# Ory

> Sign-in, registration, sessions, multi-factor and access rights have to work in every product with more than one user. Ory supplies that layer either as a hosted service or as open source servers you run yourself.

- Vendor: Ory Corp (EU-Vertretung: Ory Germany GmbH, München)
- Canonical URL: https://www.convios.com/en/toolbox/ory
- Language version: https://www.convios.com/de/werkzeugkasten/ory
- Area: Governance & security · Cluster: identity and access
- Role: Building block · Origin: Established
- As of: 2026-07-30 · Reviewed: 2026-07-30 · Author: Dr. Oliver Gausmann, Convios GmbH
- Toolbox: https://www.convios.com/en/toolbox — Markdown: https://www.convios.com/en/toolbox.md

## Verdict

Prevents falling behind: An identity layer wins no business. Without one you end up building it on the side and carry session bugs, password hashes and login weaknesses as a permanent drag. With one you are still not distinguishable. Enterprise sign-in over SAML or OpenID Connect opens doors in sales, but it opens the same doors for every competitor who offers it too. The edge sits behind the login, not in it.

## Suitability by company size

- Solo: suitable with caveats — The free plan has no production environment. Going live means either 770 US dollars a year or running the open source servers yourself, trading licence cost for operating effort.
- Mid-market: suitable — 770 US dollars a year plus usage stays predictable for a product with a few hundred daily active users, and storing personal data in the EU carries no surcharge.
- Enterprise: suitable with caveats — Exactly the items enterprise procurement asks for sit behind an enterprise contract with no public price: one-click SAML sign-in, unlimited organisations, readable event streams and the 99.99 percent uptime commitment.

## Vendor staying power

Funded: Venture funded. The most recent publicly documented round is a Series A extension in April 2024; we found no Series B. The counterweight is the Apache-2.0 open source core, which keeps running even if the vendor were to shut the hosted network down.

- Series A: USD 22.5 million led by Insight Partners, with Balderton Capital and In-Q-Tel, December 2021 (source: https://www.insightpartners.com/ideas/cloud-security-provider-ory-corp-raises-22-million-in-series-a-round-led-by-insight-partners/, as of 2026-07-30)
- Most recent documented round: USD 5 million Series A extension, April 2024 (source: https://www.ory.com/blog/series-a-extension, as of 2026-07-30)
- Open source core: Hydra and Kratos under Apache-2.0, around 17,400 and 13,800 stars on GitHub (source: https://github.com/ory/hydra, as of 2026-07-30)
- Certifications: ISO 27001 and SOC 2 Type 2 (source: https://www.ory.com/security, as of 2026-07-30)
- Legal entity: Ory Corp, Scottsdale, Arizona, USA, with Ory Germany GmbH, Karlsplatz 3, Munich, as the EU representative (source: https://www.ory.com/legal/privacy, as of 2026-07-30)
- Commercial register: Ory Germany GmbH, Munich local court (Amtsgericht München), HRB 246729 (source: https://www.northdata.com/Ory%20Germany%20GmbH,%20M%C3%BCnchen/HRB%20246729, as of 2026-07-30)
- Operating scale per vendor claim: 3.3 billion identities under management, customers including OpenAI and Mistral AI (source: https://www.ory.com, as of 2026-07-30)

## Cost of leaving

Low: The way out leads into the same software. Identities can be read out through the admin API including hashed credentials, the configuration exported through the command line, and both loaded into a self-hosted Kratos. What remains is not a data problem but an operating one: database, upgrades and on-call duty then sit with your own team.

## Regulation and data

| Point | Finding | Evidence | As of |
|---|---|---|---|
| Data processing agreement | publicly available data processing agreement with standard contractual clauses, as of 24 March 2025 — The document is openly available as a PDF. Whether it is incorporated automatically or has to be signed is not stated on the page. | evidenced | 2026-07-30 |
| Storage location | EU selectable for personal data, operational data replicated globally — The region is chosen when the project is created and is included in the Production and Growth plans. Operational data such as session and permission checks is globally replicated per the vendor. The Global and US Continental options are reserved for enterprise customers. | partially evidenced | 2026-07-30 |
| Subprocessors | unclear — We found no public subprocessor list for the hosted network. The trust centre requires an access request, and the privacy policy names only website-related services such as PostHog, HubSpot, Sanity and Cloudflare. | partially evidenced | 2026-07-30 |
| Third-country transfer | United States, standard contractual clauses included in the data processing agreement — The controller is Ory Corp in Scottsdale, Arizona. Ory Germany GmbH in Munich is named as the EU representative, not as the contracting party. The DPA carries standard contractual clauses in its file name. | evidenced | 2026-07-30 |
| Training on customer data | unclear — Neither the security page nor the privacy policy states whether customer data from the hosted network is used to train models. Since the product offers agent identity features, the question belongs in contract talks. | partially evidenced | 2026-07-30 |
| Retention and deletion | unclear — The security page names encrypted backups and a regular backup strategy but no retention periods. The privacy policy covers retention only for website data, not for identities in the hosted network. Deleting a single user is covered by a documented API. | partially evidenced | 2026-07-30 |
| Certifications | ISO 27001 and SOC 2 Type 2 held by the vendor, PCI DSS also named — The SOC 2 report is not published but handed out on request through the trust centre. Encryption is stated as AES-256 at rest and TLS 1.2 or higher in transit, plus third-party penetration testing. | evidenced | 2026-07-30 |
| EU AI Act, Article 50 | unclear — We found no vendor statement on the transparency duties under Article 50. The service produces no content towards end users, so the duty would fall on the operator of the application rather than on the identity layer beneath it. | partially evidenced | 2026-07-30 |
| Audit logging | access is logged, readable event streams only under an enterprise contract — The security page states that all access is logged for audit and incident analysis. Reading those events yourself or piping them into your own systems requires an enterprise contract per the documentation. | partially evidenced | 2026-07-30 |

## Cost

- Entry: The developer plan is free but has no production environment, one member and two development environments. Production starts at 770 US dollars a year with a 21 US dollar monthly credit, one production and three staging environments. Self-hosting carries no licence fee under Apache-2.0. (as of 2026-07-30)
- Where it gets expensive: Usage, not the base fee. Fourteen cents per average daily active user per month, where the included 21 US dollar credit covers roughly 150 of them by arithmetic. On top of that 0.007 US dollars per machine token and 0.000090 US dollars per permission check. The next plan jumps to 9,350 US dollars a year, and whatever enterprise procurement demands sits behind an enterprise contract with no public price.

## Three routes compared

### Bought identity platform

Auth0, Okta or Entra ship login screens, an admin console and compliance evidence out of the box. Getting started is faster because you build no interface. You pay with per-active-user pricing that rises exactly when your own product succeeds, and with a data store you only leave at some cost.

### No AI-native replacement, but a new neighbourhood

There is no AI-native replacement for the identity layer itself. Something else is new: identities for agents and services. Anyone running AI processes inside their own product has to grant them rights that can be traced and revoked one by one. Ory addresses this with machine tokens and permission checks in the same product. That extends the category, it does not replace it.

### Build the login yourself

It looks harmless at the start: a user table, a password hash, a session cookie. The continuation is what costs, meaning multi-factor, account recovery, device changes, passkeys, SAML for enterprise customers and review by other people's security teams during procurement. Building it yourself only holds up when the login is the product.

Recommendation by size:

- Solo: Self-host or take the production plan, but do not build it yourself.
- Mid-market: Buy, pick EU storage when creating the project and watch the usage lines every month.
- Enterprise: Buy, but pin down SAML, event streams and storage region in writing before signing.

## Context

- Implements method: [The Five Animals: ACV-to-GTM Model](https://www.convios.com/en/methods/five-ways-acv-model) — The model assigns each contract size its own route to market, and from the enterprise tier upward the deal hangs on SAML or OpenID Connect login, which Ory brings as a ready-made layer.
- Implements method: [Minimizing Need-to-Believes](https://www.convios.com/en/methods/need-to-believes) — The method removes open assumptions from the buying decision, and questions about session security, multi-factor and permissions drop off the list once a vetted identity layer sits underneath instead of one built on the side.
- Displaces: Home-grown user management, Login platform priced per active user

## Evidence

- Plans, free limits, usage prices and enterprise-only features — https://www.ory.com/pricing (as of 2026-07-30)
- ISO 27001, SOC 2 Type 2, encryption, access logging, trust centre — https://www.ory.com/security (as of 2026-07-30)
- Choice of storage region for personal data, global replication of operational data — https://www.ory.com/docs/security-compliance/personal-data-location (as of 2026-07-30)
- Data processing agreement with standard contractual clauses, dated 24 March 2025 — https://www.ory.com/legal/dpa (as of 2026-07-30)
- Controller Ory Corp in the USA, Ory Germany GmbH as EU representative — https://www.ory.com/legal/privacy (as of 2026-07-30)
- Export of identities including hashed credentials through the admin API — https://www.ory.com/docs/kratos/manage-identities/export-user-accounts-identities (as of 2026-07-30)
- Core under Apache-2.0, Hydra and Kratos as open source servers — https://www.ory.com/open-source (as of 2026-07-30)
- Event streams only for enterprise contracts — https://www.ory.com/docs/actions/live-events (as of 2026-07-30)