# Ory Ory declares [11 subprocessors](https://thirdpartyindex.com/vendors/ory#subprocessors) in [its subprocessor list](https://trust.ory.com/subprocessors), which we last checked on 2026-11-11 ([evidence](https://thirdpartyindex.com/evidence/53503)). They include [Google Cloud](https://thirdpartyindex.com/vendors/google-cloud), [Stripe](https://thirdpartyindex.com/vendors/stripe) and [Cloudflare](https://thirdpartyindex.com/vendors/cloudflare). No published changes since we first read it on 2026-09-22. [3 tracked vendors](https://thirdpartyindex.com/vendors/ory#used-by) name Ory as a subprocessor, including [Mistral](https://thirdpartyindex.com/vendors/mistral), [1mind](https://thirdpartyindex.com/vendors/1mind) and [Lattice](https://thirdpartyindex.com/vendors/lattice). Ory (ory.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index. - Page: https://thirdpartyindex.com/vendors/ory - Documents last verified: 2026-11-11 - Transparency rating: 95/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 7/7; Data processing addendum 12/12; Trust center 8/8; Privacy policy 6/6; security.txt 6/6; Security page 5/5; Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8 - Supply chain: relies on 11 tracked vendors directly, 131 within two hops, 419 within three; 3 tracked vendors rely on it directly, 52 within two hops, 714 within three - Cite as: Ory, Third Party Index, https://thirdpartyindex.com/vendors/ory (data CC BY 4.0) ## Documents | Document | URL | Last verified | Last changed | |---|---|---|---| | Trust center | https://trust.ory.com/ | 2026-11-11 | 2026-11-11 | | Subprocessor list | https://trust.ory.com/subprocessors | 2026-11-11 | 2026-10-06 | | Data processing addendum | https://www.ory.com/legal/dpa | 2026-11-11 | 2026-11-02 | | Privacy policy | https://www.ory.com/legal/privacy | 2026-11-11 | 2026-11-02 | | Terms | https://www.ory.com/legal/tou | 2026-11-11 | 2026-11-02 | | Security page | https://www.ory.com/security | 2026-11-11 | 2026-09-22 | | security.txt | https://www.ory.com/.well-known/security.txt | 2026-11-11 | 2026-09-22 | | Status page | https://status.ory.com/ | 2026-11-11 | 2026-10-25 | ## Subprocessors (11) As its own list states them. | Subprocessor | Purpose | Location | Listed since | |---|---|---|---| | [Cloudflare](https://thirdpartyindex.com/vendors/cloudflare.md) | DDOs Protection, Managed WAF, Rate Limiting, DNS Management, TLS & Custom Hostname Certs and CDN; Integrated security and performance for websites, apps, and SaaS services. Request a demo. Designed to make everything you connect to the Internet secure, private, fast, & reliable. | Global (see DPA) | 2026-10-01 | | [Cockroach Labs](https://thirdpartyindex.com/vendors/cockroach-labs.md) | CockroachDB Dedicated provides fully-managed, single-tenant CockroachDB clusters with no shared resources. CockroachDB Dedicated supports multi-region clusters on GCP.; Multi-region Database solution. | USA, EU, Japan | 2026-10-01 | | [GitHub](https://thirdpartyindex.com/vendors/github.md) | Customer Support & Version control; Source Code and Issue Management Solution (OpenSource and Ory Cloud), discussion forum. | USA | 2026-10-01 | | [Google Cloud Platform](https://thirdpartyindex.com/vendors/google-cloud.md) | GCP is a public cloud vendor that offers a suite of computing services to do everything from data management to delivering web and video over the web to AI and machine learning tools.; IaaS infrastructure: Network, GKE Clusters, Compute, Storage, Cache | USA, EU, Japan | 2026-10-01 | | [Hubspot](https://thirdpartyindex.com/vendors/hubspot.md) | CRM Solution | USA | 2026-10-01 | | [Mailgun](https://thirdpartyindex.com/vendors/mailgun.md) | Mail Service; SaaS Solution sending emails. | Belgium, Germany | 2026-10-01 | | [Posthog](https://thirdpartyindex.com/vendors/posthog.md) | Data analytics; Product Analytics | EU | 2026-10-01 | | [Pylon Labs, Inc.](https://thirdpartyindex.com/vendors/pylon.md) | Customer support and ticketing (from 01.10.2026); Customer support and ticketing platform. | USA | 2026-10-01 | | [Slack](https://thirdpartyindex.com/vendors/slack.md) | Dedicated Support Channel and Community Workspace; Messaging platform used internally by Ory employees and externally to communicate with our customers and the community. | USA | 2026-10-01 | | [Stripe](https://thirdpartyindex.com/vendors/stripe.md) | Payment Handling for Ory Network | USA | 2026-10-01 | | [Zendesk](https://thirdpartyindex.com/vendors/zendesk.md) | Customer support and ticketing (until 31.10.2026); Ticket Management for Customers (until 31.10.2026) | USA | 2026-10-01 | Read from ([evidence](https://thirdpartyindex.com/evidence/28667)). CSV: https://thirdpartyindex.com/vendors/ory/subprocessors.csv ## Compliance As its trust center lists them. - Audited: SOC 2 Type II, ISO/IEC 27001 ([evidence](https://thirdpartyindex.com/evidence/3093)) - Claimed: GDPR, Data Privacy Framework ([evidence](https://thirdpartyindex.com/evidence/3093)) ## Web Technologies Ory's homepage made 180 requests to 25 domains, 10 services controlled by another company, and 1 domain not identified. Loaded on 2026-11-05 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data. 10 third parties by category: Analytics 5 (Crazy Egg, Reo.Dev, ZoomInfo, Cloudflare; usually detected as Analytics: G2.com); Advertising 3 (Google Cloud, Microsoft, Reddit, Inc.); Marketing automation 1 (HubSpot); CMS 1 (usually detected as CMS: Sanity). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these. ### Third parties (10) - Sanity: 41 requests to sanity.io - Google Cloud: 31 requests to google.com, doubleclick.net, googletagmanager.com, googleadservices.com; DoubleClick Floodlight, Google Analytics, Google Tag Manager (its subprocessor list names it too) - HubSpot: 21 requests to hsappstatic.net, hubspot.com, hs-analytics.net, hs-banner.com, hs-scripts.com, hsadspixel.net, hubapi.com, usemessages.com; HubSpot (its subprocessor list names it too) - Microsoft: 9 requests to bing.com, clarity.ms; Microsoft Advertising - Crazy Egg: 4 requests to crazyegg.com; Crazy Egg - G2.com: 3 requests to g2.com - Reddit, Inc.: 3 requests to reddit.com, redditstatic.com; Reddit Ads - Reo.Dev: 3 requests to reo.dev; Reo.Dev - ZoomInfo: 3 requests to zi-scripts.com, zoominfo.com; Zoominfo - Cloudflare: 1 request to cloudflareinsights.com; Cloudflare Browser Insights (its subprocessor list names it too) ### Unknown (1) Domains not identified yet: brilliantlocco.com ### First party (1) - Ory: 52 requests to ory.com; Cloudflare, Cloudflare Zaraz, HSTS, HubSpot Chat, Microsoft Clarity, Next.js 15.5.28, Next.js App Router, Open Graph, Priority Hints, Radix UI, React, Sanity, Sanity.io, Vercel, Vercel Speed Insights 1.3.1, Webpack 4 tracked companies loaded by the homepage are not in Ory's subprocessor list. A website can use a service without it processing customer data. ## Subprocessor of (3) Tracked vendors whose own subprocessor lists name it, and what they say they use it for. - [1mind](https://thirdpartyindex.com/vendors/1mind.md): Ory is data importer’s identity provider; data importer would transmit data exporter’s employee emails for administrators for the sole purpose of user authe… - [Lattice](https://thirdpartyindex.com/vendors/lattice.md): \* OPTIONAL - Authentication management (specifically for customers using Lattice MCP only) - [Mistral](https://thirdpartyindex.com/vendors/mistral.md): Products: All; User Authentication ## Service status Incidents it reported on its own status page. - Last 90 days: 3 reported incidents (0 major or critical, 2 minor, 1 with no impact stated) - Typical time to resolve: 4 h - Status page last read: 2026-11-12 - 2026-10-07: OIDC login failures affecting some identities (minor) - 2026-10-01: Increased latency and timeouts for Ory Identities API (minor) - 2026-09-02: Maintenance for Console Search API (no impact stated) - 2026-07-30: Webhook delivery is experiencing issues (minor) - 2026-07-23: Investigating SAML login issues (minor) - 2026-07-23: Investigating elevated issues (major) - 2026-07-14: Monitoring potential database issues (no impact stated) - 2026-07-14: Elevated response times for Ory Hydra in Europe (minor) ## Incidents reported by Ory's subprocessors Incidents reported in the last 30 days on their own status pages by 5 vendors Ory lists as subprocessors. A subprocessor list names a company, not the service an incident touched. - 2026-11-11: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Impact across multiple GitHub products including Actions, Pages, and Copilot products. (critical) - 2026-11-11: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Incident with Webhooks (minor) - 2026-11-11: [Pylon](https://thirdpartyindex.com/vendors/pylon#status), which Ory lists as a subprocessor, reported Slack Integration Connection Issues (major) - 2026-11-10: [HubSpot](https://thirdpartyindex.com/vendors/hubspot#status), which Ory lists as a subprocessor, reported Some HubSpot tools may be unavailable for some users (no impact stated) - 2026-11-10: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Incident with Git Operations and Pull Requests (critical) - 2026-11-09: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Degraded availability for GPT-5.3 Codex and GPT-5.6 models in Copilot (major) - 2026-11-09: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Incident with Actions and Checks API (critical) - 2026-11-09: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Incident with Webhooks and Actions (major) - 2026-11-09: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Increased timeouts due to surge in anonymous users (minor) - 2026-11-08: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Increase in timeouts for some unauthenticated users (minor) - 2026-11-05: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Degraded performance for multiple GitHub services (minor) - 2026-11-05: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Incident with Actions (minor) - 2026-11-05: [Pylon](https://thirdpartyindex.com/vendors/pylon#status), which Ory lists as a subprocessor, reported Delay in Analytics Data (minor) - 2026-11-04: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Incident with Actions (major) - 2026-11-04: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Incident with Actions and Pages (major) - 2026-11-04: [Pylon](https://thirdpartyindex.com/vendors/pylon#status), which Ory lists as a subprocessor, reported Inbound Email Delays (minor) - 2026-11-04: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Incident with Pull Requests, Git Operations and Issues (major) - 2026-11-04: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Increased task-related errors for Copilot Mission Control (minor) - 2026-11-03: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Incident with Git Operations (minor) - 2026-11-03: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Incident with API, Git, and Copilot requests (minor) - 2026-11-02: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Elevated errors on GPT-5.4 Nano (minor) - 2026-11-02: [HubSpot](https://thirdpartyindex.com/vendors/hubspot#status), which Ory lists as a subprocessor, reported HubSpot is experiencing issues (no impact stated) - 2026-11-01: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Ory lists as a subprocessor, reported Elevated Instant Payouts failures (no impact stated) - 2026-10-30: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Incident with Dependabot (minor) - 2026-10-30: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Incident with Actions, Pages, and Webhooks (major) - 2026-10-30: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Disruption with GitHub services (critical) - 2026-10-29: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Disruption with Copilot Cloud services (minor) - 2026-10-28: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Ory lists as a subprocessor, reported Elevated Issuing errors from 17:13 - 20:41 UTC (minor) - 2026-10-28: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Disruption with some Copilot services (critical) - 2026-10-28: [Mailgun](https://thirdpartyindex.com/vendors/mailgun#status), which Ory lists as a subprocessor, reported Route delays in EU Region (minor) - 2026-10-27: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Elevated 404s for GitHub App s2s tokens in git/API (no impact stated) - 2026-10-26: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Incident with Actions, Issues, API Requests and Pull Requests (minor) - 2026-10-24: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Ory lists as a subprocessor, reported Elevated Blik errors (no impact stated) - 2026-10-23: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Grok 4.6 and Grok 4.7 Service Issues (minor) - 2026-10-23: [HubSpot](https://thirdpartyindex.com/vendors/hubspot#status), which Ory lists as a subprocessor, reported Some HubSpot tools may be unavailable for some users (no impact stated) - 2026-10-23: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Disruption with Dependabot Alerts (minor) - 2026-10-23: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Delayed Actions status check results (minor) - 2026-10-22: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Ory lists as a subprocessor, reported Elevated Bancontact errors (no impact stated) - 2026-10-22: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Project updates delayed (minor) - 2026-10-22: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Ory lists as a subprocessor, reported Elevated Bancontact errors (no impact stated) - 2026-10-22: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Incident with Actions (minor) - 2026-10-22: [HubSpot](https://thirdpartyindex.com/vendors/hubspot#status), which Ory lists as a subprocessor, reported Update on PHP security vulnerability (no impact stated) - 2026-10-21: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Delays for Pull Requests and Webhook deliveries (critical) - 2026-10-20: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Ory lists as a subprocessor, reported Spike in cancellations and expired errors with PayByBank payments (no impact stated) - 2026-10-20: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Ory lists as a subprocessor, reported Elevated Revolut Pay errors (no impact stated) - 2026-10-19: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported Degraded availability for GitHub Actions, GitHub Pages and Webhooks (critical) - 2026-10-15: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Ory lists as a subprocessor, reported Elevated declines on Mastercard (no impact stated) - 2026-10-15: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported CCA Automations are delayed when starting an Automation (minor) - 2026-10-15: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Ory lists as a subprocessor, reported Elevated declines on Visa (no impact stated) - 2026-10-15: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Ory lists as a subprocessor, reported Elevated Amazon Pay errors (no impact stated) - 2026-10-14: [Pylon](https://thirdpartyindex.com/vendors/pylon#status), which Ory lists as a subprocessor, reported Platform loading issues (no impact stated) - 2026-10-13: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Ory lists as a subprocessor, reported \[Retroactive\] Actions workflow run logs delayed (minor) The subprocessor list as we read it on any date: https://thirdpartyindex.com/labs/time-machine/ory ## Security contact From its security.txt (https://www.ory.com/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/3087)): - Contact: https://hackerone.com/ory_corp - Contact: mailto:security@ory.com - Disclosure policy: https://www.ory.com/docs/ecosystem/security - Languages: en, de - Valid until 2028-06-29 --- Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api