Buying managed open-source apps from a Swiss supplier

A Swiss counterparty, a standard DPA, a security pack ready for your file and invoices in CHF or EUR. Everything a tender or a supplier review asks for, in writing.

Start with one workload Book a 30-minute briefing

Counterparty: Pilae SA, Lausanne
Invoicing: CHF or EUR
Contract law: Swiss law by default
Pricing: Fixed quote after a scoping call

What goes into your supplier file

A supplier review stalls on missing documents, not on the software. We send the full set at the start, so your legal, security and finance reviewers work in parallel.

A Swiss company

Pilae SA is a Swiss company registered in Lausanne. You contract with one entity, under Swiss law, for the operations and, in Pilae Cloud, the hosting.

Invoices in CHF or EUR

You choose the currency when you sign. Recurring fees are invoiced on a fixed schedule, and onboarding is a fixed price agreed before work starts.

Standard DPA

One agreement under the revised FADP and the GDPR, with the technical and organisational measures attached.

Security pack

An architecture and security overview, our controls built to ISO 27001, the DPA, the sub-processor list and your questionnaire answered by an engineer.

Exit plan in writing

Every plan includes a written exit plan: your data back in open formats, the configurations handed over, and deletion confirmed.

Service levels you can cite

A 99.9% monthly availability commitment with service credits on every plan, and response times per plan, all in the SLA.

One supplier, one contract, one file

Buying software operations often means three contracts: the licence, the hosting and the people who run it. With Pilae you sign one. Pilae SA operates the apps, the machines and the network, under Swiss law, from Rue de Bourg 27 in Lausanne. The apps themselves are open source or source-available, so most need no licence purchase at all, and the proposal names any app whose licence calls for its own agreement with the publisher.

The contract names where your data lives: your premises, or dedicated machines in any of 12 Pilae Cloud regions, six of them in Switzerland and the EU, with new locations provisioned on request. Backups go to a second site in the same jurisdiction. Changing that location needs your written agreement.

Documents your reviewers ask for

Your legal team gets the standard DPA and the sub-processor list. Your security team gets the security pack, our certifications and controls and a completed questionnaire. Your finance team gets a fixed quote in CHF or EUR. Everyone reads the same SLA and acceptable use policy.

We answer questions in writing, so the answers can go straight into your award file. For questions on data protection, write to privacy@pilae.com. For security, write to security@pilae.com.

Public tenders

Pilae answers calls for tenders and invitation procedures from Swiss and European public bodies, including procedures under the WTO Government Procurement Agreement, the federal procurement act (BöB/LMP) and the intercantonal agreement (IVöB/AIMP). The public sector page covers the procedures and the hosting options that award files usually require.

Leaving is part of the deal

Supplier risk is easier to accept when the exit is written down. Every plan includes a written exit plan: the data export in open formats, the handover of configurations and the confirmed deletion from machines and backups. To start a review, tell us about your project.

From request to signed contract

Scoping call
Thirty minutes with an engineer on the apps, the users, the hosting location and your procurement timeline.
Documents
We send the security pack, the standard DPA, the SLA and the acceptable use policy, so your reviewers can start at once.
Fixed quote
A written proposal in CHF or EUR: fixed-price onboarding, recurring operations and any migration or SSO work, itemised.
Review
We answer your questionnaire, join calls with your security and legal teams, and negotiate terms on Enterprise plans.
Sign and onboard
The contract and the DPA are signed before any data moves. Onboarding starts on the date in the proposal.

What every contract includes

Data processing: The standard DPA, signed at onboarding, with advance notice of any sub-processor change and a right to object.
Audit rights: Your right to audit our controls yourself or through an independent auditor you appoint.
Audit trail: Every change and access in the console, exportable to your SIEM.
Backups: Daily encrypted offsite backups in the country you choose, with a restore test every month recorded in the console.
Availability: 99.9% per month, with service credits if we miss it.
Exit: A written exit plan, with your data returned in open formats and deletion confirmed.
Enterprise terms: Negotiated contract terms, a named engineer, around-the-clock incident response, and multi-site or air-gapped deployment.

The apps behind it

Nextcloud

Files, calendars and shared documents for the whole organisation, on storage you can point at in a room you control.

Replaces Google Drive, Dropbox, SharePoint

Keycloak

Single sign-on for everything else you run, with your own directory as the source of truth and no per-seat bill between you and it.

Replaces Okta, Microsoft Entra ID

Open WebUI

A chat interface over models you host, so prompts and the documents people paste into them never leave your network.

Replaces ChatGPT Team, Microsoft Copilot

n8n

Workflow automation your own team writes, running next to the systems it talks to instead of reaching them across the internet.

Replaces Zapier, Make

Questions

Can Pilae answer a public tender?

Yes. Pilae SA is a Swiss company registered in Lausanne. We answer open, selective and invitation procedures and prepare the declarations and supporting documents the tender asks for. Swiss procedures are priced in CHF; a procedure run in euros is priced in EUR.

Which currencies do you invoice in?

Swiss francs or euros, chosen at signature. The currency, the billing schedule and the fixed onboarding price are all stated in the proposal.

What is in the security pack?

An architecture and security overview, the description of our controls built to ISO 27001 and mapped to the NIST Cybersecurity Framework, the standard DPA with its technical and organisational measures, the sub-processor list and the hosting locations. We also complete your own questionnaire, in your format.

Does Pilae hold ISO 27001 certification?

Pilae SA holds no certification of its own today. Our controls are built to ISO 27001, Pilae Cloud runs in ISO 27001-certified datacentres in the region you choose, and your contract gives you the right to audit us.

How are sub-processors handled?

Through the DPA. Sub-processors are disclosed to you in the signed agreement, each one is bound by the same data protection obligations, and you get advance notice of any change with a right to object.

How is pricing set?

Pricing is on request. After a scoping call we send a fixed quote that itemises onboarding, recurring operations and any migration, SSO or consulting work.

Are the apps locked to Pilae?

No. Every app in the catalogue is open source or source-available, and the written exit plan in every contract covers how your data and configurations come back to you or to your next operator.

Trust

Need the documents for your file?

Write to hello@pilae.com or book a call. We send the security pack, the standard DPA and the SLA, then a fixed quote in CHF or EUR.