Haven vs OpenClaw

Haven

Haven answers by phone call, text, email and app, is free in beta with no card, and publishes a status page with dated incidents. No public page read says which actions need approval, which accounts it connects or how their tokens are kept, and it names no model provider or sub-processor.

OpenClaw

Self-hosted under the MIT licence, with state, memory and credentials kept on the owner's machine and no paid tier. A fresh install runs tools on the host with full access, no approval prompt and no sandbox, and the project has published 722 security advisories since January 2026, 14 of them critical.

Haven

1. Haven has no documented API or MCP server. An outside agent can reach it only through the owner's channels (call, SMS, email, app).
2. Do not assume an approval step before Haven sends mail, texts or calls. None is documented on the public pages.
3. Email Haven sends to other people names Hello Haven as sender and says it was sent on the user's behalf, per the terms.
4. Chat messages, history, profile context and uploaded files go to third-party AI model providers that the vendor does not name.
5. Check status.hellohaven.ai before relying on phone or voice. All four published incidents affected those channels.

OpenClaw

1. Set a session permission mode of guarded or workspace, or tools.exec.mode, before connecting mail. The default runs host commands without approval
2. Turn on agents.defaults.sandbox for any agent that reads mail, web pages or attachments. Sandboxing is off by default
3. Set tools.message.crossContext.allowAcrossProviders and allowWithinProvider to false to confine sends to the current conversation
4. Route incoming mail to a restricted reader agent, as the IMAP and Gmail guides show, and deny gateway, cron, sessions_spawn and sessions_send for it
5. Run openclaw security audit after setup, and treat the Gateway token as an owner credential. POST /tools/invoke accepts it with full operator access