Ory
GDPR evidence
Ory delivers identity and access management (IAM) for applications, enterprises, and AI
No public evidenceOry and GDPR
CertReports found no public GDPR evidence for Ory as of unknown date. This does not mean the vendor is non-compliant. It means CertReports found no public evidence at the last check.
Evidence
- Kind
- listing
- Issued or listed
- 30 May 2024
- Expires or valid through
- 4 May 2027
- Scope
- Ory provides an identity management platform and related services focused on securing and managing user authentication, authorization, and API protection for individuals, devices, applications, and automated systems across various online services. In this capacity, Ory acts as both a data importer and a data processor. The personal data Ory typically receives includes names, job titles, email addresses, phone numbers, and physical addresses of the customer’s employees, contractors, users/clients, business partners, and other end users who interact with its identity management services. This data is collected and processed solely for the purpose of delivering services under the contractual agreements in place with its customers. Ory processes this personal data electronically within secure cloud environments, in accordance with the data protection obligations outlined in the applicable service agreements and Data Processing Addenda (DPAs). Processing activities include data storage, access control, system monitoring, and customer support. Ory may share personal data with authorized subprocessors (e.g., providers of cloud hosting, analytics, or support services) strictly for the purposes outlined above. ____ Ory also processes personal data as a global employer with employees and contractors worldwide. The purpose of collecting this data is to comply with its employer obligations, e.g. manage compensation, benefits and time reporting. Ory processes this data electronically in secure cloud environments, in accordance with the data protection obligations outlined in the service agreement and applicable DPA. Processing includes storage, access control, system monitoring, and support activities. Ory may share personal data with authorized subprocessors (e.g., for salary payment) solely for the above purposes.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 17 Sep 2026 | Ory Corp: Active: EU-US Certification, SW-US Certification, UK Extension Certification | Live pagesha256 0e53042c74 |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is Ory GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Alternatives with GDPR evidence
Similar vendors (shared product tags) whose GDPR row is verified or vendor-stated, ranked by similarity.
No same-category vendor has GDPR evidence in the index yet.