Ory
Ory Corp (EU-Vertretung: Ory Germany GmbH, München) ·www.ory.com· As of: 2026-07-30
Our verdict
An identity layer wins no business. Without one you end up building it on the side and carry session bugs, password hashes and login weaknesses as a permanent drag. With one you are still not distinguishable. Enterprise sign-in over SAML or OpenID Connect opens doors in sales, but it opens the same doors for every competitor who offers it too. The edge sits behind the login, not in it.
Who it fits
Solo
suitable with caveats
The free plan has no production environment. Going live means either 770 US dollars a year or running the open source servers yourself, trading licence cost for operating effort.
Mid-market
suitable
770 US dollars a year plus usage stays predictable for a product with a few hundred daily active users, and storing personal data in the EU carries no surcharge.
Enterprise
suitable with caveats
Exactly the items enterprise procurement asks for sit behind an enterprise contract with no public price: one-click SAML sign-in, unlimited organisations, readable event streams and the 99.99 percent uptime commitment.
Buy, switch or build
Off-the-shelf
Bought identity platform
Auth0, Okta or Entra ship login screens, an admin console and compliance evidence out of the box. Getting started is faster because you build no interface. You pay with per-active-user pricing that rises exactly when your own product succeeds, and with a data store you only leave at some cost.
AI-native
No AI-native replacement, but a new neighbourhood
There is no AI-native replacement for the identity layer itself. Something else is new: identities for agents and services. Anyone running AI processes inside their own product has to grant them rights that can be traced and revoked one by one. Ory addresses this with machine tokens and permission checks in the same product. That extends the category, it does not replace it.
Build it yourself
Build the login yourself
It looks harmless at the start: a user table, a password hash, a session cookie. The continuation is what costs, meaning multi-factor, account recovery, device changes, passkeys, SAML for enterprise customers and review by other people's security teams during procurement. Building it yourself only holds up when the login is the product.
Our advice
- Solo: Self-host or take the production plan, but do not build it yourself.
- Mid-market: Buy, pick EU storage when creating the project and watch the usage lines every month.
- Enterprise: Buy, but pin down SAML, event streams and storage region in writing before signing.
Who is behind it
Staying power: Funded
Venture funded. The most recent publicly documented round is a Series A extension in April 2024; we found no Series B. The counterweight is the Apache-2.0 open source core, which keeps running even if the vendor were to shut the hosted network down.
- Series A: USD 22.5 million led by Insight Partners, with Balderton Capital and In-Q-Tel, December 2021 · Source · As of 2026-07-30
- Most recent documented round: USD 5 million Series A extension, April 2024 · Source · As of 2026-07-30
- Open source core: Hydra and Kratos under Apache-2.0, around 17,400 and 13,800 stars on GitHub · Source · As of 2026-07-30
- Certifications: ISO 27001 and SOC 2 Type 2 · Source · As of 2026-07-30
- Legal entity: Ory Corp, Scottsdale, Arizona, USA, with Ory Germany GmbH, Karlsplatz 3, Munich, as the EU representative · Source · As of 2026-07-30
- Commercial register: Ory Germany GmbH, Munich local court (Amtsgericht München), HRB 246729 · Source · As of 2026-07-30
- Operating scale per vendor claim: 3.3 billion identities under management, customers including OpenAI and Mistral AI · Source · As of 2026-07-30
Cost of leaving: Low
The way out leads into the same software. Identities can be read out through the admin API including hashed credentials, the configuration exported through the command line, and both loaded into a self-hosted Kratos. What remains is not a data problem but an operating one: database, upgrades and on-call duty then sit with your own team.
Regulation and data
| Data processing agreement | publicly available data processing agreement with standard contractual clauses, as of 24 March 2025The document is openly available as a PDF. Whether it is incorporated automatically or has to be signed is not stated on the page.Source · As of 2026-07-30 |
|---|---|
| Storage location | EU selectable for personal data, operational data replicated globallyThe region is chosen when the project is created and is included in the Production and Growth plans. Operational data such as session and permission checks is globally replicated per the vendor. The Global and US Continental options are reserved for enterprise customers.Source · As of 2026-07-30 |
| Subprocessors | unclearWe found no public subprocessor list for the hosted network. The trust centre requires an access request, and the privacy policy names only website-related services such as PostHog, HubSpot, Sanity and Cloudflare.Source · As of 2026-07-30 |
| Third-country transfer | United States, standard contractual clauses included in the data processing agreementThe controller is Ory Corp in Scottsdale, Arizona. Ory Germany GmbH in Munich is named as the EU representative, not as the contracting party. The DPA carries standard contractual clauses in its file name.Source · As of 2026-07-30 |
| Training on customer data | unclearNeither the security page nor the privacy policy states whether customer data from the hosted network is used to train models. Since the product offers agent identity features, the question belongs in contract talks.no source given · As of 2026-07-30 |
| Retention and deletion | unclearThe security page names encrypted backups and a regular backup strategy but no retention periods. The privacy policy covers retention only for website data, not for identities in the hosted network. Deleting a single user is covered by a documented API.no source given · As of 2026-07-30 |
| Certifications | ISO 27001 and SOC 2 Type 2 held by the vendor, PCI DSS also namedThe SOC 2 report is not published but handed out on request through the trust centre. Encryption is stated as AES-256 at rest and TLS 1.2 or higher in transit, plus third-party penetration testing.Source · As of 2026-07-30 |
| EU AI Act, Article 50 | unclearWe found no vendor statement on the transparency duties under Article 50. The service produces no content towards end users, so the duty would fall on the operator of the application rather than on the identity layer beneath it.no source given · As of 2026-07-30 |
| Audit logging | access is logged, readable event streams only under an enterprise contractThe security page states that all access is logged for audit and incident analysis. Reading those events yourself or piping them into your own systems requires an enterprise contract per the documentation.Source · As of 2026-07-30 |
What it really costs
Entry price
The developer plan is free but has no production environment, one member and two development environments. Production starts at 770 US dollars a year with a 21 US dollar monthly credit, one production and three staging environments. Self-hosting carries no licence fee under Apache-2.0.
Source · As of2026-07-30
What gets expensive
Usage, not the base fee. Fourteen cents per average daily active user per month, where the included 21 US dollar credit covers roughly 150 of them by arithmetic. On top of that 0.007 US dollars per machine token and 0.000090 US dollars per permission check. The next plan jumps to 9,350 US dollars a year, and whatever enterprise procurement demands sits behind an enterprise contract with no public price.
What it displaces
- Home-grown user management
- Login platform priced per active user
Interfaces
- REST APIs for administration and for the application itself
- OAuth 2.0 and OpenID Connect through Ory Hydra
- SAML through Ory Polis
- Ory command line tool for configuration and projects
- Event streams into your own systems, enterprise contract only
At Convios: Not used by us
Not in use. Our own sign-in and access do not run through a dedicated identity platform. This assessment therefore rests on public evidence alone, not on operating experience.
Matching methods
Evidence
- 1.Plans, free limits, usage prices and enterprise-only features · As of 2026-07-30
- 2.ISO 27001, SOC 2 Type 2, encryption, access logging, trust centre · As of 2026-07-30
- 3.Choice of storage region for personal data, global replication of operational data · As of 2026-07-30
- 4.Data processing agreement with standard contractual clauses, dated 24 March 2025 · As of 2026-07-30
- 5.Controller Ory Corp in the USA, Ory Germany GmbH as EU representative · As of 2026-07-30
- 6.Export of identities including hashed credentials through the admin API · As of 2026-07-30
- 7.Core under Apache-2.0, Hydra and Kratos as open source servers · As of 2026-07-30
- 8.Event streams only for enterprise contracts · As of 2026-07-30
Last reviewed: 2026-07-30byDr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.