# Heroku privacy rating

Platform as a service owned by Salesforce that runs apps in managed containers called dynos, with Git-based deploys, add-ons, and managed Postgres and Key-Value Store.

## Summary

Heroku scores 50 out of 100 (grade D) on the app hosting platforms criteria. It meets 4 of 8 criteria: transparency report, tells users about requests, TLS configuration and security headers. It partly meets no ads or data sales and independent audit. It does not meet open source and no trackers or telemetry. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.

- Website: https://www.heroku.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web
- Home page trackers: Google reCAPTCHA (not scored), Google Tag Manager, WordPress.com Stats
- Category: [App hosting platforms](https://privacyratings.com/app-hosting/)
- Grade: D (50/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. Buildpacks and the Heroku CLI are open source, but the platform is not. |  |
| No trackers or telemetry | No | The website loads Google Tag Manager, and the Salesforce privacy statement covers cookies used for tailored advertising. | https://www.salesforce.com/company/legal/privacy/ |
| No ads or data sales | Partial | Funded by paid plans, but the Salesforce privacy statement allows sharing data for advertising on non-Salesforce sites to promote its services. | https://www.salesforce.com/company/legal/privacy/ |
| Independent audit | Partial | SOC 1, 2 and 3 reports and ISO 27001 certification exist, but full reports are only available to customers. | https://www.heroku.com/compliance/ |
| Transparency report | Yes | Salesforce, which owns Heroku, publishes semi-annual transparency reports with counts of government requests. | https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/H2-2025-Transparency-Report.pdf |
| Tells users about requests | Yes | Salesforce notifies customers of legally binding requests for their data unless prohibited by law. | https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/H2-2025-Transparency-Report.pdf |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=dashboard.heroku.com&hideResults=on |
| Security headers | Yes | Grade A+ (100/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=dashboard.heroku.com |
| Modern web standards | Not tested yet | Not tested yet. |  |

Source: https://privacyratings.com/app-hosting/heroku/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/app-hosting/heroku.md