Self-Hosted Pentest Reporting.Your Infrastructure, Your Data.
Run Vulnotes fully on-prem at the same price as cloud. Your pentest data never has to leave your network, and for the most sensitive environments it never has to touch the internet at all.
curl -fsSL https://raw.githubusercontent.com/vulnotes/vulnotes-cli/master/install.sh | bash
./vulnotes init --token <provisioning-token>
./vulnotes startCloud or Self-Hosted. Both Complete.
A dedicated cloud instance in minutes, or the whole platform on your own servers. real-time collaboration and the review workflow run the same either way.
| Cloud | Self-Hosted | |
|---|---|---|
| Provisioning | Dedicated instance at yourcompany.vulnotes.app within minutes | One-command CLI install on your own servers |
| Updates | Applied automatically, managed for you | You decide when |
| Backups | Managed for you | Built-in backup and restore with one command |
| URL | Your subdomain on vulnotes.app | Your own domain or exposed localy on your network |
| Features | Every feature included | Every feature included |
Same features, same license machinery, same price either way. See pricing. Need zero connectivity? There are air-gapped editions too.
Enterprise Security and Access Control
SSO, enforced 2FA, custom roles and data scoping are part of the platform. The same controls run in cloud and self-hosted instances, and you can disable AI or run it fully local.
Single Sign-On, Six Provider Types
Missing your provider ? Contact us and it will be added.
Built-in second factors authentication
Enforce 2FA for everyone
Built from granular permissions with automatic dependency resolution
Exclude clients, templates, reports per team or user
Define the password rules your organization requires
Retention rules delete old reports automatically for compliance
Move Freely, in Either Direction
Start in the cloud and migrate on-prem later without losing data: migration is resumable and every step is recoverable. A whole-instance export keeps your data portable either way.
When On-Prem Isn't Isolated Enough: Fully Air-Gapped
Classified networks, defense and government programs, engagements where nothing may cross a boundary. For those, Vulnotes exists in two editions that assume zero connectivity, forever: licensing, updates and everyday work all happen offline.
Air-Gap Server
For disconnected networks
The full self-hosted platform on a server that never touches the internet. Same features, same reports, zero connectivity.
- License activation and renewal happen fully offline
- Updates arrive as signed bundles you carry across the gap
- Runs on your existing hardware, no TPM or dongle required
Air-Gap Workstation
For single isolated machine
The entire platform as one standalone desktop app on an isolated workstation, local database included. Nothing else to install, nothing on the wire.
- The whole stack runs inside a single desktop application
- Reports render exactly as they do on a server instance
- One activation per machine, renewed yearly through the same offline ceremony
Cryptographically signed update bundles, with delta bundles that ship only what changed
A dedicated build with external dependencies removed: no license heartbeat, no telemetry, no CDN calls
No TPM, dongle or online check needed to run licensed; hardware-backed binding is an optional uplift
Run the AI assistant against a local model on your side of the gap, or disable it entirely
Tailored to Your Environment
Every air-gapped deployment is scoped to your needs: seats, activation slots and binding matched to your constraints. Tell us about your environment and we'll come back with a plan.
