it automatically based on observed communication style. Proactivity runs on an hourly loop: the assistant re-reads its notes, looks for anything unfinished or due soon, and messages you if something needs attention. Notifications go to the right channel and are designed not to interrupt an active conversation. The hourly cadence is a concrete mechanism, but it also means the assistant is constantly re-reading its memory, which could be a battery or compute concern on a laptop. The README does not specify how the assistant decides what is 'due soon', so that remains a black box.

Security Model: Actor Identity, Sandboxed Tools, and Deny by Default

Security is a major section in the README. The assistant resolves actor identity once, into guardian, trusted, or unknown, and enforces that resolution everywhere. Unknown actors cannot read memory, trigger tools, or escalate. Credentials live in a separate process and never reach the model. Every tool call runs in a sandbox, and the default is to deny. This is a strong stance: it means the assistant cannot take an action unless you explicitly grant permission. For computer use, the assistant works in its own sandbox, and with your approval it can reach your actual machine to read and edit files, run commands, or drive the browser. You can grant permission once, for ten minutes, or always. The deny-by-default approach is a clear trade-off: it is safer but more tedious, because you will see prompts frequently. The separate credential process is a good design, but the README does not explain how the sandbox is implemented or how the separate process is isolated, so you need to inspect the source to verify the claims.

Channels, OAuth, and Multi-Provider Support

Vellum Assistant supports macOS, iOS, Web, Voice, Email, Telegram, Slack, and Twilio as channels. The same assistant with the same memory is reachable from all of them, and you can start a thought in one channel and pick it up in another. OAuth is handled for Slack, Notion, Google, HubSpot, Linear, Discord, Twitter, Telegram, and Twilio, with no hand-rolled token refresh. That is a practical feature because token refresh is a common source of bugs in self-hosted assistants. For model providers, it works with Anthropic, OpenAI, Google Gemini, Fireworks, OpenRouter, MiniMax, Atlas Cloud, and any OpenAI-compatible endpoint. Local models run through Ollama. The multi-provider support means you are not locked into a single vendor, but the README does not specify how model routing works or whether different memory types use different models. The embedding fallback to cloud providers is again relevant here: if you use a local model for generation, the embeddings might still go to the cloud unless you configure otherwise.

Getting It Running: CLI, Setup Script, and Hosting Modes

The quick start is a sign-up or app download, then you pick a mode: managed via Vellum Cloud or local on your machine. The CLI install is available for advanced users and non-macOS environments. To install globally, you run 'bun install -g vellum' and then 'vellum hatch'. From source, you clone the repository, run './setup.sh', source ~/.bashrc, and then 'vellum hatch'. Common commands include 'vellum wake' to start services, 'vellum sleep' to stop services but keep data, 'vellum client' for terminal interaction, 'vellum ps' to view running assistants, 'vellum terminal' to open a shell into a managed assistant container, and 'vellum upgrade' to update. All commands target the default assistant; you pass an assistant ID as the second argument for multiple assistants. The README notes that the CLI works but the desktop app is the primary focus. That is an important caveat: if you are on Linux or prefer the terminal, you are on a secondary path, and the setup script may assume a certain shell environment.

Limitations and When It Is the Wrong Tool

The most obvious limitation is the CLI's secondary status. The README explicitly says the desktop app is the primary focus, so non-macOS users and terminal enthusiasts are second-class. The managed mode requires a Vellum Cloud account, which means your data flows through their servers. The local mode still has cloud fallbacks for embeddings, so a fully offline setup is not the default. The security model is deny-by-default, which is good for safety but can become annoying if you want the assistant to act autonomously. The README does not specify the staleness windows for each memory type, so you cannot predict how long a memory persists. The hourly proactivity loop could be a resource drain on a laptop. The project is MIT-licensed, which is permissive, but you should check the license for any third-party components. The release cadence is active, with multiple versions in a week, but that also means frequent updates and potential breakage.

Alternatives: OpenClaw, Hermes Agent, and Claude Code

The README itself names OpenClaw, Hermes Agent, and Claude Code as the alternatives people have tried before. The difference is that those tools require you to set up and 'hatch' a new assistant repeatedly to get the behavior right, whereas Vellum claims to work out of the box. OpenClaw and Hermes Agent are likely more configurable, but they lack the built-in eight memory types and the deny-by-default sandbox. Claude Code is a coding assistant, so its scope is narrower. The real difference is the memory management: Vellum centralizes memory with structured extraction, while the alternatives may rely on you to maintain memory files or prompts manually. If you value a minimal setup and are willing to accept the managed runtime, Vellum is a direct competitor. If you want full control over every prompt and memory file, the alternatives may be more transparent. The README does not provide a feature comparison table, so you need to evaluate each on your own.

Maintenance and Upgrade Cost

The project has a clear upgrade path via 'vellum upgrade', and the release history shows frequent updates (v0.11.7, v0.11.6, v0.11.5 within a week). That indicates active maintenance, but it also means you should expect to upgrade often. The setup script and the CLI are the main maintenance surfaces. The README mentions that the CLI is for advanced users, so you may need to handle shell configuration yourself. The managed mode likely reduces maintenance because Vellum handles the runtime, but you lose control. The self-hosted mode requires you to manage the services, including the separate credential process and the sandbox. The MIT license means you can modify and redistribute the code, but you are responsible for any changes. Before adopting, check the documentation for how to update the memory schemas if the format changes between versions.

Editorial conclusion

Adopt Vellum Assistant if you want a personal AI that remembers across channels and you are comfortable with its managed runtime or its local setup script. Do not adopt it if you need a purely offline solution without any cloud fallback, or if you require a stable desktop app rather than a CLI that the README itself calls secondary. Before adopting, verify the staleness windows for each memory type, test the permission prompts on your actual machine, and confirm that the local ONNX embeddings meet your privacy bar. The project is MIT-licensed and actively released, but its security model depends on the sandbox and the separate credential process, so review those components before trusting it with sensitive data.

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes