North One aims to simplify financial management for small businesses, saving them time and providing better control over their finances through a user-friendly, mobile-first platform with strong integrations. They emphasize transparent fees and responsive customer support.
The client's journey began with an incumbent identity solution managing authentication for a sizable customer base comprising hundreds of thousands of profiles and several thousand daily active users. However, this partnership became increasingly problematic. The relationship faced challenges during contract renewal discussions. At the same time, the engineering team grew frustrated with the developer experience, finding the vendor’s SDKs and documentation complex. The North One team believed that their then-current provider "made easy things look hard" and hampered productivity.
Trust eroded more following a security breach in October 2023 involving the vendor's parent company. The client found the response to the incident unsatisfactory, raising concerns about their overall security posture and incident management practices. These issues were compounded by inadequate support during incidents like distributed denial-of-service (DDoS) attacks that triggered rate-limiting problems. The inability for the client to implement their own firewall rules meant that this left them powerless observers when attacks occurred and their customers could not log in.
Unfortunately, our previous provider raised prices for a sub-standard solution. Overly complicated documentation, poor support, and little direct control to change, forced us to seek alternatives. We accelerated our planned migration to a new identity vendor urgently seeking a more reliable and controllable solution.
Chris Morris, Staff Engineer at North One
The situation escalated into significant production crises. During one particularly difficult month, frequent attacks led to rate-limiting blockages that directly prevented legitimate customers from logging in or maintaining their sessions. This severely impacted application availability and consumed substantial engineering resources, demanding dozens of hours per week just to manage the fallout. The gravity of these business disruptions forced North One to accelerate finding a new identity vendor, urgently seeking a better solution.
Driven by the need for change, the client embarked on an evaluation of the identity vendor landscape, eventually shortlisting Ory Network alongside Stytch. While other vendors offered standard features, Ory Network ultimately won the selection by addressing the client's core pain points and aligning with their strategic direction, largely due to three compelling factors: Ory’s open-source nature, its superior Multi-Factor Authentication (MFA) implementation, and the level of customization it offers.
A critical decision point was Ory's best-in-class implementation of MFA. Its support for Authenticator Assurance Levels (AAL) and sophisticated step-up authentication flows was a standout capability. During proof-of-concept testing, the client judged Ory’s MFA capabilities as 'by far the best in the market'.
Also, Ory Network's architecture offered a solution to their control dilemma. It allowed the client to strategically place their own firewall between their end-users and Ory's services. This empowerment to manage traffic directly and implement custom mitigation rules was a decisive factor in contrast to the helplessness experienced before.
Another factor compelling the choice for Ory was its open-source foundations. The North One team highly values this transparency. Even when opting for the managed Ory Network service, the ability to inspect the underlying source code provided insights into the system's mechanics and fostered a level of trust and understanding simply not possible with closed-source alternatives. This openness was a breath of fresh air after their previous vendor experiences.
Furthermore, customization options were important to North One. Ory Network uniquely delivered on this, offering the customization essential for their complex enterprise needs. This empowered them to build a bespoke user interface and craft authentication journeys on top of Ory’s robust core platform, ensuring the solution fit their exact specifications rather than forcing them to adapt to a predefined mold.
Furthermore, the support model offered by Ory, featuring a dedicated Slack channel for direct and responsive communication, presented a significant improvement over their past experiences. The migration proceeded, involving the transfer of hundreds of thousands of user identities and the careful implementation of the new authentication flows, integrated with their custom user interface and the vital Cloudflare firewall layer.
We evaluated multiple vendors and solutions and found Ory to be the most modern and flexible. Only Ory allowed us to build authentication the way we wanted. Ory is easily customizable and transparent with responsive support. We are ecstatic to have Ory as a c/IAM partner.
Chris Morris, Staff Engineer at North One
The impact of migrating to Ory Network became evident soon after the launch in mid-December. Most notably, application availability stabilized significantly. Despite experiencing subsequent DDoS attacks similar to those that previously caused outages, the client reported no detrimental impact on availability since migrating to Ory Network. The combination of Ory's robust infrastructure and the client's ability to manage traffic through their Cloudflare firewall proved effective in neutralizing threats, a stark contrast to the almost constant disruptions endured before.
This new stability has a direct positive effect on engineering resources. The significant time engineers previously spent diagnosing and fighting authentication-related fires – amounted to "dozens of engineer hours per week" during incidents – dwindled to almost nothing. This reclaimed engineering capacity frees up the team to focus on innovation and core product development rather than operational emergencies. The Ory implementation also means the client finally achieved the desired level of control over their authentication traffic flow and security posture. With Ory Network securely in place, the team is now advancing their security roadmap, implementing features like phone verification, MFA, and step-up authentication, built upon Ory's strong foundational capabilities.
The decision to migrate to Ory Network marked a turning point for the client, resolving the critical operational friction, security concerns, and availability issues stemming from their previous identity provider. Ory Network delivered tangible value by granting essential control through flexible firewall integration, providing responsive and effective support, and offering robust, best-in-class features like MFA/AAL adaptable to complex requirements through deep customization. The platform stabilized North One’s application environment, shielding it from attacks that previously caused significant downtime, while simultaneously alleviating a major operational burden on the engineering team, saving dozens of engineering hours every week. For North One, Ory Network has become more than just a vendor; it is a strategic component of their technology stack, strengthening their security posture and enabling innovation in how they manage user identity and access.
Ory gives us a modern path away from legacy approaches. New innovations and features bring better ways to service customers. More security, more availability, more control.
Chris Morris, Staff Engineer at North One
