Softwr

Developer Tools · head to head

Ona (formerly Gitpod) vs Very Good Security

Ona (formerly Gitpod) logo

Ona (formerly Gitpod)

Developer Tools

Cloud development environments repositioned as a control plane for software engineering agents

From
Free
Free plan
Yes
Full reviewWebsite
Very Good Security logo

Very Good Security

Cybersecurity

Tokenisation proxy that keeps card and personal data out of your own systems and out of PCI scope

From
$1000/month
Free plan
No
Full reviewWebsite

The short version

  • Only Ona (formerly Gitpod) has a free tier, so it costs nothing to try first.
  • Each has a real cost: Ona (formerly Gitpod) acquisition risk has already materialised: the company closed a sale to OpenAI on 10 August 2026 and now sits inside the Codex team, so nothing public guarantees pricing, continuity or neutrality between model vendors beyond honouring existing commitments.; Very Good Security vGS sits in the live path of every request carrying sensitive data, so its latency and availability become yours, and an outage in the proxy is a payment outage no matter how healthy your own systems are.
  • They diverge on capability: Ona (formerly Gitpod) covers Ephemeral environments, Very Good Security covers Aliasing proxy.
  • Prices and features above were last checked on 31 August 2026.

Where they differ

Only the attributes on which Ona (formerly Gitpod) and Very Good Security actually diverge.

Attributes where Ona (formerly Gitpod) and Very Good Security differ
AttributeOna (formerly Gitpod)Very Good Security
Starting priceFree$1000/month
Pricing modelPer month by compute unitPer month
Free tierYesNo
PlatformsWeb, Linux, macOS, Windows, AWS, Google Cloud PlatformWeb, API
CategoryDeveloper ToolsCybersecurity

Identical on both: user rating (Not yet rated).

What each one covers

Drawn from each product's published feature list. An absence here means we hold no record of it - not that the product lacks it.

Only in Ona (formerly Gitpod)

  • Ephemeral environments
  • Agent sessions
  • Bring your own cloud
  • Devcontainer standard
  • Compute unit budgeting
  • Enterprise identity

Only in Very Good Security

  • Aliasing proxy
  • PCI scope reduction
  • Network tokenisation
  • Processor optionality
  • Card issuing data
  • Vault and access controls
  • Data residency options
  • Compliance artefacts

What people use each for

The jobs each tool is most often brought in to do.

Ona (formerly Gitpod)

  • Giving a large engineering team identical, disposable environments so onboarding is a link rather than a two day setupnot Very Good Security
  • Running several coding agents in parallel against real databases and services instead of on a laptopnot Very Good Security
  • Keeping source code off contractor and offshore laptops by moving the whole environment into a controlled accountnot Very Good Security
  • Reproducing a hard-to-configure toolchain for a short-lived project without polluting anyone machinenot Very Good Security

Very Good Security

  • A marketplace facing its first PCI DSS Level 1 assessment that wants to keep card data off its own estate rather than harden a dozen servicesnot Ona (formerly Gitpod)
  • A merchant negotiating with a second acquirer that needs card credentials portable so the negotiation is real rather than theoreticalnot Ona (formerly Gitpod)
  • A fintech collecting bank account and identity documents that wants sensitive fields absent from logs, backups and analytics warehouses by constructionnot Ona (formerly Gitpod)
  • A card issuer that must display a full PAN in its own mobile app without the app or its backend touching cardholder datanot Ona (formerly Gitpod)

Where each one falls short

Documented limitations, not opinions. Every one is a constraint you would hit in normal use.

Ona (formerly Gitpod)

  • Acquisition risk has already materialised: the company closed a sale to OpenAI on 10 August 2026 and now sits inside the Codex team, so nothing public guarantees pricing, continuity or neutrality between model vendors beyond honouring existing commitments.
  • Two disruptive changes of direction inside a year, from development environments to agent orchestration and then from independence to acquisition, mean the product a browser IDE buyer originally chose no longer exists in that form.
  • The Gitpod Classic sunset on 15 October 2025 required manual conversion of configuration, hand-moved secrets, self-rescued workspace data and a brand new account, which is the clearest available precedent for how the vendor handles deprecation.
  • Community self-hosting is finished: the AGPL-3.0 repository is deprecated by its own README, and self-hosted now means a vendor-operated install in your AWS or GCP account, with no Azure, no on-premises and no air-gapped path.
  • Pricing is difficult to model because it runs on a compute unit currency where subscription credits expire at the end of the month, the mapping from units to actual compute is not published on the pricing page, and Enterprise is quotation only.

Very Good Security

  • VGS sits in the live path of every request carrying sensitive data, so its latency and availability become yours, and an outage in the proxy is a payment outage no matter how healthy your own systems are.
  • Token portability is the whole selling point yet leaving VGS means migrating tokens back out, a project the vendor has no incentive to streamline, so the lock-in you removed from your acquirer partly moves to VGS.
  • Entry pricing at around one thousand US dollars a month is real money for a pre-revenue fintech, and it buys volume-limited throughput, so cost scales with exactly the growth that made you buy it.
  • Scope reduction is not scope elimination: your QSA still assesses how you integrate, and teams regularly discover that a support tool or an internal admin screen pulled plaintext back in and dragged systems into scope again.
  • Proxy-based interception constrains how you design request flows, and non-standard payloads, streaming uploads or binary formats often need custom routing rules that make debugging production issues noticeably harder.

Pricing, plan by plan

Ona (formerly Gitpod)

Free
  • FreeFree
    • Up to 3 parallel environments
    • Machines up to 4 vCPU, 16 GB memory and 80 GB disk
    • Ona Cloud multi-tenant only
  • Core$20/month
    • From 20 US dollars a month, up to 100 team members
    • Includes 80 to 2,200 recurring compute units a month depending on tier
    • Additional units from 10 US dollars per 40 units
  • Enterprise$undefined/year
    • Single-tenant deployment in your own AWS or GCP account
    • SAML and OIDC single sign-on
    • Dedicated account management and forward deployed engineers

Very Good Security

$1000/month
  • Starter$1000/month
    • Aliasing proxy
    • Vault storage
    • PCI scope reduction
  • Growth$undefined/month
    • Network tokenisation
    • Multiple processors
    • Data residency options
  • Enterprise$undefined/year
    • Custom vault architecture
    • Dedicated support and SLA
    • Contractual compliance coverage

Which should you pick?

Choose Ona (formerly Gitpod) if

  • You need ephemeral environments.
  • You want to start without paying.
  • You work on Web, Linux, macOS, Windows, AWS, Google Cloud Platform.
  • You also want agent sessions.
Ona (formerly Gitpod) review

Choose Very Good Security if

  • You need aliasing proxy.
  • You work on Web, API.
  • You also want pci scope reduction.
Very Good Security review

Questions people ask

Is Ona (formerly Gitpod) or Very Good Security better?
Neither clearly leads. Ona (formerly Gitpod) starts at Free and Very Good Security at $1000/month, and user ratings are close enough to be indistinguishable. Choose on capability and platform support.
Which is cheaper, Ona (formerly Gitpod) or Very Good Security?
Ona (formerly Gitpod) has a free tier; the other does not. Paid plans start at Free for Ona (formerly Gitpod) and $1000/month for Very Good Security.
Does Ona (formerly Gitpod) or Very Good Security run on more platforms?
Ona (formerly Gitpod) runs on Web, Linux, macOS, Windows, AWS, Google Cloud Platform. Very Good Security runs on Web, API.
Can I use Ona (formerly Gitpod) for free?
Yes. Ona (formerly Gitpod) has a free tier, so you can try it without paying. Very Good Security starts at $1000/month.
What is Ona (formerly Gitpod) best used for?
Ona (formerly Gitpod) is most often used for giving a large engineering team identical, disposable environments so onboarding is a link rather than a two day setup, running several coding agents in parallel against real databases and services instead of on a laptop, keeping source code off contractor and offshore laptops by moving the whole environment into a controlled account, reproducing a hard-to-configure toolchain for a short-lived project without polluting anyone machine. Of those, giving a large engineering team identical, disposable environments so onboarding is a link rather than a two day setup and running several coding agents in parallel against real databases and services instead of on a laptop are not what Very Good Security is typically brought in for.
What can Ona (formerly Gitpod) do that Very Good Security cannot?
Ona (formerly Gitpod) covers Ephemeral environments, Agent sessions, Bring your own cloud, Devcontainer standard. Very Good Security covers Aliasing proxy, PCI scope reduction, Network tokenisation, Processor optionality.

Answered from the vendors’ own pages

Ona (formerly Gitpod): Is Gitpod still called Gitpod?

No. It rebranded to Ona in September 2025, and gitpod.io now redirects to ona.com. The company was acquired by OpenAI in a deal that closed on 10 August 2026.

Very Good Security: Does VGS make me PCI compliant?

No. It removes cardholder data from your systems so your assessment covers a far smaller boundary, but you still complete an assessment and your integration is part of it.

Ona (formerly Gitpod): Can I still self-host it for free?

No. The AGPL-3.0 self-hosted project is deprecated by its own README. What is offered now is a vendor-operated single-tenant install in your AWS or GCP account on the Enterprise plan.

Very Good Security: Can I move to another processor without re-collecting cards?

Yes, that is a core reason people buy it. The vault reveals stored credentials to whichever processor you route to.

Ona (formerly Gitpod): What happened to Gitpod Classic?

Pay-as-you-go Classic was switched off on 15 October 2025. Migration required converting gitpod.yml to devcontainer.json, moving secrets by hand, downloading workspace data before the cutoff and creating a new account.

Very Good Security: What does it cost?

Published entry pricing is about one thousand US dollars per month; growth and enterprise tiers are quoted.

Ona (formerly Gitpod): What does it cost?

Core starts at 20 US dollars a month and includes a monthly allowance of Ona Compute Units, with more from 10 dollars per 40 units. Subscription credits expire monthly. Enterprise is quoted.

Very Good Security: Is it only for card data?

No. The proxy handles any sensitive field, including bank details, national identifiers and documents, though payments is where the product is now focused.

Share

Related pages

More on Ona (formerly Gitpod)

More on Very Good Security

Keep looking

Other head to heads