Elestio keeps the machine your app runs on alive. Pilae runs the application itself — patched against named advisories, migrated in, wired to your identity, and proven by restore.
- What they sell
- Self-serve managed hosting, one service per dedicated VM
- What we sell
- The operated application, on infrastructure you own
- Their catalogue
- 400+ services
- Their support
- 3 business days included, 4 hours at $200/mo
- Our support
- Senior engineers on the line, one working day
- Migration included
- Yes, at a fixed price agreed before it starts
What each one actually covers
Thirteen things an open-source estate needs done. Their column is filled in from elest.io.
| Capability | Elestio | Pilae |
|---|---|---|
| Deploy | ||
| One-click deploy from a curated cataloguePick the app, name the users, and it is sized, provisioned and running. | Yes | Yes |
| Migration onto the platform, run for youYour data out of the system it is in today, rehearsed before it is cut over. | No | Yes |
| SSO and identity wired into each appKeycloak, Entra ID, Google Workspace or Okta, configured on the app itself. | No | Yes |
| Keep it current | ||
| Updates applied for you, not just announcedThe release is read, staged and applied. You are not the one doing it. | Yes | Yes |
| Per-app CVE and advisory trackingThe advisory, the affected version and the fix version, per app you run. | No | Yes |
| Changes land in a window you approvedYour timezone, your hours, agreed before anything is touched. | Partly | Yes |
| Staged and checked before productionThe upgrade runs somewhere safe first, and the checks have to pass. | No | Yes |
| Prove it | ||
| Restore drills, not just backupsThe backup is restored on a schedule, because an untested backup is a hope. | Partly | Yes |
| A record of every restoreWho restored what, from which file, into which service, and whether it worked. | No | Yes |
| A change log an auditor can readEvery action, the person who took it, the outcome, inside your perimeter. | No | Yes |
| See it | ||
| Monitoring and alerting on the appsNot just the host: the application, its checks, and someone who answers. | Yes | Yes |
| Logs and metrics exported to your stackOpenTelemetry, or straight into the SIEM your security team already runs. | No | Yes |
| Run it | ||
| An agent that operates the estate with youAsk for a change in words; it plans it, shows you, and waits for approval. | No | Yes |
Pilae vs Elestio, in words
A tick says whether something is covered. These say how.
| What is being compared | Elestio | Pilae |
|---|---|---|
| Keeping up with security | The VM gets OS and security updates, and services update on the schedule you configure. | Every app you run is tracked against its upstream advisories. You get the CVE, the affected version and the fix version, before the patch lands. |
| When an update lands | On a schedule you set, in UTC. Nothing is staged first and nothing waits for a sign-off. | In a maintenance window you approved, after a staging run and a restore drill against the snapshot. |
| Getting your existing data in | Deployment is self-serve; moving what you run today is your project. | Ours, at a fixed price agreed before it starts, rehearsed once and then cut over. |
| Identity | You configure the app's own login however it ships. | Wired to Keycloak, Entra ID, Google Workspace or Okta as part of the deployment. |
| Proving a backup works | Automated backups, with 7 to 30 days of retention by support tier. | Restores are drilled on a schedule and recorded — who restored what, from which file, into which service, and whether it worked. |
| What your security team gets | Platform and application logs, in their console. | Logs and metrics exported to OpenTelemetry or straight into your SIEM, plus a change log an auditor can read. |
| Making a change | You open the console and make it. | You ask the agent in a sentence. It plans it, shows you the plan, and waits for approval. |
You ask for the change. The agent does the work.
Pilae Agent runs inside your perimeter and proposes each change as a plan you read before it runs. Nothing lands without your approval, and every action goes into the same change log as ours.
“Upgrade Nextcloud and its apps, not just the server”
Checks every installed Nextcloud app against the new release, stages the upgrade, and applies it in your window once you approve.
“Why did Keycloak log everyone out at noon?”
Reads the Keycloak events, the session settings and the change log, and tells you what expired and why, with the fix as a plan.
Managing a machine is not operating an application
Elestio’s promise is specific and they keep it: pick a service, pick where it runs, and they keep that machine patched, monitored, backed up and behind a valid certificate. For an app with no data behind it yet, that is a fine trade.
Where it stops is the application. Keeping the Keycloak process alive is not the same as knowing that the latest release fixes an advisory affecting the federation you configured, rehearsing that upgrade somewhere safe, applying it at an hour you agreed, and proving afterwards that the backup you have been taking for six months actually restores. That work does not go away when the hosting is handled. It lands on whoever is left holding the application.
What Pilae operates
Every app tracked against its upstream advisories. Not “security updates are applied” — the specific CVE, the affected version and the fix version, per application in your estate, before the change is proposed. None of the four names a CVE, an affected version and a fix version, per application, on any public page of theirs.
Updates that are staged, approved and reversible. The upgrade runs somewhere safe first and the checks have to pass. It lands inside a maintenance window in your timezone that you agreed to. A restore is drilled against the snapshot before and after, and the result is recorded.
Migration and identity as part of the deployment. Your data comes out of whatever it lives in now, rehearsed before it is cut over. The app is wired to your directory. Both are in the fixed price, not an add-on and not a support article telling you how to do it yourself.
Your monitoring, in your stack. Application-level checks and alerting, with logs and metrics exported to OpenTelemetry or into the SIEM your security team already runs. Plus a change log that names every action, the person who took it, and the outcome — readable by an auditor without us in the room.
And the agent
You do not click through a console for any of it. You say what you want changed, in a sentence, and Pilae Agent plans it, shows you the plan, and waits. Set an environment variable across an estate. Ask why Keycloak got slow this morning. Stand up a Metabase for the finance team, sized from the headcount, with SSO already wired. The console is there when you want it; it is not the interface you are required to learn.
Moving from Elestio
A migration is a service, not a support article. This is the sequence we run, and it is in the fixed price.
Read what you run
Which Elestio services, which versions, how much data, and what talks to each one.
Stand it up beside it
The same apps on your infrastructure or a region you choose, with nothing switched off yet.
Move the data twice
A rehearsal to learn the timings, then the real one. The rehearsal is what makes the second boring.
Wire identity and the rest
Your directory, your SSO, the integrations that were living outside Elestio.
Cut over in your window
Old service still running until every check passes, with a tested way back.
Then it runs itself
Advisory tracking, staged updates, restore drills and the change log, from day one.
Elestio still fits when
- The app is new, has no data behind it, and nobody has to own it afterwards.
- You have an engineer in-house who already knows that application's failure modes.
Everywhere else, Pilae
The moment the estate has to stay patched, stay proven and stay auditable without someone in your building doing it by hand, the comparison stops being close.