Ory Acceptable Use Policy

This Acceptable Use Policy ("AUP") applies to all users of Ory Network and related products and services. This AUP supplements the Ory Terms of Service.

Prohibited conduct

You shall not, and shall not permit others to:

General prohibitions

• Use the Ory Network for unlawful, offensive, or privacy-infringing purposes
• Interfere with other customers' use of the Ory Network
• Attempt unauthorized access to Ory systems or data
• Infringe intellectual property rights

API and rate limit requirements

• Exceed the rate limits applicable to your Subscription Plan
• Fail to handle HTTP 429 (Too Many Requests) responses appropriately
• Implement retry logic without exponential backoff
• Generate traffic patterns designed to circumvent rate limits
• Use multiple accounts or projects to bypass rate limit restrictions

Testing restrictions

• Conduct load testing, stress testing, or performance testing without prior written approval
• Conduct penetration testing or security testing without prior written approval

For load and performance testing, see our Load Testing Policy. For security research, see our Bug Bounty Program.

Technical requirements

Your API clients must:

• Monitor for and respect HTTP 429 responses
• Implement exponential backoff when rate limited
• Use rate limit headers to proactively manage request volume
• Avoid retry storms or aggressive polling patterns

Enforcement

Ory reserves the right to:

• Monitor API usage patterns for compliance
• Block or throttle clients exhibiting abusive behavior
• Suspend projects that repeatedly violate rate limits
• Terminate accounts for persistent or egregious violations

Violations of this AUP constitute a material breach of the Terms of Service.

Reporting violations

Report suspected violations to [email protected].

Changes to this policy

Ory may update this AUP from time to time. Material changes will be communicated via the Ory Console or email.