AWS sells infrastructure and managed services your engineers assemble and run. Pilae operates the open-source apps you choose, on your premises or in any of 12 Pilae Cloud regions, six of them in Switzerland and the EU, with every change approved and recorded.
- What they sell
- Compute, storage, databases, networking, AI and managed services, billed by use
- Where it runs
- AWS Regions worldwide, including Europe (Zurich), and the AWS European Sovereign Cloud in Brandenburg, Germany
- Their certifications
- ISO 27001, SOC 2, BSI C5 and others, as stated on their site
- Their support
- Paid plans; under 15 minutes for a critical case on Enterprise Support, under 5 on Unified Operations
- What we sell
- The open-source or source-available apps you pick, operated for you
- Where ours runs
- Your premises, any of 12 Pilae Cloud regions (six in Switzerland and the EU), hybrid or air-gapped
What each one actually covers
Thirteen things an open-source estate needs done. Their column is filled in from aws.amazon.com.
| Capability | Amazon Web Services | Pilae |
|---|---|---|
| Deploy | ||
| One-click deploy from a curated cataloguePick the app, name the users, and it is sized, provisioned and running. | Partly | Yes |
| Migration onto the platform, run for youYour data out of the system it is in today, rehearsed before it is cut over. | Partly | Yes |
| SSO and identity wired into each appKeycloak, Entra ID, Google Workspace or Okta, configured on the app itself. | Partly | Yes |
| Keep it current | ||
| Updates applied for you, not just announcedThe release is read, staged and applied. You are not the one doing it. | Partly | Yes |
| Per-app CVE and advisory trackingThe advisory, the affected version and the fix version, per app you run. | Partly | Yes |
| Changes land in a window you approvedYour timezone, your hours, agreed before anything is touched. | Partly | Yes |
| Staged and checked before productionThe upgrade runs somewhere safe first, and the checks have to pass. | Partly | Yes |
| Prove it | ||
| Restore drills, not just backupsThe backup is restored on a schedule, because an untested backup is a hope. | Partly | Yes |
| A record of every restoreWho restored what, from which file, into which service, and whether it worked. | Partly | Yes |
| A change log an auditor can readEvery action, the person who took it, the outcome, inside your perimeter. | Partly | Yes |
| See it | ||
| Monitoring and alerting on the appsNot just the host: the application, its checks, and someone who answers. | Partly | Yes |
| Logs and metrics exported to your stackOpenTelemetry, or straight into the SIEM your security team already runs. | Yes | Yes |
| Run it | ||
| An agent that operates the estate with youAsk for a change in words; it plans it, shows you, and waits for approval. | Partly | Yes |
Pilae vs Amazon Web Services, in words
A tick says whether something is covered. These say how.
| What is being compared | Amazon Web Services | Pilae |
|---|---|---|
| What you are buying | Infrastructure and managed services, billed by use, that your team designs, assembles and runs. | The applications themselves, deployed, patched, backed up and watched by Pilae engineers, on a plan quoted on request. |
| Who operates the app | You do, or a consulting partner you hire. AWS runs the services underneath under its shared responsibility model. | Pilae does — deployment, updates, backups, monitoring and incident response on the app itself. |
| When an update lands | Managed services such as RDS apply maintenance in a window you set. Software you deploy on EC2 updates when you update it, with tools such as Systems Manager. | The Pilae Agent plans each change, waits for your approval, applies it in your window and records it. |
| Identity | IAM and IAM Identity Center for access to AWS and to SAML applications. SSO on each app you self-host is yours to configure. | Each app wired to your directory, through Keycloak or Entra ID, as part of onboarding. |
| Proving a backup works | AWS Backup, including scheduled restore testing, which your team configures and follows up. | Daily encrypted offsite backups, and a restore test every month, recorded in the console. Nothing to configure. |
| Running on your own servers | AWS Outposts puts AWS-managed racks in your building, connected to an AWS Region. | On your premises, in Pilae Cloud, hybrid or fully air-gapped. The same console and the same operations in each. |
| Jurisdiction | Amazon Web Services is a US company. The AWS European Sovereign Cloud is run by a German entity with EU-resident leadership, and AWS publishes the sovereignty commitments that apply to it. | Pilae SA is a Swiss company in Lausanne. Your apps and data run on machines in the country you choose, and every sub-processor is named in the DPA. |
You ask for the change. The agent does the work.
Pilae Agent runs inside your perimeter and proposes each change as a plan you read before it runs. Nothing lands without your approval, and every action goes into the same change log as ours.
“Which of our apps are behind on security fixes?”
Lists each app against its upstream releases and the advisories that apply, then proposes an upgrade order you approve in one pass.
“Restore last Tuesday’s Keycloak backup to staging”
Restores it beside production, signs in against it, compares realms and clients with the live one, and records the drill.
Infrastructure, or an operated estate
Amazon Web Services is one of the largest cloud providers in the world. It offers compute, storage, databases, AI services and a managed service for almost every layer of a modern system, in regions around the world, including Zurich. For a platform team building its own product, it is a strong foundation.
It is still a foundation. An open-source app on AWS is an app your team deploys, patches, backs up, wires to your directory and wakes up for. AWS is clear about this in its shared responsibility model: AWS secures the cloud, and you secure and operate what you put in it. Managed services move that line, but only for the services AWS runs itself.
Pilae sells the layer above. You choose the apps; Pilae deploys them, keeps them current, backs them up, tests the restores and answers the alerts.
On sovereignty, stated plainly
Amazon is a US company, and US law, including the CLOUD Act, applies to it. AWS has answered the European question with the AWS European Sovereign Cloud: a separate cloud in Germany, operated by a German company with EU-resident leadership, generally available since January 2026. That is a real step, and some organisations will find it sufficient.
Others want the software itself to be something they could take anywhere. Pilae operates open-source or source-available apps, so what you depend on is not tied to one provider. They run on your premises or on dedicated machines in Pilae Cloud, in the country you choose, or fully air-gapped on the Enterprise plan. The data sovereignty guide goes through the questions to ask any provider, Pilae included.
What your contract includes
The apps, operated. Open-source or source-available apps from the catalogue — for example Nextcloud, Keycloak, n8n or Open WebUI — each under its own published licence.
Changes with approval. The Pilae Agent plans each change, waits for your approval, applies it in your window and records it in the console. The audit trail exports to your SIEM.
Backups you can prove. Daily, encrypted, stored offsite in the country you choose, with a restore test every month recorded in the console. See backups.
Watched around the clock. 60-second probes, and alerts that reach Pilae engineers at any hour. See monitoring.
A commitment in writing. 99.9% monthly availability with service credits on every plan, as set out in the SLA, plus the standard DPA, audit rights and a written exit plan.
Moving across
Keep what you build on AWS where it is. Move the adopted apps that need an owner. Migration is delivered at a fixed price agreed before it starts, and onboarding wires each app to your identity from day one.
Moving from Amazon Web Services
A migration is a service, not a support article. This is the sequence we run, and it is in the fixed price.
Separate your code from adopted software
Your own services can stay on AWS. The open-source apps your teams adopted are what Pilae takes on.
Inventory the adopted apps
Which apps, which versions, how much data, what talks to each one, and who last upgraded it.
Stand them up beside AWS
On your premises or in Pilae Cloud, wired to your directory, with nothing switched off yet.
Move the data with a rehearsal
Once to learn the timings, once for real. The AWS instance keeps running until every check passes.
Then we operate it
Monitoring, backups, monthly restore tests and approved changes in your window, all recorded.
AWS still fits when
- You build and run your own software at scale, with a platform team that already knows AWS.
- You need managed services Pilae does not offer, such as global content delivery, serverless functions or large GPU fleets billed by the hour.
- Your workloads have to sit in more regions than the 12 Pilae Cloud offers, close to users on every continent.
Everywhere else, Pilae
The moment the estate has to stay patched, stay proven and stay auditable without someone in your building doing it by hand, the comparison stops being close.