Learn how Swiss nonprofit Kiwix replaced legacy auth with Ory Network to achieve EU-compliant, open-source SaaS authentication with zero security incidents.
Kiwix is a Swiss nonprofit that makes free knowledge accessible where the internet cannot reach. Founded 20 years ago as a volunteer project to create offline copies of Wikipedia, Kiwix has grown into a global platform serving over 3 million users in more than 200 countries. The organization packages educational content from Wikipedia, Project Gutenberg, TED Talks, and other sources into compressed ZIM files that work without any internet connection. Kiwix ZIM files are used in refugee camps, submarines, prisons, remote schools, and anywhere connectivity is limited or censored.
Kiwix reached a level of organizational maturity where its platform-by-platform, "old school" approach to authentication became a liability. Each internal platform handled login separately, with local username/password stores and inconsistent security policies. As the team prepared to open its back-office tools to a wider community of contributors, this fragmented approach posed real risks.
The team needed a solution that met several non-negotiable requirements: open source (to match Kiwix's own values and avoid vendor lock-in), European-hosted (for regulatory alignment and organizational trust), available as SaaS (because a small team cannot operate high-availability auth infrastructure), and self-hostable as a fallback option.
Emmanuel Engelhart, Kiwix co-founder, searched the market and found almost nothing that fit. Most identity platforms were proprietary SaaS products with no open-source component. The open-source options, like Keycloak, did not offer a managed SaaS version from the project maintainers themselves. Third-party hosting of Keycloak introduced a split: the company operating the service was not the team building and maintaining the software. That gap creates risk.
We searched for an open-source, European-based project that was technically appealing and offered a SaaS approach. Ory was the only possibility.
Ory was the only platform that combined all of these properties: open source, modular, EU-based, available as managed SaaS from the maintainers, and self-hostable when needed. For Kiwix this was the only option that existed.
Kiwix chose Ory Network as a managed SaaS platform, driven by two factors: the service-level reliability that a small team could not replicate internally, and the knowledge that paying for Ory SaaS directly sponsors the open-source project.
Benoit Beraud, the engineer leading the implementation, started with one web application and then migrated a second. The migration follows a deliberate strategy: new projects start on Ory to avoid accumulating technical debt, and platforms that will onboard external contributors get priority. Internal tools used by a single core team member stay on the backlog.
The integration uses session-based authentication with tokenized JWTs. Kiwix's architecture includes single-page applications and machine-to-machine calls between internal platforms. For machine-to-machine communication, the team creates technical users with client ID and client secret pairs. When Platform A calls Platform B, the JWT is signed by Ory regardless of whether it originates from a user session or an M2M exchange. This lets Kiwix use a single verification mechanism (same issuer, same audience, same signing) for both human and machine callers.
Developing a central authentication solution in-house would have been a waste of time and would have made maintenance difficult. Authentication involves many standards. It made sense to rely on an off-the-shelf solution.
The most challenging part of the integration was not Ory itself but navigating the broader authentication ecosystem. The team initially explored OAuth2 flows before realizing, with guidance from Ory support, that session-based token exchange was simpler and more secure for their first-party scenario. This kind of course correction, handled through direct support, saved significant time.
Since launching on Ory, Kiwix has experienced zero authentication incidents. The Ory Network performs as intended with no surprises.
The quantifiable savings are less about upfront development time and more about the maintenance burden that no longer exists. Benoit Beraud is the only person working on the identity migration. Without Ory, Kiwix estimated it would need to build and maintain a custom identity system, a task that would require deep expertise in authentication standards like FIDO2, TOTP, and OpenID Connect. That expertise would need to persist in the team indefinitely.
Kiwix plans to extend access to a broader contributor community, people who help create offline archives of MediaWikis, educational content, and fandom sites. These contributors need strong authentication (enforced passwords, second-factor options) but do not need access to every internal platform. The team plans to implement role-based authorization using Ory's metadata feature on identities, a simpler approach than fine-grained permissions that fits their current scale.
The value of Ory as a "pure player" matters to Kiwix. When a nonprofit pays for Ory Network, that revenue supports the open-source project directly. With third-party-managed alternatives, that connection breaks. For an organization built on open-source principles, this alignment is not incidental. It is a deciding factor.
Using the Ory SaaS service ensures that even though the money is little, the open-source project is properly sponsored.
Kiwix did choose Ory because it was the only solution that met all of their requirements simultaneously: open source, modular, European-hosted, available as managed SaaS from the project maintainers, and self-hostable as a long-term option.
For small teams operating critical infrastructure at global scale, the calculus is straightforward. Building authentication in-house is a permanent maintenance commitment that grows more complex every year. Proprietary SaaS platforms create lock-in and misalign with open-source values. Third-party-managed open-source tools introduce a middleman between the team building the software and the team operating it.
Ory eliminates all three of those trade-offs.
Benoit Beraud put it simply: "If we deployed something on our own, we would be in a very bad position because in terms of maintenance it will be on our duty." Third-party-managed alternatives carried a different risk. "There is by design some friction in this kind of deployment because the one deploying is not the one managing the software." And for a nonprofit built on open source, paying the maintainers directly mattered. As Emmanuel Engelhart said: "You are sure you sponsor properly, even if this is little money, the open source project."
The migration required just two engineers. The hardest part was not Ory but the complexity of the authentication ecosystem itself, and Ory's support team helped correct the course when the team initially went in the wrong direction.
For organizations that need open-source identity infrastructure they can trust, host, and scale, Ory stands alone.
