Open-source and self-hosted ATS options in 2026, compared

Behnoud Mostafaie — Sun, 25 Oct 2026 00:00:00 GMT

If you want an open-source ATS you can self-host, you have more choice in 2026 than most roundups suggest, and the options differ more than their feature lists show. Some are dedicated applicant tracking systems, some are recruitment modules inside a full HR or ERP suite, and a few are new AI-first projects. Their licences range from MIT to AGPL, which matters if you plan to change the code.

This guide compares nine of them. We wrote it as the people behind Vekt, one of the nine, so read our section with that in mind. To keep it fair, every licence below was read from the project’s own repository on 25 October 2026, every other fact links to its source, and each section says who the project suits best, including where that isn’t us.

The short answer

Project	Best for	Licence	Stack	Scope	Last commit on main*
OpenCATS	A classic ATS on PHP hosting	MPL 2.0	PHP, MySQL	Dedicated ATS	22 Oct 2026
FreeATS	A conventional ATS with an optional hosted plan	MIT	Ruby on Rails, Docker	Dedicated ATS	13 Oct 2026
Vekt	AI screening with human review and data deletion, EU teams	MIT	Next.js, SQLite, Docker	Recruiting platform	18 Oct 2026
Vellum	An AI-first ATS with a shared inbox	AGPL 3.0	Next.js, PostgreSQL, Docker	Dedicated ATS	4 Aug 2026
Horilla	One open-source system for all of HR	LGPL 2.1	Django, PostgreSQL, Docker	HR suite	21 Oct 2026
Frappe HR	Teams already on ERPNext	GPL 3.0	Frappe (Python)	HR suite	25 Oct 2026
OrangeHRM	An established HRIS with recruitment	GPL 3.0	PHP	HR suite	29 Jun 2026
Odoo Recruitment	Teams already on Odoo	LGPL 3.0 (Community)	Python, PostgreSQL	ERP module	Very active
Recruit (OSSAdmiral)	Laravel developers who want a base to build on	AGPL 3.0	Laravel, Filament	Dedicated ATS	13 Nov 2024

*Date of the latest commit on the default branch, checked 25 October 2026. Odoo’s main repository was not checked commit by commit; it receives changes daily.

How we compared them

Five questions decide whether a self-hosted ATS works for a team:

Licence. Can you change the code without publishing your changes? MIT, MPL and LGPL are permissive enough for most in-house changes; GPL and AGPL ask you to share modified source in some situations (see the licence note below).
Scope. Do you want a dedicated ATS, or recruitment as one module of an HR or ERP system?
Hosting effort. Is there a maintained Docker setup, or do you assemble a LAMP or Python stack yourself?
AI and data. If the tool uses AI on CVs, which providers can it use, can it run on a local model, and what happens to the data?
Upkeep. Is the project actively maintained, and does it say whether it is ready for production?

OpenCATS

OpenCATS is the name most people know when they search for an open-source ATS. It is a dedicated applicant tracking system written in PHP with MySQL, and it includes a careers page. The repository has a docker folder, and the project is still receiving commits in October 2026.

The licence is split: OpenCATS code is under the Mozilla Public License 2.0, while the original CATS code it grew from is under its own licence (both explained in the repository’s LICENSE.md).

Best for: teams and agencies that want a classic ATS feature set and are comfortable hosting PHP. Try a test install first to check that its interface fits how your recruiters work today.

FreeATS

FreeATS is an MIT-licensed ATS built with Ruby on Rails, with a Docker Compose setup for self-hosting. It also sells a hosted version: on its site today, the free cloud plan allows 3 open positions and 3,000 candidate profiles with unlimited users, and Pro costs $99 a month.

Its feature list is that of a conventional ATS: custom pipelines, scorecards, a LinkedIn import browser extension, email sync, tasks, duplicate detection and a career site.

Best for: small teams that want a familiar ATS and like having a hosted plan to fall back on.

Vekt

Vekt is our project: an MIT-licensed, self-hosted recruiting platform built with Next.js, SQLite and Inngest for background jobs, deployed with Docker Compose. It covers job listings, a careers page, applications with screening questions, a candidate pipeline and candidate emails.

What sets it apart is how it handles AI and personal data. CVs can be scored by OpenAI, OpenRouter or a local model through Ollama. Names, contact details and other direct identifiers are removed from the CV text before any model sees it. A low score never rejects anyone on its own: those candidates are marked needs review until a recruiter decides. Every evaluation records the provider, model, prompt hash and evaluator version, and a daily job deletes candidates and their CVs once the retention period you set has passed.

We also publish what its AI can’t do: the scores have never been measured against real hiring outcomes, so Vekt claims no accuracy figure.

Best for: teams hiring in the EU that want AI screening with a human in charge, candidate data on their own servers, and code they can read.

Not a fit: if you need interview scheduling, job-board multiposting or single sign-on today. Vekt has none of these yet.

Vellum

Vellum describes itself as “an open-source, AI-first applicant tracking system”. It is built with Next.js, PostgreSQL and Prisma, and ships a Docker Compose setup that includes a reverse proxy. Its README lists a hiring pipeline, branded career sites, a shared inbox, multi-tenancy, and “bring-your-own (or local) AI”.

The README marks its own status as an “actively developed MVP”. It is licensed under the AGPL 3.0.

Best for: teams that want a modern, AI-first ATS with a shared inbox and are comfortable with an MVP and the AGPL’s terms.

Horilla

Horilla is a complete open-source HR system: recruitment sits next to onboarding, employee records, attendance, leave, payroll, helpdesk and more. It is built with Django and PostgreSQL, has Docker Compose files, and is licensed under the LGPL 2.1.

Best for: organisations that want one open-source system for all of HR, with recruitment as one part of it.

Frappe HR

Frappe HR is the HR and payroll app of the Frappe and ERPNext ecosystem, licensed under the GPL 3.0. Recruitment covers job openings, applicants and interviews, inside the same system as the rest of HR.

Best for: companies already running ERPNext, or happy to adopt the Frappe framework.

OrangeHRM

OrangeHRM is a long-established HR system written in PHP. The open-source edition, under the GPL 3.0, includes a recruitment module; the company also sells paid editions with more features.

Best for: teams that need an HR information system first and recruitment second.

Odoo Recruitment

Recruitment is one of the apps in Odoo, the open-source ERP. The Community edition is licensed under the LGPL 3.0; some features are part of the paid Enterprise edition only.

Best for: businesses already running Odoo, where recruiting next to accounting, sales and HR outweighs having a dedicated ATS.

Recruit (OSSAdmiral)

Recruit is a corporate recruitment system built with Laravel and FilamentPHP, under the AGPL 3.0. Its README says it is “under hard development and not yet ready for production”, and its last commit on the default branch was in November 2024.

Best for: Laravel developers who want a starting point to build their own recruiting tool, rather than a finished product.

What the licences mean in practice

All nine are open source, but they ask different things of you if you change the code:

Licence	Who uses it here	If you modify the code and run it internally	If you offer your modified version to others over the web
MIT	Vekt, FreeATS	No obligations beyond keeping the notice	Same: no obligation to publish
MPL 2.0	OpenCATS	Fine	Changed files must stay under the MPL if you distribute them
LGPL 2.1 / 3.0	Horilla, Odoo Community	Fine	Mainly affects distributing modified copies
GPL 3.0	Frappe HR, OrangeHRM	Fine	Distributed copies must include the source
AGPL 3.0	Vellum, Recruit	Fine	You must offer the modified source to the users of your hosted service

This is a summary, not legal advice. If you plan to build a product on top of any of these, read the licence itself.

Some ATS products, open source and hosted, describe themselves as GDPR-compliant. No software is compliant on its own. Self-hosting lets you decide where candidate data lives and when it is deleted, but the lawful basis for processing, the privacy notice, the DPIA and your answers to candidate requests are still your organisation’s work.

If an ATS uses AI to screen applications, that is also a high-risk use under the EU AI Act. We explain what that means on our AI Act page and what GDPR asks of a hiring system on our GDPR page.

How to choose

You want a dedicated ATS and a familiar workflow: start with OpenCATS or FreeATS.
You want AI screening, but with a human deciding and the data under your control: Vekt, or Vellum if a shared inbox and multi-tenancy matter more to you.
You want recruiting inside a full HR or ERP system: Horilla, Frappe HR, OrangeHRM or Odoo, ideally whichever matches what you already run.
You want a codebase to build on: pick by language and licence first. MIT gives you the most freedom.

Whichever you pick, run it with real job postings for a week before you move live candidates into it.

FAQ

What is the best open-source ATS?

There isn’t one best option; it depends on scope. For a dedicated ATS, OpenCATS and FreeATS are the most established. For AI screening with human review and automatic data deletion, Vekt. For recruitment inside a full HR suite, Horilla, Frappe HR, OrangeHRM or Odoo.

Which open-source ATS is easiest to self-host?

The projects with a maintained Docker Compose setup: Vekt, FreeATS, Vellum and Horilla. Vekt also has a one-line setup script that generates secrets and starts everything.

Is there a free open-source ATS with no user limits?

Yes. Self-hosted open-source software has no seat limits: Vekt, OpenCATS, FreeATS’s self-hosted version and the others here all let you add as many users as you like. Limits only apply to hosted plans, such as FreeATS Cloud.

Can an open-source ATS use AI without sending CVs to OpenAI?

Yes, if it supports a local model. Vekt can score CVs with a model running in Ollama on your own hardware, and Vellum also supports local AI.

What’s the difference between a self-hosted ATS and an open-source ATS?

Self-hosted describes where it runs: on your servers. Open source describes the licence: you can read and change the code. Most tools here are both, but a hosted service can be open source, and some proprietary software can be self-hosted.

Found an error, or a project we should add? Open an issue on GitHub and we will update this page.

Why we publish what Vekt's AI can't do

Behnoud Mostafaie — Sun, 25 Oct 2026 00:00:00 GMT

Vekt is an open-source recruitment orchestration engine for privacy-first hiring. It runs on your own servers, structures how candidates are evaluated, and uses AI to rank applications against the job description so a recruiter knows what to read first. It does not decide who gets hired.

Before the feature list, the repo has a compliance folder that names what the AI scoring can’t do. This post explains those four limits and why they come first.

Why lead with limits

In the EU, using AI to screen job applications is classed as a high-risk use under Annex III of the AI Act. Those obligations now apply from 2 December 2027, after the Digital Omnibus moved the original date. GDPR already applies today: candidates have rights over decisions based solely on automated processing, and they have to be told how their data is used.

It is easy to answer that with a “compliant” badge. We think a tool in this space should be easier to question instead, and that starts with saying plainly where it falls short.

Limit 1: no accuracy has been measured

Vekt has never been tested against a labelled set of CVs and hiring outcomes. There is no precision, recall or agreement-with-reviewer figure. Any number we gave you today would be invented.

If a vendor gives you an accuracy figure, ask what it was measured on, and whether it was measured on hiring like yours.

Limit 2: redaction removes names, not every clue

Before any text reaches the model, Vekt removes direct identifiers: name, email, phone, links, date of birth, and lines that state nationality, citizenship, marital status or gender.

It does not remove proxies. University names, languages spoken, military service, career gaps and writing style can all carry signals of origin, age and gender, and a language model can pick them up. Redaction reduces the risk; it does not remove it. That is why a person makes the final call.

Limit 3: scores aren’t comparable across setups

The score comes from a general-purpose language model asked for a number from 0 to 100. Change the model, the provider or the prompt, and the same CV gets a different number. Even the same CV scored twice can drift by a few points.

So scores are only comparable within one configuration, and the threshold you choose sits on a noisy signal. Write down why you picked it.

Limit 4: running it yourself doesn’t make you compliant

Self-hosting answers one important question: where the data is. With a local model, CV text never leaves infrastructure you control. With a hosted provider such as OpenAI or OpenRouter, the redacted text does go to that provider, which becomes a processor and possibly a transfer outside the EU.

What self-hosting does not answer is whether your hiring process is lawful and fair. That depends on your criteria, your human review, what you tell candidates and how you handle their requests. Those stay with the organisation that hires.

What we’re doing about it

The biggest gap is the first one. We’re looking for two or three EU organisations willing to measure Vekt on their own past applications, on their own servers, with their data never leaving them. We’ll help set it up, and with your agreement the method and aggregate results get published, so the next team doesn’t start from zero.

If that’s you, open an issue on GitHub or message us on LinkedIn.

Vekt blog