Snapshot 258017
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content Ory Network and Ory Enterprise License Ory offers two commercial products built on Ory Open Source software: Ory Network and the Ory Enterprise License (OEL). Ory Network is a managed cloud service that provides planet-scale, low-latency, resilient, and secure infrastructure. It's the most convenient way to run Ory. The Ory Enterprise License enables organizations to run Ory software on their own infrastructure with enterprise features, dedicated support, and builds optimized for production environments. Both commercial offerings share the same security and compliance standards covered by this trust center. security@ory.com Privacy PolicyOpens in new tab Compliance ISO 27001:2022 SOC 2 Type 2 PCI DSS v4.0.1 SAQ D for Service Providers GDPR Data Privacy Framework Resources View all Compliance Attestations & Certificates Ory Corp - SOC 2 Type 2 - Report - 2026 Ory Corp - PCI 4.0.1 SAQ-D for Service Providers - AOC - 2026 Penetration Tests Pentest - 2025-Q4 - Ory Cloud Implementation & Codebase (ORY-11) - Cure 53 - Summary Report Pentest - 2025-Q4 - Ory GCP Environment & Infra (ORY-10) - Cure 53 - Summary Report Legal Documents Privacy Policy Opens in new tab DPA Opens in new tab Controls View all Infrastructure security Unique production database authentication enforced Encryption key access restricted Unique account authentication enforced View 17 more Infrastructure security controls Organizational security Asset disposal procedures utilized Production inventory maintained Portable media encrypted View 11 more Organizational security controls Product security Data encryption utilized Control self-assessments conducted Penetration testing performed View 2 more Product security controls Internal security procedures Continuity and Disaster Recovery plans established Continuity and Disaster Recovery plans tested Cybersecurity insurance maintained View 30 more Internal security procedures controls Data and privacy Data retention procedures established Customer data deleted upon leaving Data classification policy established Subprocessors View all Google Cloud Platform • IaaS infrastructure: Network, GKE Clusters, Compute, Storage, Cache USA, EU, Japan GCP is a public cloud vendor that offers a suite of computing services to do everything from data management to delivering web and video over the web to AI and machine learning tools. Cloudflare • DDOs Protection, Managed WAF, Rate Limiting, DNS Management, TLS & Custom Hostname Certs and CDN Global (see DPA) Integrated security and performance for websites, apps, and SaaS services. Request a demo. Designed to make everything you connect to the Internet secure, private, fast, & reliable. Cockroach Labs • Multi-region Database solution. USA, EU, Japan CockroachDB Dedicated provides fully-managed, single-tenant CockroachDB clusters with no shared resources. CockroachDB Dedicated supports multi-region clusters on GCP. Mailgun • Mail Service Belgium, Germany SaaS Solution sending emails. Updates View all Compliance Ory Completes PCI DSS v4.0.1 SAQ D for Service Providers Published June 3, 2026 Ory Corp has successfully completed its PCI DSS v4.0.1 SAQ D for Service Providers assessment, with an overall Compliant rating. The Qualified Security Assessor, BARR Advisory, performed the testing procedures. Ory is a service provider and does not store, process, or transmit account data. The scope covers Ory Network, and the assessment reflects the design and implementation of our controls against the applicable PCI DSS requirements as of the assessment date. The Attestation of Compliance (AOC) is available under Resources in the Trust Center. Compliance Ory Corp Completes 2025-2026 SOC 2 Type 2 Audit Published May 12, 2026 Ory Corp has successfully completed its SOC 2 Type 2 audit for the period April 1, 2025 to March 31, 2026 with no exceptions noted. The audit was conducted by BARR Advisory, P.A., a licensed CPA firm. The report covers the Trust Services Criteria relevant to Security, Confidentiality, and Availability. SOC 2 Type 2 attests to the suitability of design and operating effectiveness of our controls throughout the full twelve-month audit period. The scope covers Ory Network. The updated report is available under Resources in the Trust Center. Compliance Ory Corp Recertified to ISO/IEC 27001:2022 Published April 20, 2026 Ory Corp has successfully completed its ISO/IEC 27001:2022 recertification audit with no findings. The audit was conducted by BARR Certifications, an ANAB-accredited certification body. This recertification renews our ISO/IEC 27001 certification for a full three-year cycle, with annual surveillance audits scheduled to maintain continuous compliance. The scope covers the Information Security Management System supporting the Ory Identity Platform. The updated certificate is available under Resources in the Trust Center. Security Security Assessment Update: Q4 2024 Published February 12, 2025 We are pleased to announce the completion of two comprehensive security assessments conducted by Cure53 in Q4 2024. These assessments covered both the Ory Network services and our infrastructure setup. Ory Network Services A thorough evaluation of the Ory Network and its components was performed across five work packages, covering Ory Network UI & CLI, Login & Authentication, Identity Management, Permissions & Access Control, and API Access with OAuth2/Machine-To-Machine capabilities. The assessment identified eight findings: two low-to-medium severity vulnerabilities and six general recommendations. Our team is actively working on implementing fixes and improvements to address these findings. Notably, no critical or high-severity issues were discovered, demonstrating our platform's robust security posture. Ory Network Infrastructure A separate review of our infrastructure configuration revealed only two low-risk findings. This exceptional result validates the effectiveness of our security measures and infrastructure implementation. Both assessments were conducted using white-box methodology, providing Cure53's security experts with full access to our source code and documentation. The complete absence of critical findings and the minimal number of vulnerabilities underscore our commitment to maintaining the highest security standards. We maintain our commitment to regular security assessments and continuous improvement of our security measures.