Ory

Ory: frequently asked questions

How much does Ory cost?

Ory prices on average daily active users, not monthly active users, which makes direct comparison with most CIAM vendors misleading. Developer is free with 2 development environments and 1 member. Production is 770 dollars per year and includes a 21 dollar monthly usage credit, 1 production environment, 3 staging, 5 development and unlimited members. Growth is 9,350 dollars per year with a 255 dollar monthly credit, 2 production environments and 20 development. Usage beyond the credit runs at 0.14 dollars per aDAU per month on Production and 0.12 on Growth, plus 0.007 or 0.006 per machine-to-machine token and roughly 0.00009 per permission check. Enterprise is custom. Self-hosting the open-source builds is free; the commercial Ory Enterprise License is quoted, not listed.

Is Ory genuinely open source?

Yes, at the licence level. Every component is Apache 2.0 with no field-of-use restriction and no user cap: Kratos, Hydra, Keto, Oathkeeper, Polis, Fosite and Talos. There has been no relicensing event, no move to BUSL or SSPL, which distinguishes Ory sharply from HashiCorp and from open-core vendors with proprietary enterprise directories. The catch is feature-gating rather than licence-gating. Certain capabilities ship only in Ory Enterprise License binaries, including B2B organisations and multi-tenancy in Kratos, the OAuth 2.0 resource owner password credentials grant, verifiable credentials and custom token prefixes in Hydra, plus guaranteed CVE patching under SLA. OEL is distributed as a Docker image from a private authenticated registry, not as a public release. So the licence is fully open, and the open-source build is not the same product as the commercial one.

What are Ory's components and do they work independently?

Yes, each server runs standalone. Kratos handles identity, credentials, sessions and self-service flows including passwords, social sign-in, OIDC, passkeys and SCIM. Hydra is an OpenID Certified OAuth 2.0, OAuth 2.1 and OIDC provider. Keto implements relationship-based authorization following Google's Zanzibar paper, supporting RBAC and ABAC. Oathkeeper is a zero-trust identity and access proxy. Polis, formerly BoxyHQ Jackson, provides enterprise SSO via SAML and OIDC with SAML IdP mode and SCIM 2.0 directory sync against Okta, Microsoft Entra ID and Google Workspace. Talos manages machine-to-machine API credentials.

Has Ory had security vulnerabilities?

Yes, and one deserves attention. On 20 March 2026 Ory published a coordinated advisory across Kratos, Hydra, Keto, Oathkeeper and Polis, fixed in v26.2.0. CVE-2026-33503 and CVE-2026-33504, both CVSS 7.2 High, were SQL injection flaws in admin API list endpoints reachable through forged pagination tokens. The operationally important detail: they are exploitable using the publicly known default secret when secrets.pagination is left unset. Anyone self-hosting Ory should confirm that value is configured and that they are on v26.2.0 or later. Earlier issues affected Fosite, including a missing jti uniqueness check under private_key_jwt.

Did Ory acquire BoxyHQ?

Yes, announced 29 May 2025 on undisclosed terms. BoxyHQ was London and India based; its team joined Ory and co-founder Deepak Prabhakara became Head of Enterprise Integrations. BoxyHQ Jackson was rebranded Ory Polis and remains Apache 2.0. It fills a real gap, giving Ory a dedicated enterprise SSO and SCIM directory-sync component rather than expecting Kratos to cover B2B federation alone.

Is Ory still a German company?

German-founded, now US-headquartered. Ory Corp states Scottsdale, Arizona as its headquarters, with Ory Germany GmbH in Munich as a subsidiary. Jeff Kukowski became CEO in April 2024 alongside a 5 million dollar Series A extension led by Insight Ventures and Balderton Capital; founder Aeneas Rekkas remains CTO. Note also that Ory's primary domain moved from ory.sh to ory.com. EU data residency remains available, with self-service region selection on all paid plans and the option to keep personal data on EU servers.

What compliance does Ory hold?

SOC 2 Type 2, with the report available on request through its trust centre, and ISO 27001:2022. Older ory.sh pages still reference ISO 27001:2013; the current certification is 2022. Data residency covers US East, US West and EU Central with self-service selection, three super-regions across Europe, North America and Japan, and enterprise-only Global and US Continental options. Personal data is homed to one region and replicated across at least three availability zones. HIPAA and CCPA attestations are not claimed.

What are the best Ory alternatives?

Keycloak for a mature, fully open-source self-hosted platform with no commercial feature-gating. Zitadel for a modern open-source alternative with a similar managed-or-self-hosted model. Auth0 or WorkOS if you would rather buy a managed product than assemble components. FusionAuth for self-hosted CIAM with straightforward licensing. Ory's distinguishing argument remains that its components are genuinely Apache 2.0 and genuinely standalone, so you can adopt only Hydra for OAuth or only Keto for authorization without taking the rest.