Frequently Asked Questions

Twenty questions we hear often. If yours isn't here, check Common issues or the other documentation pages.

1. What is ATHELOS?

A self-hosted command center for pentesters. It runs on your own machine and holds everything your practice touches: clients, engagements, findings, evidence, reports, invoices, and a searchable knowledge base. See Introduction.

2. Who is it for?

Solo pentesters running their own practice, small teams of two to five, and security researchers who want their client work organized in one place. See Introduction.

3. How can I run ATHELOS?

Three ways. Cloud — we host it, you sign up in a browser and start working in minutes. Self-hosted — you run the Docker image on your laptop, VPS, or server and keep everything on your infrastructure. Dedicated — we deploy on private infrastructure for you, or ship it as an appliance to your data center for enterprise and government requirements.

See Deployment options to compare.

4. Does it need internet access?

No. Once installed, ATHELOS works fully offline. The only optional feature that benefits from a connection is pulling AI models for the local Ollama runtime. Everything else — clients, engagements, findings, reports, invoices — works offline.

5. Where does my data live?

On your machine. Encrypted at rest. The database runs in Docker on your disk. Evidence files live in MinIO on your disk. Backups go to encrypted offsite storage that only you control.

Nothing is sent to any third party. No telemetry. No analytics. No cloud AI. See Security.

6. What hardware do I need?

Minimum — 4 GB RAM, 20 GB disk
Recommended — 8 GB RAM, 50 GB disk
For local AI — 8+ GB RAM for 3B models, 16+ GB for 7B

See Installation for details.

7. Can I use it with my team?

The Community and Solo tiers are single-user. The Studio tier supports up to five operators with shared engagements and evidence. The Enterprise tier has no operator cap and adds SSO, audit exports, and dedicated support.

8. Is my client data safe?

Yes, to the extent that your machine is safe. ATHELOS is designed around the assumption that you control the hardware. If your machine is compromised, nothing in the app layer can protect you.

For the threats ATHELOS defends against, see Security.

9. What AI does it use?

Local Ollama. Default models are Llama 3.2 3B (chat) and nomic-embed-text (embeddings). Everything runs on your CPU or GPU. Nothing leaves your machine.

You can swap in any Ollama-compatible model. See AI: overview.

10. Do I need AI for it to work?

No. The AI layer is optional. Every core feature — clients, engagements, findings, evidence, reports, invoicing, contracts — works without AI. If you don't install Ollama, the AI features simply hide themselves.

11. Can I customize the reports?

Yes. Reports come from one of seven templates. You edit the executive summary, methodology, and recommendations inline. Findings are auto-populated from your engagement. The letterhead is configurable.

See Generating reports.

12. How do I deliver a report to a client?

Click Create delivery link on the report. Choose an expiry (30, 60, or 90 days). Copy the URL. Send it to the client.

The client opens the URL — no login required. Every view is tracked. You can revoke the link at any time. See Delivering to clients.

13. What if a delivery link leaks?

Revoke it. Open the delivery in the Deliveries panel and click Revoke. The link stops working immediately. All future requests show "Link revoked."

Create a new delivery link if the client still needs access.

14. Can I run it on a VPS?

Yes. ATHELOS runs on any Docker-capable Linux server. Ubuntu 24.04 with 4 GB RAM is the recommended minimum. The production setup uses Caddy for TLS and Tailscale for private access.

See Installation → Production deployment.

15. Can I access it from my phone?

Yes, via your private network (Tailscale or VPN). ATHELOS isn't designed for public internet exposure — it's meant to be accessed from your own devices on a private network.

The UI is responsive and works on mobile browsers.

16. How do updates work?

Pull the latest Docker image and restart. Your data persists.

For the source-based install:

git pull
pnpm install
cd packages/db
pnpm drizzle-kit migrate
cd ../..
pnpm build

Restart the app and worker. Releases follow semantic versioning, and breaking changes are documented in the changelog.

17. What about backups?

Automated. ATHELOS backs up to encrypted offsite storage (Backblaze B2 by default) every night at 3am. Snapshots are retained 7 daily, 4 weekly, 12 monthly, 1 yearly.

Restores are tested monthly as part of the recommended operations checklist. See Scheduled backups.

18. Can I export my data?

Yes. The database is standard PostgreSQL — you can dump it with pg_dump. Evidence is in MinIO — you can copy it directly from disk. Reports export as PDF.

Every piece of data is in a standard, non-proprietary format.

19. What license is ATHELOS under?

ATHELOS is a self-hosted product. The license is per-installation, tiered by operator count (Community, Solo, Studio, Enterprise). See the pricing page for details.

The source is available for self-hosted installation. Redistribution, resale, or bundling with other products requires a commercial agreement.

20. How do I get help?

Check the docs — most questions are answered here
Check Common issues — 20 known problems with fixes
Check the logs — journalctl, docker compose logs, browser console
Open an issue — if the repo has public issues enabled
Contact support — for paid tiers, email is in the pricing page

When reporting a problem, include:

The exact error message
The action that triggered it
Your OS, Docker version, and RAM

What's not here

Common questions that didn't make the top 20 but might apply to you:

Can I use it for bug bounty work?

Yes. Treat each bounty as an engagement. Findings become submissions. Time tracking helps you know your effective rate.

Can I use it for compliance audits?

Yes. The compliance template and the report structure work for ISO 27001, SOC 2, and similar frameworks. It's not a compliance tool specifically — no control mapping, no evidence schedules — but the output fits standard audit documentation.

Can I resell access?

No, not without a commercial agreement. The license covers your own installation.

Can I run multiple instances?

Yes. Each instance is independent. Useful for separating clients with strict isolation requirements, or for testing new versions.

Is there an API for automation?

Server actions and API routes exist, but they're designed for internal use. There's no public API token system. For scripting, use direct database access via Drizzle. See Reference: API.

What happens if I stop paying for the license?

Nothing. ATHELOS doesn't phone home. The license is on your honor. Payment stops, features that were unlocked stay unlocked. Renewals are about supporting continued development, not enforcement.

Where to go next

Common issues — 20 known problems
Introduction — what ATHELOS is
Installation — detailed setup

FAQ