Core Concepts
This page explains the foundational concepts in Atrium. Understanding these terms and their relationships will help you navigate the rest of the documentation.
Tenant
A tenant is an organization using Atrium. Everything in Atrium — sites, users, visitors, documents — belongs to exactly one tenant. Data is strictly isolated between tenants; there is no cross-tenant visibility.
In SaaS mode, multiple tenants share the same Atrium infrastructure (with full data isolation). In self-hosted mode, the deployment contains exactly one tenant.
Each tenant has a short identifier (the "slug") used during login and in URLs.
Site
A site is a physical location — an office building, a campus, a factory. A tenant can have multiple sites. Sites are the primary unit of configuration: document templates, kiosk tablets, network settings, and user assignments are all scoped to individual sites.
When you open the dashboard, you're viewing visitors for a specific site. Site-Admins and Members are assigned to one or more sites and can only see data for their assigned sites.
Visit
A visit is the central record in Atrium. It represents a single occasion of a visitor coming to a site. A visit tracks who is visiting, who invited them (the host), when they're expected, and their current status.
Every visit moves through a defined lifecycle:
pre_registered → checked_in → checked_out
↘ expired
pre_registered → cancelled
| Status | Meaning |
|---|---|
| Pre-registered | The visit has been created and the visitor has been invited. The QR code is active. |
| Checked in | The visitor has arrived and completed check-in (either via the dashboard or the kiosk). WLAN credentials have been issued. |
| Checked out | The visitor has left. WLAN sessions have been terminated. |
| Expired | The expected departure time passed without a manual check-out. Atrium automatically transitions the visit and terminates WLAN sessions. |
| Cancelled | The visit was cancelled before check-in. The QR code is invalidated. |
Visitor
A visitor is a person who visits your sites. Visitors have a profile (name, email, company) that persists across visits. When a visitor returns, their profile is reused — no duplicate data entry needed.
Visitor profiles also track which document versions they've already signed. If a returning visitor has signed the current version of your NDA, they won't be asked to sign it again.
Visitors don't have Atrium accounts. They interact with the system only through the pre-registration email (QR code, optional pre-signing) and the kiosk during check-in.
Host
A host is the person within your organization who invited the visitor. Every visit has exactly one host. The host receives a notification when their visitor checks in.
"Host" is not a separate role — any authenticated Atrium user (Tenant-Admin, Site-Admin, or Member) can be a host. The host is simply the user who created the visit or who is assigned to it.
Document template
A document template is an HTML document with placeholder variables (like {{visitor_name}} or {{visit_date}}) that gets rendered during check-in. Templates represent the documents visitors must acknowledge — NDAs, safety regulations, WiFi acceptable use policies, GDPR notices.
Templates are versioned. When you edit a template, a new version is created; the old version is preserved. This ensures that the archived PDF of a signed document always matches exactly what the visitor saw.
Templates are assigned to sites. Different sites can require different documents, in different orders.
Voucher
A voucher (or WiFi voucher) is a time-bound set of WLAN credentials (username and password) generated when a visitor checks in. The voucher is valid for the duration of the visit.
Vouchers are authenticated via RADIUS by the Atrium Agent. When the visit ends or the voucher expires, the credentials stop working and any active WiFi sessions are terminated on the firewall.
Kiosk
A kiosk is a tablet (typically an iPad or Android tablet) placed in your lobby for visitor self-service check-in. The kiosk runs the Atrium PWA in a dedicated mode.
Kiosks authenticate as devices (not as users) via a pairing process. A kiosk is bound to a specific site and can only process check-ins for that site.
Kiosks can operate offline during brief network interruptions — check-ins are queued locally and submitted when connectivity returns.
Atrium Agent
The Atrium Agent is the on-premises network component. It runs as a single Docker container on your local network and handles three things:
- RADIUS authentication — Authenticates guest WiFi connections against active vouchers.
- Session tracking — Maps IP addresses to visitors via RADIUS Accounting.
- Session termination — Sends disconnect commands to your firewall when a visit ends, using vendor-specific protocols (CoA/Disconnect-Message per RFC 5176 or vendor REST APIs).
The Agent communicates with the Atrium Server over a secure WebSocket connection (mTLS). It's stateless — if it restarts, it recovers its voucher list from the Server.
Not every deployment needs an Agent. If you don't use Atrium for WiFi provisioning, the Agent is not required.
Control Plane
The Control Plane is a background service that manages licensing, software updates, and feature flags across all Atrium deployments. Both SaaS and self-hosted instances periodically check in with the Control Plane.
As a user, you don't interact with the Control Plane directly. Its effects are visible in the admin dashboard: your license status, available updates, and which features are enabled for your tenant.