Azure sells infrastructure and managed services your engineers assemble and run. Pilae operates the open-source apps you choose, from sign-in to documents to private AI, on your own servers or in any of 12 Pilae Cloud regions, six of them in Switzerland and the EU, and changes nothing you have not approved.
- What they sell
- Compute, storage, databases, networking, AI and managed services, billed by use
- Where it runs
- Azure regions worldwide, including Switzerland North (Zurich) and Switzerland West (Geneva)
- Their certifications
- ISO 27001, SOC 2, BSI C5 and others, as stated on their site
- Their support
- Paid plans, sold separately from usage; under an hour for a critical case from the Standard plan up
- What we sell
- The open-source or source-available apps you pick, operated for you
- Where ours runs
- Your premises, any of 12 Pilae Cloud regions (six in Switzerland and the EU), hybrid or air-gapped
What each one actually covers
Thirteen things an open-source estate needs done. Their column is filled in from azure.microsoft.com.
| Capability | Microsoft Azure | Pilae |
|---|---|---|
| Deploy | ||
| One-click deploy from a curated cataloguePick the app, name the users, and it is sized, provisioned and running. | Partly | Yes |
| Migration onto the platform, run for youYour data out of the system it is in today, rehearsed before it is cut over. | Partly | Yes |
| SSO and identity wired into each appKeycloak, Entra ID, Google Workspace or Okta, configured on the app itself. | Partly | Yes |
| Keep it current | ||
| Updates applied for you, not just announcedThe release is read, staged and applied. You are not the one doing it. | Partly | Yes |
| Per-app CVE and advisory trackingThe advisory, the affected version and the fix version, per app you run. | Partly | Yes |
| Changes land in a window you approvedYour timezone, your hours, agreed before anything is touched. | Partly | Yes |
| Staged and checked before productionThe upgrade runs somewhere safe first, and the checks have to pass. | Partly | Yes |
| Prove it | ||
| Restore drills, not just backupsThe backup is restored on a schedule, because an untested backup is a hope. | Partly | Yes |
| A record of every restoreWho restored what, from which file, into which service, and whether it worked. | Partly | Yes |
| A change log an auditor can readEvery action, the person who took it, the outcome, inside your perimeter. | Partly | Yes |
| See it | ||
| Monitoring and alerting on the appsNot just the host: the application, its checks, and someone who answers. | Partly | Yes |
| Logs and metrics exported to your stackOpenTelemetry, or straight into the SIEM your security team already runs. | Yes | Yes |
| Run it | ||
| An agent that operates the estate with youAsk for a change in words; it plans it, shows you, and waits for approval. | Partly | Yes |
Pilae vs Microsoft Azure, in words
A tick says whether something is covered. These say how.
| What is being compared | Microsoft Azure | Pilae |
|---|---|---|
| What you are buying | Infrastructure and managed services, billed by use, that your team designs, assembles and runs. | The applications themselves, deployed, patched, backed up and watched by Pilae engineers, on a plan quoted on request. |
| Who operates the app | You do, or a Microsoft partner you hire. Azure runs the services underneath under its shared responsibility model. | Pilae does — deployment, updates, backups, monitoring and incident response on the app itself. |
| When an update lands | Managed services apply maintenance on Microsoft's schedule or in a maintenance configuration you set. Software you deploy on virtual machines updates when you update it. | The Pilae Agent plans each change, waits for your approval, applies it in your window and records it. |
| Identity | Entra ID is a strong identity provider. Connecting each open-source app you self-host to it is yours to configure. | Each app wired to your directory, through Entra ID or Keycloak, as part of onboarding. Entra ID stays yours. |
| Proving a backup works | Azure Backup and service-level backups, with restores run and checked by your team. | Daily encrypted offsite backups, and a restore test every month, recorded in the console. |
| Running on your own servers | Azure Local runs on validated hardware in your building, with disconnected operations for sites that cannot reach Azure. | On your premises, in Pilae Cloud, hybrid or fully air-gapped, on the hardware you have. The same console and the same operations in each. |
| Jurisdiction | Microsoft is a US company. It has completed the EU Data Boundary and offers Microsoft Sovereign Cloud, including national partner clouds such as Bleu in France and Delos Cloud in Germany. | Pilae SA is a Swiss company in Lausanne. Your apps and data run on machines in the country you choose, and every sub-processor is named in the DPA. |
You ask for the change. The agent does the work.
Pilae Agent runs inside your perimeter and proposes each change as a plan you read before it runs. Nothing lands without your approval, and every action goes into the same change log as ours.
“Wire Nextcloud sign-on to our Entra ID groups”
Registers the app in your tenant with the redirect you approve, maps the groups to Nextcloud roles and tests a login for each.
“Why is Metabase slow since this morning?”
Pulls the logs, the deploy history and the resource graphs, and comes back with what changed and when rather than with a dashboard.
Infrastructure, or an operated estate
Microsoft Azure is one of the largest clouds in the world, with two regions in Switzerland and close ties to the Microsoft 365 and Entra ID tools many organisations already use. For a team building its own software on a Microsoft stack, it is a natural foundation.
It is still a foundation. An open-source app on Azure is an app your team deploys, patches, backs up, connects to Entra ID and wakes up for. Microsoft’s shared responsibility model says as much: the more of the stack you run yourself, the more of it is yours to operate.
Pilae sells the layer above. You choose the apps; Pilae deploys them, keeps them current, backs them up, tests the restores and answers the alerts.
On sovereignty, stated plainly
Microsoft is a US company, and US law, including the CLOUD Act, applies to it. Microsoft has done real work on the European question: the EU Data Boundary, completed in February 2025, and Microsoft Sovereign Cloud, which spans sovereign controls in its public cloud, Azure Local on premises, and national partner clouds such as Bleu and Delos Cloud.
Pilae takes a different route. The apps are open source or source-available, so the software you depend on is not tied to one vendor. They run on your premises or on dedicated machines in Pilae Cloud, in the region you choose, or fully air-gapped on the Enterprise plan, on the hardware you have. The data sovereignty guide goes through the questions to ask any provider, Pilae included.
What your contract includes
The apps, operated. Open-source or source-available apps from the catalogue — for example Nextcloud, Mattermost, n8n or Open WebUI — each under its own published licence.
Changes with approval. The Pilae Agent plans each change, waits for your approval, applies it in your window and records it in the console. The audit trail exports to your SIEM.
Backups you can prove. Daily, encrypted, stored offsite in the country you choose, with a restore test every month recorded in the console. See backups.
Watched around the clock. 60-second probes, and alerts that reach Pilae engineers at any hour. See monitoring.
A commitment in writing. 99.9% monthly availability with service credits on every plan, as set out in the SLA, plus the standard DPA, audit rights and a written exit plan.
Moving across
Keep what you build on Azure where it is. Move the adopted apps that need an owner. If you are also reconsidering Microsoft 365, start with the sovereign workplace. Migration is delivered at a fixed price agreed before it starts.
Moving from Microsoft Azure
A migration is a service, not a support article. This is the sequence we run, and it is in the fixed price.
Separate your code from adopted software
Your own services, and Microsoft 365, can stay where they are. The open-source apps your teams adopted are what Pilae takes on.
Inventory the adopted apps
Which apps, which versions, how much data, what talks to each one, and who last upgraded it.
Stand them up beside Azure
On your premises or in Pilae Cloud, wired to Entra ID or Keycloak, with nothing switched off yet.
Move the data with a rehearsal
Once to learn the timings, once for real. The Azure instance keeps running until every check passes.
Then we operate it
Monitoring, backups, monthly restore tests and approved changes in your window, all recorded.
Azure still fits when
- Your organisation is built around Microsoft 365 and Entra ID, and your engineers already run workloads on Azure.
- You build and run your own software, and want managed services Pilae does not offer, such as serverless functions or large GPU capacity billed by the hour.
- Your workloads have to sit in more regions than the 12 Pilae Cloud offers, or you need a Microsoft stack running on premises through Azure Local.
Everywhere else, Pilae
The moment the estate has to stay patched, stay proven and stay auditable without someone in your building doing it by hand, the comparison stops being close.