Managed on-premise hosting for open-source apps

Your servers, your network, your data. Pilae installs, runs, patches and backs up your open-source apps where they already live, and answers for them under a contract.

Start with one workload Book a 30-minute briefing

Runs on: Your servers, your virtualisation, your datacentre
Network: Private mesh, one hardened gate on port 443
Modes: Connected, hybrid or fully air-gapped
Operated by: The Pilae Agent and Pilae engineers

Self-hosted, without running it yourself

Keeping data on your own hardware used to mean hiring a team to keep the software alive. Pilae brings that team and its tooling to your servers, and your data stays where it is.

Your hardware, our operations

We install on the machines you choose: bare metal, VMware, Proxmox, Hyper-V or a Kubernetes cluster you already run.

Apps answer only on the private mesh

Every app sits on the Pilae private network. Nothing listens on the internet except one hardened gate on port 443, and only if you want it.

Updates you approve

The Pilae Agent plans each update with a rollback, waits for your approval and applies it in your maintenance window.

Backups on your storage

Encrypted backups go offsite to storage you own at a second location you pick. Restores are tested every month and recorded in the console.

Probes every 60 seconds

Each app is checked every minute and each machine reports its metrics. An alert reaches a Pilae engineer, not a shared inbox.

Air-gapped when required

Sites with no outbound connection get signed releases through their own transfer process, and the agent runs on a locally hosted model.

Self-hosting with an operator attached

Running open-source software on your own servers keeps your data under your control. It also hands you every upgrade, every advisory and every failed backup. Pilae takes that work on and leaves the ownership with you.

We install the apps on your machines, connect them to your identity provider and put them on a private network. The Pilae Agent then plans each update, waits for your approval and applies it in your window. Our engineers watch the probes and take over when something needs a person.

Built for organisations that cannot move their data

Public administrations, international organisations and regulated firms often have a rule that data stays on site. See private AI on your servers for how that deployment works.

The network design follows the same rule. Apps answer only on the private mesh, and a single hardened gate on port 443 is the one door you choose to open. Our security page describes the controls in detail.

On premises, in the cloud, or both

Some workloads belong on your hardware and others do not. The same recipes and the same console run on your servers and on dedicated machines in Pilae Cloud, so a hybrid estate is operated as one. Operation on your premises starts on the Business plan, priced on our pricing page. Tell us what you run and we will scope it.

How an on-premise deployment runs

Scope
We agree the apps, the machines, the network rules and the maintenance windows with your IT and security teams.
Prepare
Your team provides the machines. We harden them, join them to the private mesh and connect them to the control plane.
Install
Each app is deployed from a tested recipe, wired to your identity provider and backed up before it goes live.
Hand over
Your users get their accounts. Your team gets the console, the runbooks and a named engineer.
Operate
The Pilae Agent and our engineers patch, back up, monitor and fix, under the service levels in your contract.

What your contract includes

Scope: The apps, machines and environments we operate, listed by name.
Availability: A monthly availability commitment with service credits, 99.5% on Business and 99.9% on Enterprise, where the underlying hardware meets the agreed specification.
Security updates: Critical fixes planned and proposed to you within the time your plan specifies.
Backups and restores: Daily backups, retention set per app, and a restore test every month.
Access: Pilae access only through the private mesh, per named engineer, logged in the audit trail.
Exit: Your data, configuration and runbooks handed over in open formats on request.

The apps behind it

Open WebUI

A chat interface over models you host, so prompts and the documents people paste into them never leave your network.

Replaces ChatGPT Team, Microsoft Copilot

Nextcloud

Files, calendars and shared documents for the whole organisation, on storage you can point at in a room you control.

Replaces Google Drive, Dropbox, SharePoint

Keycloak

Single sign-on for everything else you run, with your own directory as the source of truth and no per-seat bill between you and it.

Replaces Okta, Microsoft Entra ID

n8n

Workflow automation your own team writes, running next to the systems it talks to instead of reaching them across the internet.

Replaces Zapier, Make

Mattermost

Team chat, channels and calls on a server in the country you choose, with the message history stored in your own database.

Replaces Slack, Microsoft Teams

Vaultwarden

A password manager for the whole organisation, compatible with the Bitwarden apps, on a server you choose and with vaults only your people can decrypt.

Replaces 1Password, LastPass

Questions

What hardware do I need for managed on-premise hosting?

It depends on the apps and the number of users. During scoping we give you a machine specification per app. A small estate can start on two or three standard Linux servers or virtual machines. Private AI adds a GPU server.

Does any of my data leave my premises?

No. Your apps, files, databases and backups stay on machines and storage you own. The control plane receives health signals and deployment status, never your application data. In air-gapped mode nothing leaves at all.

How do Pilae engineers reach my servers?

Through the private mesh, with a named account per engineer. You can restrict access to your maintenance windows, require your approval for each session, and read every action in the audit log.

Can you operate apps in an air-gapped environment?

Yes. We deliver signed releases and recipes through the transfer process your security team defines, and our engineers operate on site or through your jump host. The Pilae Agent runs inside the perimeter with a locally hosted model.

Can we move between on-premise and Pilae Cloud later?

Yes. The same recipes run in both places, so an app can move from your servers to dedicated machines in Pilae Cloud, or back, as a planned migration with a backup and a rollback.

Platform

Put open-source apps on your own servers, operated.

Thirty minutes with an engineer to go through your machines, your network rules and the apps you want to run.