Security

Ory Security Policy

This security policy outlines the security support commitments for differenttypes of Ory users.

Get in touch to learn more about Ory's securitySLAs and process.

Security SLA: No security Service Level Agreement (SLA) is provided.
Release Schedule: Releases are planned every 3 to 6 months. These releaseswill contain all security fixes implemented up to that point.
Version Support: Security patches are only provided for the currentrelease version.

Security SLA: The following timelines apply for security vulnerabilitiesbased on their severity:
- Critical: Resolved within 14 days.
- High: Resolved within 30 days.
- Medium: Resolved within 90 days.
- Low: Resolved within 180 days.
- Informational: Addressed as needed.
Release Schedule: Updates are provided as soon as vulnerabilities areresolved, adhering to the above SLA.
Version Support: Depending on the Ory Enterprise License agreementmultiple versions can be supported.

Security SLA: The following timelines apply for security vulnerabilitiesbased on their severity:
- Critical: Resolved within 14 days.
- High: Resolved within 30 days.
- Medium: Resolved within 90 days.
- Low: Resolved within 180 days.
- Informational: Addressed as needed.
Release Schedule: Updates are automatically deployed to Ory Network assoon as vulnerabilities are resolved, adhering to the above SLA.
Version Support: Ory Network always runs the most current version.

Please head over to oursecurity policy to learn moreabout reporting security vulnerabilities.