BoxyHQ built open-source SAML SSO, SCIM Directory Sync, and audit logging for SaaS teams. See what it offers and how it became Ory Polis after Ory's 2025…
BoxyHQ's core thesis was that most SaaS companies eventually hit the same wall: a large enterprise prospect asks for SAML SSO, SCIM-based user provisioning, or detailed audit logs, and the engineering team has to drop everything to build protocol-level plumbing that has nothing to do with the product's actual value proposition. BoxyHQ's answer was to package that plumbing as open-source, embeddable building blocks - SAML Jackson for SSO, a SCIM 2.0 Directory Sync service, and Retraced for audit logging - so teams could add 'enterprise readiness' in days rather than months.
Because the products were open source, teams could self-host them for free and audit the code directly, which mattered for security-conscious buyers. BoxyHQ also offered a managed/enterprise tier for teams that preferred a hosted service with SLAs and support, and it shipped integrations and documentation for popular frameworks including Next.js, Express, and NextAuth.js/Auth.js, along with a SaaS Starter Kit to help new products launch with enterprise features baked in from day one.
In May 2025, Ory - an identity infrastructure company with a broader platform spanning authentication, authorization, and identity management - acquired BoxyHQ. The stated rationale was to help enterprises modernize identity management and reduce dependence on large, monolithic identity providers, folding BoxyHQ's lightweight, developer-first SSO and directory sync tools into Ory's stack.
Following the deal, BoxyHQ's flagship SAML Jackson and Directory Sync products were rebranded as Ory Polis, and BoxyHQ's GitHub organization now displays an 'acquired by Ory' label. Ory has continued to maintain and ship updates to the underlying open-source project (now living at ory/polis), while folding Retraced-style audit logging concepts into its broader security and compliance messaging. For research and directory purposes, this means 'BoxyHQ' is best understood today as the origin story and technical foundation for a set of identity tools that now operate under the Ory brand.
Whether approached as BoxyHQ's original open-source repositories or as Ory Polis today, the underlying value proposition is unchanged: it gives engineering teams a fast, self-hostable or managed path to enterprise SSO, directory sync, and audit logging, which are frequently prerequisites for closing larger B2B deals. This makes it most relevant to SaaS companies moving upmarket toward enterprise customers who require SAML/OIDC login and automated user lifecycle management.
Teams evaluating this technology should go in expecting some documentation and branding to be mid-migration between the BoxyHQ and Ory names, and should confirm current product names, repositories, and support channels directly with Ory rather than assuming BoxyHQ still operates as an independent vendor.
BoxyHQ built open-source tools that let SaaS companies add enterprise-ready features - SAML and OIDC single sign-on, SCIM directory sync, and audit logging - without building the underlying protocols themselves.
No. Ory acquired BoxyHQ in May 2025, and its products and team have been folded into Ory's identity platform.
Ory Polis is the new name for BoxyHQ's SAML Jackson and Directory Sync products following the 2025 acquisition; it continues the same open-source SSO and SCIM functionality under the Ory brand.
Yes. BoxyHQ's core products were released under open-source licenses for self-hosting, and the successor project continues as open source under Ory.
SAML Jackson is BoxyHQ's original SSO product, which handles SAML and OIDC login flows behind a simplified OAuth 2.0-style interface.
Yes. BoxyHQ built a SCIM 2.0-based Directory Sync service for automated user and group provisioning and deprovisioning.
The core open-source software is free to self-host. Managed hosting and enterprise features such as SLAs and premium support require a custom quote through Ory.
BoxyHQ was founded in August 2021 by Deepak Prabhakara and Carlos Samame, originally based in London, United Kingdom.