VSHN operates applications on a platform they run. Pilae operates them on infrastructure you run, with no Kubernetes underneath and no platform skills on your side of the line.
- What they sell
- Managed Kubernetes and OpenShift, plus operated apps on top
- Their catalogue
- GitLab, Jira, Confluence, Postgres, Redis, Elasticsearch
- Our catalogue
- The business apps your staff use, each with a runbook
- Their support
- 24/7, ISO 27001 certified
- What sits underneath
- A cluster you rent from them, or plain servers you already own
- Migration included
- Yes, at a fixed price agreed before it starts
What each one actually covers
Thirteen things an open-source estate needs done. Their column is filled in from www.vshn.ch.
| Capability | VSHN | Pilae |
|---|---|---|
| Deploy | ||
| One-click deploy from a curated cataloguePick the app, name the users, and it is sized, provisioned and running. | Partly | Yes |
| Migration onto the platform, run for youYour data out of the system it is in today, rehearsed before it is cut over. | Partly | Yes |
| SSO and identity wired into each appKeycloak, Entra ID, Google Workspace or Okta, configured on the app itself. | Partly | Yes |
| Keep it current | ||
| Updates applied for you, not just announcedThe release is read, staged and applied. You are not the one doing it. | Partly | Yes |
| Per-app CVE and advisory trackingThe advisory, the affected version and the fix version, per app you run. | Partly | Yes |
| Changes land in a window you approvedYour timezone, your hours, agreed before anything is touched. | Yes | Yes |
| Staged and checked before productionThe upgrade runs somewhere safe first, and the checks have to pass. | No | Yes |
| Prove it | ||
| Restore drills, not just backupsThe backup is restored on a schedule, because an untested backup is a hope. | Partly | Yes |
| A record of every restoreWho restored what, from which file, into which service, and whether it worked. | No | Yes |
| A change log an auditor can readEvery action, the person who took it, the outcome, inside your perimeter. | Partly | Yes |
| See it | ||
| Monitoring and alerting on the appsNot just the host: the application, its checks, and someone who answers. | Yes | Yes |
| Logs and metrics exported to your stackOpenTelemetry, or straight into the SIEM your security team already runs. | Partly | Yes |
| Run it | ||
| An agent that operates the estate with youAsk for a change in words; it plans it, shows you, and waits for approval. | No | Yes |
Pilae vs VSHN, in words
A tick says whether something is covered. These say how.
| What is being compared | VSHN | Pilae |
|---|---|---|
| What you are buying | A managed platform, and operated apps from their catalogue running on it. | The operated app on its own. If it does not need a cluster, it does not get one. |
| Which apps | Developer and data infrastructure — GitLab, Jira, Confluence, Postgres, Redis, Elasticsearch. | The apps your staff use all day, each with a runbook written for your deployment. |
| Anything not in the catalogue | Custom application operations, scoped and quoted as an engagement. | Same fixed-price onboarding as everything else. The catalogue is where we start, not where we stop. |
| Applying an upgrade | Your change, through your pipeline, on your judgement. | Staged, checked, then applied in a window you approved, with a restore drilled either side. |
| The skills you need in-house | Kubernetes or OpenShift, at working depth, for anything you deploy yourself. | None of that. If you already have it, spend it on something that differentiates you. |
| Migration and integration | Available, as a consulting engagement, scoped and quoted per project. | In the product, at a fixed price agreed before it starts. |
| Proving a restore works | Backups run, and they run them well. A rehearsed restore is a procedure you ask for. | Drilled on a schedule and recorded — who restored what, from which file, into which service, and whether it worked. |
| Making a change | A ticket to their team, or a pipeline yours maintains. | A sentence to the agent. It plans it, shows you, and waits for approval. |
You ask for the change. The agent does the work.
Pilae Agent runs inside your perimeter and proposes each change as a plan you read before it runs. Nothing lands without your approval, and every action goes into the same change log as ours.
“Add Grafana for the platform team on the machines we have”
Checks headroom on the existing machines, deploys it there, wires sign-on, and adds dashboards for the apps already running.
“Rotate the Keycloak signing keys before the audit”
Plans the rotation, rehearses it in staging, waits for your approval and your window, rotates, and checks that every client still signs in.
The platform is the price of admission
This is the closest comparison on the site, and it is worth being straight about why. VSHN is a Swiss company that has operated open-source software for other people since 2014. They are ISO 27001 certified, they answer 24/7, and they do not just rent you a cluster — they run applications on it for you: GitLab, Jira, Confluence, Postgres, Redis, Elasticsearch. Anyone telling you VSHN only sells Kubernetes has not read their product pages.
The difference is what has to exist underneath. Their operated applications sit on a managed Kubernetes or OpenShift platform, and that platform is a thing you rent, pay for by consumed resources, and need someone on your side to reason about the day you deploy anything of your own onto it. It is excellent if you needed a cluster anyway. It is overhead if you did not.
Pilae starts from the other end. You want Nextcloud, or Keycloak, or Odoo, run properly on servers you already own. Whether a cluster belongs under it is our decision to make per workload, not a skill you have to hire for and not a line on your invoice. Most business applications do not need one.
What Pilae operates
Advisory tracking per application. Every app watched against its upstream security advisories, with the CVE, the affected version and the fix version named before a change is proposed — for the apps your staff use, not only the ones in a catalogue.
Updates staged and landed in your window. The upgrade runs somewhere safe first, the checks have to pass, and it lands at an hour in your timezone you agreed to — with a restore drilled against the snapshot either side.
Restores that are proven and recorded. Not “backups run”, but restores actually performed on a schedule, each one written down: who ran it, from which file, into which service, and whether it worked.
Migration and integration in the product. Your data moved, your directory wired in, rehearsed before it is cut over — at a fixed price agreed before it starts, rather than scoped and quoted as a separate consulting engagement each time.
Your logs in your stack. Application monitoring and alerting, with logs and metrics exported to OpenTelemetry or into the SIEM your security team already runs, alongside an auditable change log.
And the agent
None of it costs you console time. You ask in a sentence — change this variable, upgrade that app to the version that fixes the advisory, give this team their own instance with SSO already wired — and Pilae Agent plans it, shows you the plan and waits for your approval before anything moves.
Moving from VSHN
A migration is a service, not a support article. This is the sequence we run, and it is in the fixed price.
Decide what actually needs a cluster
Keep the cluster for what genuinely needs it. The business apps beside it do not have to live there.
Inventory the workloads
Which apps, which data, what talks to what, and what has to stay where it is.
Rebuild the rest
Onto plain hosts you own, cheaper to run and far cheaper to reason about.
Move data with a rehearsal
Once to learn the timings, once for real, with the namespace live until every check passes.
Then we run it
Advisory tracking, staged updates, windows, restore drills, exported logs and a runbook per app.
VSHN still fits when
- You need Kubernetes or OpenShift anyway, and want one supplier for the cluster and the apps on it.
- Your estate is GitLab, Jira, Confluence and databases — their catalogue is built for exactly that.
- Fifteen years of Swiss references and an ISO 27001 certificate are a procurement requirement today.
Everywhere else, Pilae
The moment the estate has to stay patched, stay proven and stay auditable without someone in your building doing it by hand, the comparison stops being close.