Q39
Are you PCI DSS compliant? At what level?
PCI DSS compliance claim found on trust page (Vendor attested)
Public evidencemedium confidence
Heroku Vendor Risk & Security Assessment
ThirdProof independently checks public intelligence sources to show what your team can verify about Heroku before Heroku sends a questionnaire or a security document.
Heroku's SOC 2 report is confidential. There is no public registry for SOC 2, so the report itself has to come from Heroku — ThirdProof does not hold or distribute it. What this page gives you is an independent assessment built from evidence anyone can check, and a record of which certifications are registry-verified versus claimed on Heroku's own trust page.
⚠ Heroku was not found in the FedRAMP Marketplace. Checked August 2026.
This matters if you place federal workloads with this vendor: agencies may only use cloud services holding a FedRAMP certification. It carries no weight for a purely commercial deployment.
Risk
Tier 3 — Moderate RiskEvidence confidence
100%27 of 27 sources returned data
Questionnaire
89 / 133 answered67% from public evidence
Last assessed
Aug 27, 2026Evidence confidence measures how much of the evidence ThirdProof set out to gather it was able to gather and corroborate. It is not a statement that every fact about this vendor is known.
🟢IP Reputation: Abuse score: 0%, 0 reports🟡SSL/TLS: TLSv1.3🟢Domain Age: 19.2 years🟢Infrastructure: 2 open ports, 0 CVEs
- FedRAMP Status
- Heroku is not listed on the FedRAMP Marketplace (checked August 2026).
- SOC 2 Status
- Heroku — SOC 2: Vendor attested — trust page. SOC 2 reports are confidential with no public registry, so compliance status is not publicly verifiable. Request the full Type II report and bridge letter directly from the vendor.
- Sanctions Screening
- Heroku returned no matches in OFAC SDN, EU Consolidated, and UN sanctions screening.
- Risk Tier
- ThirdProof assigned Heroku a Moderate Risk tier across 27 intelligence sources, 27 of which returned usable evidence (evidence confidence 100%).
27 sources queried, 27 returning usable evidence. The Heroku assessment ThirdProof has already run covers both a risk report and an auto-filled security questionnaire, with anything the evidence could not settle listed as an open question.
Get the Latest Heroku Vendor Assessment →Full risk assessment + 133-question security questionnaire|Free · Delivered by email
Certification & Compliance Status
Security questionnaire — auto-filled
89 questions answered before Heroku responds.
ThirdProof used public evidence to pre-fill 67% of a 133-question vendor security questionnaire — without waiting for Heroku. The remaining 44 are listed as open, so the follow-up you send is short and specific.
Q37
Do you have a current SOC 2 Type II report?
SOC 2 Type II: Vendor attested — trust page
Public evidencemedium confidence
Q42
Are you GDPR compliant? Do you have a DPA available?
GDPR compliance / DPA claim found on trust page (Vendor attested)
Public evidencemedium confidence
Q40
Are you HIPAA compliant? Do you sign BAAs?
HIPAA compliance / BAA claim found on trust page (Vendor attested)
Public evidencemedium confidence
Q23
Is data encrypted at rest? What encryption standard is used (e.g., AES-256)?
All plans use AES-256 block-level storage encryption at rest, with Amazon managing the keys and individual volume keys stable for the lifetime of the volume.
Public evidencehigh confidence
+ 84 additional evidence-backed answers
Get the Complete Heroku Assessment →
See all 133 questions, evidence links, findings, and the vendor follow-ups still required.
What you can verify before Heroku sends anything
Independent evidence settles part of the review. The rest still needs the vendor.
Public evidence establishes
- No Sanctions Matches Found
- No SEC Enforcement Filings Found
- Clean domain reputation
- Clean Safe Browsing Status
- Clean Website Security Scan
Still requires vendor confirmation
- Current SOC 2 report and its audit scope
- Data Security — 6 of 14 questions need vendor input
- Network & Infrastructure — 5 of 14 questions need vendor input
- Incident Response — 4 of 10 questions need vendor input
- Vulnerability Management — 4 of 8 questions need vendor input
Reviewing Heroku for your company?
Get the complete ThirdProof assessment now, then use the same workflow to assess the rest of your vendor stack.
5 vendors free · No credit card
Need ongoing vendor reviews? ThirdProof includes up to 50 vendor assessments per month for $399. See pricing
Executive Summary
Narrative analysis for Heroku
Heroku is a mature, widely-adopted cloud application platform owned by Salesforce, with an established 19-year domain history and significant technical community presence.
Area Requiring Attention
The vendor demonstrates solid foundational security practices, including AES-256 encryption at rest, TLS 1.3 in transit, multi-factor authentication controls, SOC 2 attestation, and a comprehensive compliance framework (ISO 27001, ISO 27017, ISO 27018, PCI DSS, HIPAA, and GDPR). Infrastructure exposure is minimal (2 open ports: 80, 443), domain reputation is clean, and the vendor maintains redundant multi-region architecture with 24/7 monitoring.
The full risk rationale, every finding and the recommended vendor follow-ups are in the complete assessment below.
Independence Statement
All evidence in this assessment was independently sourced from public domain records, threat intelligence feeds, registry lookups, web archive data, and vendor-published trust pages, without vendor participation or input.
Investigation Findings
3 findings identified for Heroku
1 medium2 low
medium
AI training data practices unclear
The vendor has an [AI data usage policy page](https://elements.heroku.com/addons/heroku-inference) addressing Heroku's inference and generative AI services, but the policy does not clearly state whether customer data (customer applications, configurations, or metadata) is used to train Heroku's internal or third-party AI models. The vendor discloses use of third-party AI providers (OpenAI, Anthropic, Cohere, Stability AI) but does not specify data retention periods, training consent models, or opt-out mechanisms.
low
Subprocessor list could not be parsed
The [vendor's subprocessor page](https://heroku.com/docs/subprocessors) was found and is accessible, but the automated parser could not extract individual subprocessor entries. The page may use a non-standard format, JavaScript rendering, or a format not supported by the parsing tool. …
low
8 certifications claimed but not independently verified
The vendor's [trust page](https://heroku.com/security) and [compliance page](https://heroku.com/compliance) claim eight certifications: SOC 2, SOC 1, ISO 27001, ISO 27017, ISO 27018, PCI DSS, HIPAA, and GDPR compliance. However, independent registry verification found no results for ISO 27001 (IAF CertSearch) or PCI DSS (PCI Security Standards Council listing). …
✓
Security Strengths
Evidence that positively supports Heroku's posture
Neutral observations, source coverage notes and items ThirdProof could not independently establish are recorded separately in the complete assessment — they are not counted as strengths.
✓
No Sanctions Matches Found
Sanctions & Watchlist Screening →✓
No SEC Enforcement Filings Found
SEC Filing Search →✓
Clean domain reputation
Threat Intelligence →✓
Clean Safe Browsing Status
Malware & Phishing Check →✓
Clean Website Security Scan
Website Security Scan →✓
Clean IP Reputation
IP Reputation →✓
Established Domain (19+ years)
Domain Registration →Heroku complete vendor assessment
Tier 3
Moderate Risk
89 / 133
questionnaire answers
27
sources checked
Aug 27, 2026
assessment date
- Complete 133-question security questionnaire
- Evidence behind every answered item
- Full findings and risk rationale
- Recommended vendor follow-ups
- Source and evidence inventory
- Source-cited PDF assessment
Risk tiers are set by a deterministic rules engine. AI summarises sourced evidence and writes the narrative; it does not assign the tier. Read the full methodology.
Compliance Resources
Frequently asked about Heroku
Is Heroku FedRAMP authorized?+
Heroku was not found in the FedRAMP Marketplace when it was checked on August 27, 2026. Absence of a public record is not evidence that the certification is absent; organisations with a hard requirement should confirm directly with the vendor.
Does Heroku have SOC 2 Type II?+
Heroku states that it maintains SOC 2 on its trust page. Because SOC 2 reports are generally confidential and there is no public SOC 2 registry, ThirdProof classifies this as vendor-attested until the current report and its scope have been reviewed. Request the report directly to confirm the audit period and which systems are in scope.
Is Heroku on the OFAC sanctions list?+
Heroku returned no matches in ThirdProof's OFAC SDN, EU Consolidated, and UN sanctions screening as of August 2026.
What is Heroku's vendor risk tier?+
ThirdProof assigned Heroku a risk tier of Moderate Risk as of August 2026, with an evidence confidence of 100% across 27 intelligence sources. Evidence confidence describes how much of the evidence ThirdProof set out to gather it was able to gather — not certainty about every fact concerning Heroku.
Has Heroku had any data breaches or security incidents?+
ThirdProof's adverse media and incident screening as of August 2026 did not surface a validated security incident involving Heroku. Public sources do not record every incident, so this is not a guarantee that none occurred — ask Heroku directly for its incident disclosure history and breach notification commitments.
Is Heroku PCI DSS compliant?+
PCI DSS compliance claim found on trust page (Vendor attested) ThirdProof records this from Heroku's published compliance evidence; request the current Attestation of Compliance to confirm the scope that applies to your integration.
Does Heroku support HIPAA and sign BAAs?+
HIPAA compliance / BAA claim found on trust page (Vendor attested) If protected health information is in scope for your use, confirm BAA availability in writing before contracting.
Can ThirdProof pre-fill a Heroku security questionnaire?+
Yes. ThirdProof answered 89 of 133 questions (67%) about Heroku from public evidence, before contacting the vendor. Each answered item carries the evidence it was drawn from. The remaining 44 are listed as open, so the follow-up you send Heroku is short and specific.
Represent Heroku? Submit updated security evidence.
If Heroku is in your vendor stack, can you prove you assessed them?
SOC 2 CC9.2, HIPAA, PCI DSS and CMMC all require documented vendor due diligence — not just knowing the answer, but holding evidence that you verified it. The Heroku assessment above is already written; ask for it and it lands in your inbox.
✓ This assessment: free, no account required✓ Your first 5 vendor investigations are free✓ No credit card required