Control plane for self-hosted apps: one console for your whole estate

Apps, machines, deployments, backups, logs and the audit trail in one console, with roles for each person and single sign-on through your identity provider.

Start with one workloadBook a 30-minute briefing

Covers
Apps, machines, deployments, backups, logs, audit
Sign-in
Single sign-on through Keycloak or Entra ID
Access
Roles per person, per environment
Audit trail
Every login, approval and change, exportable to your SIEM

Everything you run, on one screen

A self-hosted estate usually lives in a dozen places: a spreadsheet of servers, a wiki page of passwords, a backup script nobody reads. The console puts it in one place and keeps it current.

Apps and versions

Each app, its version, its machine, its URL and its health. Pending updates and advisories sit next to the app they affect.

Machines

Every machine on your premises or in Pilae Cloud, with its region, size, operating system and live metrics.

Deployments and changes

Each plan from the Pilae Agent, its approval, its run and its result. Approve or decline from the same screen.

Backups and restore tests

The last backup of every app, where it is stored, and the result of each monthly restore test.

Logs

Application and system logs stay on the machines that produced them, in your contract region. The console reads them there on demand and never stores a copy.

Roles and single sign-on

Staff sign in with the account they already have. Each person sees and approves only what their role allows.

One console instead of a dozen tools

Running self-hosted apps yourself usually means a server list in a spreadsheet, credentials in a wiki and backups nobody has checked. The Pilae console replaces all three. It shows every app you run, where it runs, what version it is on, when it was last backed up and what changed last.

The console works the same for apps on your premises, in Pilae Cloud or across both. One screen, one set of roles, one audit trail.

Approvals where your team already works

The Pilae Agent writes a plan for every update, migration and fix. The plan lands in the console, with the backup it will take and the rollback. The approver reads it and decides. Approvals also work by email and in chat, and each one is recorded against the person who gave it.

Access control your security team can sign off

Staff sign in through your identity provider, Keycloak or Microsoft Entra ID. Our identity service sets up the connection during onboarding. Roles decide who can see and approve what. When someone leaves, disabling their account in your directory removes their access to the console.

Every login, approval and change is written to the audit trail. Your auditors can read it in the console or receive it in your SIEM. The security page lists the controls behind it, and the shared responsibility model sets out who does what.

Backups and health, in plain sight

Each app shows its last backup, where it is stored and the result of its monthly restore test. Monitoring feeds probe results and machine metrics into the same screen. Our backup page covers the schedule and retention, and your contract sets the recovery objectives. To see the console on your own stack, book a scoping call.

How your team uses the console

  1. Connect your identity provider

    We link the console to Keycloak or Entra ID, so your staff sign in with their usual account and leave when they leave.

  2. Assign roles

    You decide who can view, who can approve changes and who administers each environment.

  3. Review and approve

    Plans from the agent arrive in the console, by email or in chat. The approver reads the plan and says yes or no.

  4. Audit

    Your security team reads the trail in the console or receives it in its SIEM, per app and per person.

What your contract includes

Console access
For every person you name, with the roles you set.
Single sign-on
Connection to your Keycloak or Entra ID, set up during onboarding.
Audit trail
Retained for the length of the contract and exported on request.
Log forwarding
Audit and application logs forwarded to your SIEM or log platform when you ask for it, in a format agreed with your team.
Location
The console runs in the region named in your contract and receives health signals and deployment status, never application data. For air-gapped deployments it runs inside your perimeter.

The apps behind it

Questions

What can I see in the Pilae console?

Every app you run with Pilae, the machine it runs on, its version and health, the changes planned and applied, the last backup and restore test, the logs and the full audit trail.

Does the console support single sign-on?

Yes. Your staff sign in through your identity provider, Keycloak or Microsoft Entra ID. Access ends when the account is disabled there.

Can I limit what each person can do?

Yes. Roles decide who can view, who can approve changes and who administers each environment. A finance approver can see their apps without seeing the research cluster.

Can I export the audit trail to my SIEM?

Yes. Logins, approvals, commands and configuration changes are recorded and can be forwarded to your SIEM or log platform. The trail is retained for the length of the contract.

Where does the console run for an air-gapped deployment?

Inside your perimeter, next to the apps it manages. Nothing in an air-gapped deployment depends on a connection to Pilae Cloud.

Related

See your estate in one console.

Thirty minutes with an engineer: a walk through the console, from an app to its backups, its changes and its audit trail.