Hyground vs ilert: the investigation runs inside your cluster

ilert is a genuinely European option, and this page says so plainly. Its AI runs on region-specific endpoints, and for EU customers the models are hosted in the EU, Anthropic through AWS Bedrock in an EU region. Every AI and agent action is logged, and the whole AI layer can be switched off account-wide, after which nothing is sent to an external model at all. It also does the things Hyground does not do: paging, on-call schedules, call routing with a voice agent, and status pages. The difference is not Europe. ilert's agents reason in ilert's cloud, against the tools you connect to them; Hyground's agents reason inside the cluster they are installed in.

REVIEW NOTES FOR THE TEAM. Draft only. Delete this block before publishing.

Claims checked 2026-09-14 against ilert's own documentation at docs.ilert.com: the AI and agents overview including the model endpoints and data residency table, AI features, Agents, the ilagent edge connector and the documentation index. On our side against the product docs repo at commit d4604a6b and the current hyground.ai pricing and security pages. Only claims that need a second pair of eyes are listed.

• ilert hosts EU customers' models in the EU, and our sovereignty argument against them is narrower than we have been making it. Please read this one first. Their documentation publishes a region table: EU customers are served by Anthropic models through AWS Bedrock in an EU region, and non-EU customers by OpenAI and Anthropic platforms in the US. The whole AI layer can also be disabled account-wide, after which nothing is sent to an external model. The page now says outright that our argument is not jurisdiction, it is that their agents still reason in their cloud rather than in your cluster. That is a real narrowing and it needs your agreement before it goes live.

• "Platform-level RBAC" is off the page. The old card claimed it on our side. Our own enterprise-readiness audit says RBAC is not enforced yet and lists it under "do not claim yet". The page now says credentials are managed at platform level with a full audit trail, which is what the documentation supports. Same correction as the rest of the family.

• "Read-only by default" became "read-first". Our docs say adapters default to read-only and verify it at startup, and the few writes that exist are ticket comments and email behind configuration flags. A demo would have contradicted the old wording.

• Their agents act, not just investigate. Their documentation describes autonomous agents that reason, investigate and trigger actions to resolve or communicate incidents, with every action logged and traceable. The old page treated their AI as noise reduction and triage. The row and the card now state what they actually do.

• They have an on-premises component. ilagent, with an edge connector that polls ilert and delivers to local systems over HTTP, Kafka, MQTT or script execution. It is a relay rather than an in-cluster agent, but the page should not imply they have nothing on-premises, and it no longer does.

• ilert gets the table's one competitor tick, on alerting and on-call. Paging, schedules, escalation, call routing with an AI voice agent, and status pages. We do none of it, and the page says most teams keep their pager.

• Our LLM claim was a hard list of five providers and is now "any provider". Same correction as the rest of the family. The sharpest remaining model difference is that Hyground can run a model inside the cluster and ilert cannot.

• Their pricing is per user but we could not source current rates. The row says per user on published plans and points at their pricing page. Add the numbers if someone verifies them.

• Open decision. The six cards are prose paragraphs; the Dash0 layout uses bullet lists. Same question as the rest of the family.

• Nothing a visitor sees changes until this is published. The live site is still served from Strapi.