Under the hood
One platform, from bare server to busy website
Ateculus isn’t a control panel on top of someone else’s hosting. We build and run the whole stack: the servers, the software that sets them up and watches them, the backups, and the control panel you use. Here is how it works.
12–15 min
From a click in our panel to a new web server that is built, hardened and checked in, ready for websites. Measured on our last four.
2,800+
Automated tests run on every change to the platform’s code before it can ship.
Hourly
The control panel itself is backed up, encrypted, off the server. We’re alerted if two hours pass without a good copy.
38
Operations the agent on our servers can be asked to do. It has no remote shell to break into.
Architecture
How it fits together
Three kinds of server and one small program on each of them, all run by us.
Visitors
Your website’s visitors, in any browser.
Edge servers
The public front door. They hold the HTTPS certificates and pass visitors to the right web server.
Agent a small Go programWeb servers
Where websites run: nginx, PHP-FPM (PHP 8.4 and 8.3), MariaDB and a locked-down SFTP. Each website has its own Linux user and PHP pool. They take web traffic only from the edges and the control panel.
Agent a small Go programYou and your team
Sign in to the control panel.
The control panel
Our own software (Laravel and PostgreSQL), written from scratch. It keeps the records, plans every change and runs its own certificate authority for the servers. It never connects in to a server: each agent calls out to collect its jobs and runs them one at a time, in order.
Provisioning
A new server in about 12 to 15 minutes
Adding capacity is a click in our panel, not a weekend of setup. Every server is built the same way, by code.
1. We click
Our panel asks the cloud provider for a server. Every request carries a one-time key, so a retry can never create two.
2. It builds itself
On first boot it runs our Ansible roles: every update installed, automatic security updates, key-only SSH, a deny-by-default firewall, fail2ban, PHP, disk quotas and the SFTP jail.
3. It enrols
The agent swaps a one-time token for its own certificate from our certificate authority. Certificates last a year and renew themselves.
4. It takes websites
It is hardened at its first check-in and only then gets websites, and only while it has memory to spare.
Measured from our panel’s own records for the last four web servers we added: 12 to 15 minutes from the click to the first check-in.
Engineering
How changes ship
Every change to the platform is tested twice before it reaches your website: by machines, then in our lab.
- 2,800+ automated tests (the control panel and the server agent) run on every change, on GitHub Actions
- A lab of virtual servers built the same way as production, with the same roles and the same server-creation path, where changes are tried first
- Nothing deploys itself: production updates only when we press Pull Updates, and the update runs from its own protected copy of the code
- Server agent updates are signed; a server installs only builds that verify, and an earlier build can be put back
- Web server changes are checked first, then reloaded gracefully, so visitors aren’t cut off
- What changed is written up in What’s New in your control panel
Watching it run
- Every server reports in; one that goes quiet is flagged within minutes
- Alerts go straight to our engineering channels: failed backups, expiring certificates, a server that never checked in
- Every night each server is compared with our records, so nothing missing or left over goes unnoticed
- nginx and PHP restart themselves if they ever stop
- Operating system updates run from our panel, with the live log
- You see your place in line when a change is queued for your website
Backups and recovery
Built to be put back
Backups only matter if they restore. Ours are encrypted before they leave the server and kept somewhere else.
Your website
- Daily, weekly or monthly, your choice
- Your files and databases, encrypted with AES-256 using a passphrase you set, before they leave the server
- Stored off the server, in separate object storage
- 7 to 55 copies kept, depending on your plan
- Restore a copy yourself, in one click, from the control panel
- If a backup fails, we’re told straight away
The platform itself
- The control panel is backed up every hour, encrypted, off the server, with the newest ten kept
- An alert if two hours pass without a good backup
- A full rebuild of the control panel from a backup is rehearsed, and every server reconnects to the rebuilt panel on its own
- Websites move between servers with a step-by-step process that can roll back, and the old copy is kept for 7 days
Security
Every website in its own box
Your neighbours on a server can’t see your files, use up your share, or reach your database.
Isolation
- Each website has its own Linux user and its own PHP pool
- PHP is kept to the website’s own folder, with private temp files and sessions
- Dangerous PHP functions are switched off
- SFTP and SSH logins are locked inside the website’s folder
Fair shares
- Each website has its own CPU, memory and process limits, set by its capacity
- Disk quotas per website
- Other users’ processes are hidden on the server
- Uploaded files can’t run as PHP
Your account
- Two-factor login for everyone, and a fresh code every time a console opens
- A second check before sensitive changes, and an audit log
- Limits on login attempts and two-factor guesses
- A full security review of the platform in October 2026, every fix shipped with a test
Everything included
The whole platform, as a list
What you get today. If it isn’t on this list, we don’t claim it.
Websites
- WordPress, Joomla and Drupal installed for you
- Laravel ready to run, or plain PHP
- PHP 8.4 or 8.3 per website
- MariaDB databases (PostgreSQL on request)
- A temporary address while you build
- Password protection for any website
- Free WordPress migration plugin
Developer tools
- A website console in your browser: WP-CLI, Composer, Git and PHP
- A database console in your browser
- SFTP, switched on when you need it
- SSH with your own keys, from addresses you approve
- Scheduled tasks (cron)
- Staging with a 7-day undo (Grow, Scale and Pro)
Domains and SSL
- Your own domain, with extra domains per plan
- www added automatically, and your choice of www or not
- DNS records managed in the control panel
- Free Let’s Encrypt certificates that renew themselves
- Or upload your own certificate
Capacity and limits
- Standard, Extra and Max capacity: 3, 5 or 8 PHP workers
- CPU, memory and process limits per website
- Storage and bandwidth shown against your plan
- Change plans whenever you need
Your account
- Two-factor login
- Team logins with their own permissions
- Groups, and which websites each person can see
- Support tickets to the right team
- Invoices, payment methods and a clear billing history
- Light and dark mode
Agencies
- One shared resource pool per agency, for all its clients
- Your own hosting packages for clients
- A portal with your name and colours, on your own domain
- Client logins that see only their own websites
- Dedicated servers for agencies
Not included: email hosting and domain registration. Keep your current email and registrar; we’ll point your domain here.
See it for yourself
Pick a plan, add your domain, and your website is built as soon as checkout completes.
Currently available to customers in the United States.