App hosting platforms
Heroku privacy rating
Platform as a service owned by Salesforce that runs apps in managed containers called dynos, with Git-based deploys, add-ons, and managed Postgres and Key-Value Store.
Summary
Heroku scores 50 out of 100 (grade D) on the app hosting platforms criteria. It meets 4 of 8 criteria: transparency report, tells users about requests, TLS configuration and security headers. It partly meets no ads or data sales and independent audit. It does not meet open source and no trackers or telemetry. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.
Score 50 out of 100. How scoring works
Criteria
-
No
Open source Weight 3 of 3
Is all the source code needed to run the product public?
Closed source. Buildpacks and the Heroku CLI are open source, but the platform is not.
-
No
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
The website loads Google Tag Manager, and the Salesforce privacy statement covers cookies used for tailored advertising.
-
Partial
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by paid plans, but the Salesforce privacy statement allows sharing data for advertising on non-Salesforce sites to promote its services.
-
Partial
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
SOC 1, 2 and 3 reports and ISO 27001 certification exist, but full reports are only available to customers.
-
Yes
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
Salesforce, which owns Heroku, publishes semi-annual transparency reports with counts of government requests.
-
Yes
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
Salesforce notifies customers of legally binding requests for their data unless prohibited by law.
Automated tests
-
Yes
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade A+
-
Yes
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade A+ (100/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.