What is atreoLINK?

atreoLINK is secure remote access for your home server, with native apps for the whole family. It gives your server a custom subdomain (yourname.atreo.link) with automatic HTTPS, then lets you and the people you invite connect through a WireGuard tunnel built into the mobile and TV apps. (The browser dashboard generates QR codes and wg-quick configs for any other device that runs WireGuard.) Notifications are encrypted end to end and reach phones and browsers.

The product has three pieces. You’ll usually only think about one of them at a time.

Piece	What it is	Who runs it
atreoLINK web app	The dashboard at app.atreolink.com. Sign up, pair a server, manage apps, invite members, receive browser notifications.	Hosted by atreoLABS.
atreoLINK app	Native app for iPhone, iPad, Android, Apple TV (tvOS), and Android TV (including Fire TV gen 3 and newer). Connects to your server with one tap; mobile builds also receive push notifications.	Installed by invited members.
atreoAGENT	A small Docker container that runs on your home server. Terminates WireGuard, serves HTTPS, enforces per-app access, encrypts notifications.	Self-hosted by the server owner.

How it fits together

flowchart LR
  Client["Mobile / TV /<br/>Browser app"]
  Cloud["atreoLINK<br/>coordination"]
  Server["Your server<br/>running atreoAGENT<br/>in Docker"]
  Client -- "1" --> Cloud
  Cloud -- "2" --> Server
  Client -. "3 — Direct WireGuard tunnel,<br/>encrypted end to end" .-> Server

1. The clients and the server agent both maintain a control connection to atreoLINK.
2. atreoLINK coordinates pairings, member invites, and per-app access.
3. Once connected, the client talks directly to your server over an encrypted WireGuard tunnel. atreoLINK relays encrypted notification payloads and routing metadata, but app traffic and notification contents are unreadable to it.

What you can do with it

• Open homelab apps from anywhere. Jellyfin, Immich, Home Assistant, your dashboard, your file shares, all at https://appname.yourname.atreo.link.
• Use your own domain. The Pro plan can serve apps under *.your-domain.com instead of, or alongside, the default subdomain.
• Native apps for phones, TVs, and browser. Same account, same access on every device.
• Share with family and friends without exposing your self-hosted apps directly to the internet. You generate an invite link and share it yourself with each person; pick which apps each one can access. They install the app and that’s it.
• Push notifications from your apps. Backup finished, disk filling up, doorbell rang. Notifications carry HTML bodies so reports and dashboards keep their formatting, encrypted end to end on phones and browsers. atreoLINK delivers them; it can’t read them.
• Any self-hosted app can send notifications. The agent’s built-in SMTP relay turns emails from anything that supports email (Synology, Vaultwarden, Pi-hole, your NAS, your router) into encrypted push notifications. No webhook or API integration required.

Privacy by design

atreoLINK splits into a control plane and a data plane, and the two see very different things.

The data plane is end to end encrypted. Your apps’ traffic flows over a WireGuard tunnel established directly between your devices and your server. When a direct connection isn’t possible — for example behind carrier-grade NAT — it falls back to a blind relay that forwards the same encrypted packets without being able to read them; the relay sees only metadata (addresses, timing, volume), never content. Notifications are encrypted to your identity key before they reach atreoLINK, so it only ever forwards opaque ciphertext it can’t decrypt.

The control plane holds the minimal coordination metadata needed to broker those connections — and nothing about your traffic. To set up pairings, member invites, and per-app access, atreoLINK stores things like your account record, which apps you’ve defined and which members you’ve granted access to, members’ public keys, the routing and push-delivery metadata needed to reach each device, and any custom-domain configuration. It does not hold your password, your identity private keys, your app traffic, or your notification contents.

Concretely, here’s what stays off atreoLINK’s servers entirely:

• Your password never leaves the browser or app. It’s processed on your device, and only a derived key is sent to the server.
• Your identity private key is encrypted under your password before it’s stored. atreoLINK keeps the encrypted blob; only your devices can unwrap it.
• atreoLINK relays signed messages between you and your agent, but it can’t verify or forge those signatures. The agent does that itself, against pubkeys it pinned at pair time.
• App-traffic and notification contents are encrypted before they reach the relay. Browser notifications add a second encryption layer on top.

You can read more in Encryption and Authentication.

Get started

I got an inviteInstall the app, accept the invite, and start using the server you were invited to.

I'm setting up my own serverInstall atreoAGENT on your server, pair it to your atreoLINK account, and invite family and friends.