Ory GmbH

Ory Corp has successfully completed its PCI DSS v4.0.1 SAQ D for Service Providers assessment, with an overall Compliant rating. The Qualified Security Assessor, BARR Advisory, performed the testing procedures. Ory is a service provider and does not store, process, or transmit account data. The scope covers Ory Network, and the assessment reflects the design and implementation of our controls against the applicable PCI DSS requirements as of the assessment date. The Attestation of Compliance (AOC) is available under Resources in the Trust Center.

Ory Corp has successfully completed its SOC 2 Type 2 audit for the period April 1, 2025 to March 31, 2026 with no exceptions noted. The audit was conducted by BARR Advisory, P.A., a licensed CPA firm. The report covers the Trust Services Criteria relevant to Security, Confidentiality, and Availability. SOC 2 Type 2 attests to the suitability of design and operating effectiveness of our controls throughout the full twelve-month audit period. The scope covers Ory Network. The updated report is available under Resources in the Trust Center.

Ory Corp has successfully completed its ISO/IEC 27001:2022 recertification audit with no findings. The audit was conducted by BARR Certifications, an ANAB-accredited certification body. This recertification renews our ISO/IEC 27001 certification for a full three-year cycle, with annual surveillance audits scheduled to maintain continuous compliance. The scope covers the Information Security Management System supporting the Ory Identity Platform. The updated certificate is available under Resources in the Trust Center.

We are pleased to announce the completion of two comprehensive security assessments conducted by Cure53 in Q4 2024. These assessments covered both the Ory Network services and our infrastructure setup. Ory Network Services A thorough evaluation of the Ory Network and its components was performed across five work packages, covering Ory Network UI & CLI, Login & Authentication, Identity Management, Permissions & Access Control, and API Access with OAuth2/Machine-To-Machine capabilities. The assessment identified eight findings: two low-to-medium severity vulnerabilities and six general recommendations. Our team is actively working on implementing fixes and improvements to address these findings. Notably, no critical or high-severity issues were discovered, demonstrating our platform's robust security posture. Ory Network Infrastructure A separate review of our infrastructure configuration revealed only two low-risk findings. This exceptional result validates the effectiveness of our security measures and infrastructure implementation. Both assessments were conducted using white-box methodology, providing Cure53's security experts with full access to our source code and documentation. The complete absence of critical findings and the minimal number of vulnerabilities underscore our commitment to maintaining the highest security standards. We maintain our commitment to regular…

We are pleased to announce that Ory Corp has successfully self-certified in the Data Privacy Framework (DPF) as of May 30, 2024. The EU-U.S. DPF, UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF were developed by the U.S. Department of Commerce in collaboration with the European Commission, the UK Government, and the Swiss Federal Administration. These frameworks provide reliable mechanisms for personal data transfers to the United States from the European Union, United Kingdom, and Switzerland while ensuring data protection consistent with EU, UK, and Swiss law. This certification is a testament to our unwavering commitment to data privacy and our steadfast adherence to the highest standards of data protection.