Ona (formerly Gitpod; product still reachable at gitpod.io, redirects to ona.com)

G2's product page for the company is titled 'Gitpod Reviews 2026' with only 16 reviews at 4.3/5 (also listed via the seller profile g2.com/sellers/gitpod), and the visible reviews are dated between 2022 and April 2024, describing the legacy cloud-IDE product with no mention of Ona, background agents, Automations, or Veto. Direct competitors have far deeper, more current review corpora on the same platform: Coder shows 4.3/5 across 212 reviews, and Cursor shows 4.5-4.6/5 across 42-316 reviews depending on the profile checked. A buyer researching 'AI agent infrastructure' on G2 finds a thin, stale entry under a brand name (Gitpod) the company itself no longer leads with in its own marketing, and searching for 'Ona' on G2 returns nothing at all.

Why it matters: Enterprise buyers doing vendor diligence lean on G2 volume and recency as a trust signal, and right now Ona's review footprint reads as an abandoned, stale product rather than the category leader it claims to be, giving competitors with active review pipelines a credibility edge in side-by-side procurement.

Ona's pricing page lists 'Bank-grade VPC deployment' and 'SSO and OIDC identity and access controls' exclusively under the Enterprise tier ('Custom pricing'), with Core capped at Ona's own multi-tenant cloud only, and the compare table confirms Core's 'Compute Deployment' as 'Ona Cloud (multi-tenant)' versus Enterprise's 'Self-hosted, Ona-managed VPC.' The only route into that tier from the pricing page is 'Request a demo' — there is no price shown and no self-serve path. Coder's free, self-hosted Community edition already includes 'Single Sign-On (OpenID Connect)' and lets users 'Assign long-running tasks to AI coding agents' at $0, with no seat cap and no sales call required, so a security-conscious mid-market buyer can be running Coder in their own infrastructure the same afternoon while the equivalent Ona capability requires booking and surviving a sales cycle.

Why it matters: Buyers with basic security requirements (SSO) or infra-control requirements (self-hosting) who are not yet ready for a full enterprise contract have no paid self-serve tier to land on at Ona and default to Coder for free — a structural speed and pricing disadvantage in exactly the segment Ona's Enterprise tier targets.

There are two live AWS Marketplace product pages: prodview-752jqvg74yo7k ('Ona Enterprise', sold by 'Gitpod', 4.3/5 from 16 external reviews) and prodview-vn4wpn7u4afrq ('Ona Enterprise (US)', showing a PeerSpot-style review plus teaser titles of the same old Gitpod-era G2 reviews duplicated from the first listing). Competitor Coder has a single AWS listing ('Coder Premium Edition') at 4.7/5 from 7 ratings with visible 'Top 10' accolade badges, and AWS's own 'Product comparison' feature explicitly pairs Coder Premium Edition against 'Ona Enterprise' by seller name 'Gitpod' on the same comparison table — putting the fragmented, lower-rated, still-Gitpod-branded listing directly next to a cleaner competitor at the exact moment procurement teams decide who to shortlist.

Why it matters: Procurement teams comparing vendors inside AWS Marketplace see a fragmented, lower-rated, still-Gitpod-branded footprint sitting right next to a cleaner, higher-rated, badge-decorated Coder listing at the exact moment they're deciding who to shortlist.

Ona's homepage leads its 'what customers achieve' section with a quote from an unnamed 'Top 100 global company' claiming '90-95% of migration work is done by Ona Automations,' and its headline stats (4x productivity, 83% of PRs co-authored, 400% productivity increase, 24/7 runs) are attributed only to anonymized tags like 'Global pharma company' and 'Top 100 global company' — never a named company or person. Named logos on the homepage (BNY, GSR, Vanta, Pearson, EquipmentShare, Hargreaves Lansdown) carry only a 'Since [year]' tag with no attached result. Coder's homepage, by contrast, headlines named-company case studies with quantified outcomes ('Dropbox Boosts Dev Onboarding Speeds by 4x', 'J.B. Hunt Reduces Developer VDI Costs by 90%', 'Palantir Tames Environment Configuration Drift with Coder'), and GitHub Codespaces attributes quotes to named individuals with titles (Clint Chester, Developer Lead, Synergy; Keith Annette, Cloud Capability Lead, KPMG UK).

Why it matters: Enterprise buyers comparing vendors for a security-governance purchase will discount unverifiable anonymous stats against named, checkable case studies from direct competitors, weakening Ona's strongest proof point at the exact moment it's meant to close the deal, and enterprise security/procurement reviewers will use this to slow or stall deals.

Ona's pricing page shows exactly one self-serve tier, 'Core from $20 / month,' with no free plan listed anywhere on the page content fetched. Every named competitor gives a genuine zero-cost way in: GitHub Codespaces is free up to 60 hours/month, Cursor's Hobby tier is free with 'No credit card required,' Daytona gives '$200 in free compute included' on top of a pay-as-you-go floor, and Coder's Community edition is free and open-source indefinitely. For a buyer comparing 'infrastructure to run AI coding agents,' Ona is the only option in this set that requires a paid commitment before first use.

Why it matters: In a category where four out of five named rivals let a developer try the product for free before typing in a credit card, Ona's $20/mo floor is a real conversion tax on the exact self-serve individual/small-team buyer its Core tier claims to target.

On gitpod.io/pricing, the plan-comparison table lists the Free plan's included OCUs as "40 OCUs (one time)" versus Core's "80 - 2,200 OCUs (monthly recurring)" — the free allocation is explicitly one-off, not a recurring monthly quota. GitHub Codespaces, by contrast, states its free allowance is "120 core hours or 60 hours of run time on a 2 core codespace, plus 15 GB of storage each month," a quota that resets every month indefinitely. This means an individual developer or small team evaluating Ona for free burns through their entire allotment once and then must pay, while the same evaluator can keep using Codespaces for free indefinitely at low volume.

Why it matters: A one-time free grant converts evaluators into paying customers faster but also disqualifies Ona from the low-commitment, indefinitely-free 'try it on a side project' use case that Codespaces still owns, ceding that acquisition channel entirely.

Ona's pricing page shows "Core from $20/month" and "80 - 2,200 OCUs," but never states what an OCU costs in dollars or how fast it drains; that information ("Standard | 4 vCPUs / 16GB RAM | 1 OCU/hour", "GPU-accelerated | 16 vCPUs / 64GB RAM | 7 OCUs/hour", agent-task costs like "Add a feature to medium codebase | 8" OCUs) only appears in a separate docs page. Ona's own pricing FAQ additionally admits OCU consumption per task is highly variable ('there is a large variability in the number of OCUs consumed for each task'), ranging from 1 OCU to explain a small codebase up to 8 OCUs to add a feature to a medium codebase. Daytona, by contrast, publishes exact per-resource dollar rates directly on its pricing page ('Compute, vCPU, $0.0504/h, Memory, GiB, $0.0162/h, Storage, GiB, $0.000108/h', billed per second), and Cursor's paid tiers are flat, fixed monthly prices ($20/mo Individual, $40/user/mo Teams) rather than a variable usage credit.

Why it matters: Buyers cannot forecast their real monthly spend from Ona's pricing page alone, and a buyer who cannot predict their bill defaults to the competitor whose pricing math is a one-line multiplication — pushing budget-conscious or procurement-gated evaluators toward Daytona or Cursor before they ever request an Ona demo.

Ona's pricing page states Core add-on OCUs cost a flat "from $10 / 40 OCUs" with no tiered or volume-based pricing shown, and the only alternative unit economics come from Enterprise's "Custom credits," which requires a sales conversation. Daytona explicitly markets scaling discounts within its self-serve, no-sales-call tier: "Pay as you go with usage-based pricing" and "Unlock volume discounts as you scale." A Core customer on Ona who outgrows the $20-$220ish OCU-add-on range has no self-serve path to better pricing — they must go straight to a custom Enterprise quote, even if all they need is more compute at a better rate, not VPC/SSO/audit features.

Why it matters: Growing Core customers who just need cheaper bulk compute — not enterprise governance features — are forced into a full sales cycle for better pricing, adding friction and sales-cycle cost to a segment Ona could otherwise retain and expand with a simple tiered discount.

Ona's trust center and homepage display a generic 'SOC 2' badge with a document simply labeled 'SOC 2 Report' — no Type I/Type II distinction visible on the page. Daytona's trust center explicitly lists both 'SOC 2 Type 1' and 'SOC 2 Type 2' as separate compliance badges plus HIPAA. Coder's footer displays an explicit 'SOC 2 Type II Certified' badge. Cursor's security page states outright that 'A SOC 2 Type II attestation report is available on request.' For a security-conscious enterprise buyer, Type II (proving controls operated effectively over time) is materially stronger evidence than Type I (a point-in-time design check), and Ona is the only one of the four not stating which it has on the page.

Why it matters: Enterprise security questionnaires and procurement checklists specifically ask for Type II; an ambiguous badge forces extra back-and-forth or reads as weaker than competitors who state it upfront, adding friction at exactly the stage (security review) Ona's own Trust Center is trying to shortcut.

Ona markets itself as 'Orchestrated, governed, secured at the kernel' with a dedicated 'Veto' kernel-level security product, but its own Trust Center's public 'Security Notifications' log lists multiple past incidents: an OAuth token exposure (Aug 2025), an account-impersonation bug that forced re-authentication of all Gitpod Cloud users, and a CVE-2023-0957 vulnerability that could allow shared-workspace takeover. None of the competitor security pages fetched (Cursor's security page, Daytona's trust center summary) surfaced an equivalent public incident log on the page checked. This is a double-edged asset: transparency is good, but a buyer doing diligence on a company now positioning itself as the security layer for AI agents will find a track record of exactly the class of vulnerability (auth/token handling) that agent governance is supposed to prevent.

Why it matters: Buyers evaluating Ona specifically for its security/governance pitch will read this incident history against the current kernel-security claim, and a competitor sales rep can use it directly in a security-review objection.