Ory

Short Summary

Customer Identity and Access Management (CIAM) has expanded from basic registration and login into foundational infrastructure for trust, compliance, personalization, and resilience across B2C and B2B channels. Unlike workforce IAM, CIAM operates at massive scale in volatile environments with identities sourced from non-authoritative systems and diverse credentials (email, social, national IDs, mobile, IoT), while enforcing privacy and security. Most CIAM is delivered as multi-tenant SaaS on public IaaS for global elasticity and rapid feature delivery, but data residency and compliance pressures drive demand for alternatives such as customer-deployed software, on-premises, private cloud, and single-tenant SaaS with stronger isolation and customizable performance/SLA terms.

Functionally, CIAM must support flexible registration (social federation, passwordless, QR, document-based identity verification), progressive profiling, de-duplication, account linking, self-service credential recovery, consent management, and increasingly device identity. MFA remains crucial for account takeover mitigation, with modern methods including passkeys (FIDO2/WebAuthn), risk-adaptive step-up, and device reputation. Authorization is shifting beyond RBAC toward ABAC/PBAC, delegated admin, and standards-based integration using OAuth2 scopes and SAML attributes. Privacy regulations (GDPR, CCPA, LGPD, PIPEDA) require revocable consent, DSAR handling, and data export/deletion APIs, often integrated with external privacy tools. CIAM also depends on strong APIs (REST/GraphQL/Webhooks), connectors to CRM/CDP/CPM and fraud/IDV ecosystems, and extreme scalability with global distribution, failover, throttling, and partitioning.

Ory is presented as a modular, API-first identity platform spanning CIAM and workforce IAM. Its open-source modules (Kratos, Hydra, Oathkeeper, Polis, Keto) can be self-hosted or consumed via Ory Network SaaS, with strong observability, high availability, and flexible deployment—while key gaps remain in progressive profiling, device registration, built-in IDV, governance/lifecycle automation, and packaged integrations.

Interesting Facts

• CIAM platforms often run as multi-tenant SaaS on public IaaS and are commonly priced by monthly active users or transaction volumes.
• B2B CIAM use cases frequently involve AML, KYC, and sanctions screening requirements, especially in regulated industries.
• Ory started as an open-source project in 2015, and Ory Corp was founded in 2019.
• Ory is headquartered in Scottsdale, Arizona, and is backed by venture capital.
• Ory secures over two billion reported identities across its open-source, commercial self-hosted, and cloud offerings.
• Ory Hydra is an OAuth2 and OpenID Connect (OIDC) compliant authentication server.
• Ory Keto is a Google Zanzibar-based authorization server enabling relationship-based access control and ACL enforcement; ABAC support is planned for 2026.
• Ory Network is priced by daily active users and per-token creation charges, with most contracts per annum and monthly options available.
• Ory Network has ISO 27001 and SOC 2 Type 2 certifications.
• Ory Network’s standard SLA guarantees 99.995% uptime.

Notable Quotes

• “CIAM platforms now serve as critical infrastructure designed to deliver trust, compliance, personalization, and operational resilience across both Business-to-Consumer (B2C) and Business-to-Business (B2B) environments.”
• “They must accommodate millions or even billions of identities derived from scattered, often non-authoritative sources.”
• “Scalability is not merely an architectural preference: it is a gating requirement for any CIAM solution operating in consumer contexts.”
• “Role-Based Access Control (RBAC), while nearly universally available, is increasingly insufficient to meet the demands of contemporary requirements.”
• “CIAM platforms must provide consent orchestration workflows, version tracking, Data Subject Access Request handling, and account data export or deletion Application Programming Interfaces (APIs).”
• “CIAM is not a standalone capability.”
• “Ory’s modular, API-first design enables incremental service upgrades rather than ‘rip-and-replace’ migrations, aligning with the Identity Fabric model to make it easier for customers to modernize specific identity services as needed.”
• “Ory’s strength lies in its deployment flexibility and developer accessibility.”
• “Ory is positioned as a business enabler for enterprises building agent-powered digital experiences”
• “Success in CIAM requires more than simply managing credentials or logging events.”