PenTest Project PenTest Project
See pricing Book a demo
Server version · Enterprise edition

Self-hosted and air-gapped penetration test reporting

Flint and Slate on one Linux host inside your network. Activated online in one step or offline by hand, then licensed and updated without the platform ever contacting us. Start with Flint or Slate and add the other later, without reinstalling.

Book a 30-minute demoSee Enterprise pricing
Built for closed networks

Your data never leaves your network. Not even for the licence check.

Self-hosted software often phones home to activate, check its licence or look for updates. The Server version does none of that unless you choose to.

Activation online or by handA single-use activation key. The installer checks it on the host, shows what it is for and changes nothing until you confirm. It then sends the request code over HTTPS and installs the licence it gets back, or, with no internet, you exchange the code and the licence by hand.
No call homeThe licence is verified on the host against keys built into the release. Flint and Slate never contact us to check it, and nothing about your installation, your users or your findings is sent anywhere.
Updates as filesChecking for updates is off until you turn it on. On a closed network your administrator imports the release list as a file; a release is downloaded only while your licence covers updates.
Signed, verified upgradesEvery release is signed. The upgrade checks the signature, size and SHA-256 of the archive, refuses downgrades, backs up the database first and runs only when your administrator starts it.
Hardened containersRead-only file systems, no privilege escalation, and every Linux capability dropped except the few a service needs. Only ports 80 and 443 are exposed.
Your data, your disksDatabase, uploads, reports and evidence live in one folder on your host, with a nightly database backup. We see none of it, and reach the instance only when you grant access for support.
What you install

Flint and Slate, one host, one command.

The release carries every image it needs, so nothing is downloaded during installation. Flint and Slate run side by side, integrated, each with its own licensed users.

Products
Flint (scoping and project management) and Slate (engagements and reporting), with the client portal
Runs on
One Linux x86_64 host with Docker Engine 24 or later and Docker Compose v2
Sized for a small team
4 CPU cores, 8 GB RAM, 40 GB disk; the database and evidence grow with use
Network
Two DNS names, one per product. Ports 80 and 443 for your users, nothing else
Included services
PostgreSQL, Redis, nginx and a nightly backup, all in the release
Certificates
Your own TLS certificate, or a self-signed one generated at install until you replace it
Email and bot protection
Both optional; the products work fully without them
AI Assist
Works with a model you host inside your network, so drafts never leave it
Installation

Four steps, licensed from the first start.

Your team installs from the release and our guide, or we do it for you. The installer can stop while you wait for the licence and continue later from where it stopped.

Book a demoPricing
  1. 1
    Enter the activation keyThe installer shows the customer, users per product, licence term and update period, and asks you to confirm.
  2. 2
    Answer a few questionsThe hostnames of the products you bought, the administrator's email, your company name and time zone. Secrets are generated for you.
  3. 3
    ActivateThe installer sends the request code to us and installs the licence, or you send the code and paste the licence yourself. It is bound to this host.
  4. 4
    StartThe products you bought come up licensed, connected to each other when you have both, and the installer prints each administrator's first sign-in.
Licensing

A licence that never holds your data hostage.

Bound to your server, clear about users, and gentle when a term ends.

Bound to one serverA copied licence does not work on another machine. Replacing one of the network card, the processor or the hostname is tolerated; moving to a new server is a transfer we carry out for you.
Users you can countEach product counts its own users. Add users any time, and clients are never counted.
Grace, then read-onlyWhen a term ends without renewal, a grace period follows. After it the instance turns read-only: everything can still be read and exported, nothing is deleted.
Questions

Self-hosting, answered.

Does the Server version need internet access?

No. Installation, activation and updates all work on a network with no internet access: the release carries its images, activation can be a request code and a licence exchanged by hand, and the list of new releases can be imported as a file.

Does single sign-on work on a closed network?

Yes, with an identity provider inside your network. Single sign-on works with any OpenID Connect provider, such as AD FS on Windows Server or Keycloak, so nobody needs a connection to Microsoft or Google. Two-step sign-in with an authenticator app needs no connection at all.

What does the platform send to PenTest Hub?

Nothing on its own. The licence is checked on your host. Checking for updates is off until you turn it on, and then it only fetches the public list of releases; nothing about your installation is sent.

Which edition includes self-hosting?

Enterprise, from 10 users. Every edition is available as the Cloud version, a dedicated instance we host in the region you choose.

How are updates applied?

Your administrator downloads a signed release, or receives it as a file, and runs the upgrade command. It verifies the signature and checksum, backs up the database and refuses to downgrade. Nothing installs itself.

What happens if the licence lapses?

A grace period follows the end of the term. After it the instance becomes read-only until the licence is renewed: your data stays readable and exportable and is never deleted.

Can we move the installation to another server?

Yes. The licence is bound to one server, so a move is a transfer: you send the new server's request code, we issue its licence and retire the old one.

Can we use AI Assist on a closed network?

Yes. AI Assist works with a model you host yourself, so write-ups and summaries are drafted without anything leaving your network.

Who installs it?

Your team, from the release and our install guide, or we install it for you as part of onboarding. Either way the stack runs on one Linux host with Docker.