Enterprise assurance and control for IAM & CIAM projects | Ory

Question 1

What is the Ory Enterprise License (OEL)?

Accepted Answer

The Ory Enterprise License (OEL) is the commercial, self-hosted edition of Ory (Hydra, Kratos, Keto, Oathkeeper, Polis) for mission-critical production environments. You run Ory on your own infrastructure, but get enterprise builds, 24×7 support, frequent releases, and contractual SLAs for reliability and security.

Question 2

Who is OEL for?

Accepted Answer

OEL is for teams that:

Treat identity and access as critical infrastructure with strict uptime or compliance requirements.

Need to self-host due to data sovereignty, regulatory, or internal policy constraints.

Want open source transparency while requiring predictable releases, security patches, and vendor accountability.

For non-critical or exploratory use, the open source stack or the Ory Network free tier is typically sufficient. OEL is appropriate when identity becomes a supported production dependency. OEL is the step you take when identity becomes core infrastructure.

Question 3

How is OEL different from running Ory Open Source?

Accepted Answer

OEL uses the same APIs and core architecture as open source Ory, but differs in operational guarantees:

Support: Open source has no guaranteed response times. OEL provides 24×7 support with SLAs.

Security: Open source CVE fixes depend on community release timing. OEL provides scheduled, SLA-backed CVE patches.

Security fixes: Open source CVE patches land only with new community releases; OEL gets prioritized CVE fixes as part of its enterprise release stream.

Compatibility: OEL emphasizes backward compatibility across databases, APIs, and key integrations to reduce upgrade risk.

Operational readiness: OEL releases are validated for large-scale deployments, including advanced database topologies and zero-downtime migrations.

Both OSS and OEL share the same underlying technology, but they are maintained and delivered with different reliability, support, and risk profiles.

Question 4

What value does OEL provide for security and CVE patching?

Accepted Answer

OEL provides a structured and predictable approach to vulnerability management:

Continuous CVE coverage: Enterprise releases include patches for vulnerabilities across Ory components and dependencies on a regular schedule.

SLA-backed prioritization: Critical CVEs in OSS are addressed on a best-effort basis, but without guaranteed timelines. OEL delivers fixes according to defined SLAs and a planned patching workflow.

Auditability: OEL includes detailed release notes, documented CVE coverage, SBOMs, and a repeatable patching process aligned with internal security and compliance requirements.

This shifts vulnerability management from community-timed updates to a clear, contractual, and auditable security process.

Question 5

What kind of support and SLAs come with OEL?

Accepted Answer

OEL provides formal support guarantees:

24×7 incident support, with severity-based response-time SLAs.

Direct access to Ory engineers and IAM domain experts.

Architectural guidance, migration assistance, and help with troubleshooting and performance optimization.

For buyers, the key point is that identity and access issues are no longer handled on an ad-hoc, best-effort basis (for OSS). With an OEL, Ory is accountable and contractually committed to supporting your resolution.

Question 6

What technical capabilities does OEL unlock?

Accepted Answer

OEL enables functionality and performance characteristics needed for large-scale or complex IAM deployments. Key differences include, but not limited to:

Horizontal database scaling, sharding, multi-region failover, and data homing when used with CockroachDB Enterprise.

High-performance connection pooling and tuning options for high-throughput workloads.

Multi-tenancy, and support for multiple tenants within a single deployment

In Hydra: enterprise OAuth2 enhancements like ROPC grant, verifiable credentials, and custom token/code prefixes.

In Kratos: B2B Organizations support.

In Polis: Identity federation and SSO integration capabilities for complex enterprise environments.

Question 7

How does OEL change day-to-day operations?

Accepted Answer

OEL is built to reduce operational risk and overhead:

Zero-downtime upgrades and migrations, so you can avoid service interruptions.

Automated lifecycle management, such as cleanup of stale sessions/tokens at scale.

Clear guidance for backup strategies, disaster recovery, monitoring, and observability.

This ensures you can roll out updates and improvements without taking systems offline or interrupting user flows.

Question 8

How hard is it to move from Ory Open Source to OEL?

Accepted Answer

OEL is designed as a drop-in replacement for existing Ory self-hosted deployments:

The same APIs, configuration formats, and core concepts apply, so no application-level rewrite is needed.

Migration typically involves:

Obtain license and enterprise image access.

Swap your containers/Helm charts to use the OEL images.

Follow OEL’s upgrade notes if you’re jumping multiple versions.

Your applications keep calling Ory the same way; you just upgrade to a hardened, supported distribution – with no client-side changes.

Question 9

How does OEL relate to Ory Network?

Accepted Answer

Both options provide enterprise-grade functionality; the difference is operational responsibility:

OEL: You run Ory on your own infrastructure with enterprise builds and support.

Ory Network: Ory operates the entire platform as a managed cloud service.

Organizations that require self-hosting choose OEL. Those prioritizing operational offloading often choose Ory Network. Both use the same standards and APIs, making migration between them straightforward.

Question 10

How does licensing and delivery work for OEL?

Accepted Answer

OEL is licensed on a per-product, subscription basis. A subscription provides access to:

Private enterprise container images for the specific Ory products included in your license.

Enterprise Helm charts and Docker container images for those products.

Continuous enterprise release channels, including feature updates, bug fixes, and SLA-backed CVE patches.

Support and SLA coverage for the duration of the subscription.

You deploy OEL into your own environment (Kubernetes, VMs, or private cloud) and retain full control over infrastructure, data location, and compliance posture.

Ory Enterprise License: self-hosted with enterprise support

Why Ory Enterprise License?

Do I want/need ability to contact and get immediate help in critical situations?

Do I want/need access to the latest Ory and community innovations?

Do I want/need to quickly resolve security & regulatory issues?

Frequently asked questions

Compare deployment options

Get started with Ory Enterprise License