Deep-dive on the Next Gen Platform. Join the Webinar!

Skip Navigation
Show nav
Dev Center
  • Get Started
  • Documentation
  • Changelog
  • Search
  • Get Started
    • Node.js
    • Ruby on Rails
    • Ruby
    • Python
    • Java
    • PHP
    • Go
    • Scala
    • Clojure
    • .NET
  • Documentation
  • Changelog
  • More
    Additional Resources
    • Home
    • Elements
    • Products
    • Pricing
    • Careers
    • Help
    • Status
    • Events
    • Podcasts
    • Compliance Center
    Heroku Blog

    Heroku Blog

    Find out what's new with Heroku on our blog.

    Visit Blog
  • Log inorSign up
Hide categories

Categories

  • Heroku Architecture
    • Compute (Dynos)
      • Dyno Management
      • Dyno Concepts
      • Dyno Behavior
      • Dyno Reference
      • Dyno Troubleshooting
    • Stacks (operating system images)
    • Networking & DNS
    • Platform Policies
    • Platform Principles
  • Developer Tools
    • Command Line
    • Heroku VS Code Extension
  • Deployment
    • Deploying with Git
    • Deploying with Docker
    • Deployment Integrations
  • Continuous Delivery & Integration (Heroku Flow)
    • Continuous Integration
  • Language Support
    • Node.js
      • Working with Node.js
      • Troubleshooting Node.js Apps
      • Node.js Behavior in Heroku
    • Ruby
      • Rails Support
      • Working with Bundler
      • Working with Ruby
      • Ruby Behavior in Heroku
      • Troubleshooting Ruby Apps
    • Python
      • Working with Python
      • Background Jobs in Python
      • Python Behavior in Heroku
      • Working with Django
    • Java
      • Java Behavior in Heroku
      • Working with Java
      • Working with Maven
      • Working with Spring Boot
      • Troubleshooting Java Apps
    • PHP
      • PHP Behavior in Heroku
      • Working with PHP
    • Go
      • Go Dependency Management
    • Scala
    • Clojure
    • .NET
      • Working with .NET
  • Databases & Data Management
    • Heroku Postgres
      • Postgres Basics
      • Postgres Getting Started
      • Postgres Performance
      • Postgres Data Transfer & Preservation
      • Postgres Availability
      • Postgres Special Topics
      • Migrating to Heroku Postgres
    • Heroku Key-Value Store
    • Apache Kafka on Heroku
    • Other Data Stores
  • AI
    • Working with AI
  • Monitoring & Metrics
    • Logging
  • App Performance
  • Add-ons
    • All Add-ons
  • Collaboration
  • Security
    • App Security
    • Identities & Authentication
      • Single Sign-on (SSO)
    • Private Spaces
      • Infrastructure Networking
    • Compliance
  • Heroku Enterprise
    • Enterprise Accounts
    • Enterprise Teams
    • Heroku Connect (Salesforce sync)
      • Heroku Connect Administration
      • Heroku Connect Reference
      • Heroku Connect Troubleshooting
  • Patterns & Best Practices
  • Extending Heroku
    • Platform API
    • App Webhooks
    • Heroku Labs
    • Building Add-ons
      • Add-on Development Tasks
      • Add-on APIs
      • Add-on Guidelines & Requirements
    • Building CLI Plugins
    • Developing Buildpacks
    • Dev Center
  • Accounts & Billing
  • Troubleshooting & Support
  • Integrating with Salesforce
  • Security
  • Heroku Security & Compliance Resources and Features

Heroku Security & Compliance Resources and Features

English — 日本語に切り替える

Last updated April 10, 2025

Table of Contents

  • Shared Responsibility Model & Compliance Resources
  • A Strategic Approach to Security & Compliance
  • Security and Compliance Features

This article introduces available compliance collateral, approaches for managing compliance on the Heroku platform, and security features that can help reduce risk and meet compliance objectives.

We’re working towards getting the Fir generation of the Heroku platform certified.

Shared Responsibility Model & Compliance Resources

Developers around the world entrust sensitive data to Heroku, and nothing is more important to Salesforce than trust and protecting this data. However, protecting your data is a shared responsibility between Salesforce and you, our customer, as described in Heroku’s Security, Privacy and Compliance.

Heroku has leveraged the Cloud Security Alliance’s Consensus Assessments Initiative Questionnaire (CSA CAIQ) as a framework to help customers better understand this delineation of responsibility. In addition, Heroku has created a ‘Security Runbook’ to complement the CSA CAIQ, which provides a starting point of common configurations and considerations for securely developing compliant apps on the Heroku platform.

The CSA CAIQ + Security Runbook, Salesforce audit and compliance reports, and other compliance resources for Heroku Services such as third-party penetration testing reports are available to customers via the Salesforce Trust website (Salesforce Services login required) or via logging a compliance doc request.

A Strategic Approach to Security & Compliance

Heroku offers three application runtimes to allow you to meet different data sensitivity requirements:

  • Heroku Common Runtime: Secure multi-tenant environment for low to moderately sensitive data type that provides essential data security features
  • Heroku Private Spaces: Account isolated environment with defined network boundaries for moderate to high data types that provides additional data security and geographic isolation features
  • Heroku Shield Private Spaces: Account isolated environment with defined network boundaries for highly regulated data types such as PCI or HIPAA data that provides enhanced data security and geographic isolation features

Heroku also offers the following Heroku managed data add-ons for your applications running in the above runtimes:

  • Heroku Postgres
  • Heroku Connect
  • Heroku Key-Value Store
  • Apache Kafka on Heroku

These add-ons offer a wide spectrum of plan types that allow you to meet not only performance and sizing needs, but also accommodate the different security and compliance needs for various data types.

Similar to the Heroku runtimes, add-ons will have “Private” or “Shield” plan tier options. The “Private” plan tier is designed for moderate to high data types and offers additional data security features over entry-level plan types, while a “Shield” plan offers enhanced security configurations and helps enable customers to meet highly regulated data type requirements such as Payment Card Industry (PCI) and Health Insurance Portability & Accountability Act (HIPAA).

For additional information regarding using sensitive data types and Heroku Services refer to Heroku’s compliance page or Security Privacy & ARChitecture (“SPARC”) documentation.

Security and Compliance Features

Heroku offers an array of security and compliance features your organization can configure or utilize to fine-tune security controls, commensurate with your organization’s risk tolerance. These include Authentication & Access, Logging & Monitoring, Advanced Heroku App & Data Access Methods, and Encryption and Data Backups.

Authentication & Access

  • Single Sign-On (SSO)
    SSO for Heroku allows you to use your identity provider to centralize user access and delegate authentication to Heroku’s web experience and Command Line Interface (CLI). Identity Providers can enforce custom password composition requirements and multi-factor authentication.

  • Multi-Factor Authentication (MFA)
    If your organization isn’t ready to take advantage of SSO, MFA is available for an extra layer of security. MFA is a mandatory Heroku security feature and an effective way to increase protection for your account against common threats like phishing attacks, credential stuffing, and account takeovers.

  • Enterprise Accounts and Enterprise Teams
    These Heroku Enterprise features allow for easier management of groups of users and the ability to implement the concept of least privilege through allowing your organization to grant fine-grained permissions to team members on a per-app basis, ensuring that the right people have access to the right operations and resources.

  • Lock Apps
    After releasing an app to production and after user access is stable, you can lock an app, which prevents all access by team members unless the member has the ‘Manage’ permission.

  • Config Variables
    Store an app’s environment-specific configuration, such as credentials as environmental variables instead of version control systems. Heroku allows customers to store these sensitive environment-specific configurations as config vars.

  • Add-On Controls
    Heroku provides first and third-party add-ons through the Heroku Elements marketplace to enhance the capabilities of your applications. The partner add-on allowlist allows your admin to control which add-ons are used with apps in your team and is helpful for ensuring only vetted and approved add-ons are utilized by your developers.

  • Limit Access For Third-Party OAuth to Apps
    Heroku provides the ability to restrict OAuth access to team-owned resources from all non-Heroku products and services. Team members can ​still​ OAuth with Heroku, but team resources aren’t accessible.

  • Heroku Postgres Credentials**
    Heroku Postgres allows you to grant specific privileges such as Grant, Select, Insert, Update and Delete to individual roles. These roles can then be attached to your application to limit access to the database by your application and allow you to follow the principle of least privilege.

  • Heroku Flow
    Heroku Flow is a structured deployment workflow that streamlines the app release experience by making continuous integration and delivery easy, visual, efficient and more secure.

  • Dashboard Session Length Limits
    Users can stay logged into the Heroku Dashboard for a limited period of time before they must reauthenticate.

Logging and Monitoring

  • Logging & Add-On Providers^
    Heroku aggregates a variety of logs for your deployed apps such as app logs, system logs, API logs, add-on logs, and build logs that allow you to audit important app events and performance metrics. The Heroku platform maintains these logs for a short time period and best practice is to have these logs sent to third-party logging add-on providers or external servers for long-term persistence.

  • Audit Trails*
    The Heroku Enterprise feature Audit trails provides a chronological history of configuration change events associated with your account and is an important input into your compliance program.

  • Private Space Logging**
    This Shield Private Space feature forwards log events from applications, Heroku Postgres databases, Heroku system services logs and Heroku API logs to a single log capture destination for easily access and validation that logging is correctly setup.

  • Keystroke Logging**
    This Shield Private Spaces feature logs all user keystrokes typed into interactive Heroku run sessions and provides the ability to review these logs for auditing purposes.

Advanced Heroku App & Data Access Methods

  • Trusted IP Ranges**^
    Allows you to restrict access to applications in Private Spaces and Shield Spaces to only clients originating from a list of approved IP ranges that your organization has defined.

  • Stable Outbound IP Addresses**
    Outbound traffic from apps in a Private Space or Shield Space originate from a stable set of IP addresses. Services receiving traffic from these apps can add the Outbound IP addressees to an allow list as an additional level of security.

  • Private Space Peering**^
    This feature allows you to establish a private network connection between dynos running in a Private Space or Shield Space to an AWS VPC that you control. This connection method provides additional security benefits as it does not traverse the public Internet and instead only communicates over AWS’s secure network.

  • Private Space VPN**^
    Heroku Private Spaces and Shield Spaces can configure a secure connection to another private network using IPSec VPN. This lets dynos connect to hosts on your private networks and vice versa. Connections are established over the public Internet, but all traffic is encrypted using IPSec.

  • Internal Routing**^
    Access to applications are further restricted through use of Internal Routing, which limits access to applications to only other apps running in the same Private Space or Shield Private Space network and to previously configured Private Space Peering or Private Space VPN connections.

  • PrivateLink**
    PrivateLink allows you to connect the first-party Heroku add-ons Heroku Postgres, Heroku Key-Value Store, and Apache Kafka on Heroku to one or more AWS VPCs. This connection method provides additional security benefits as it doesn’t traverse the public Internet and instead only communicates over AWS’s secure network.

  • Mutual TLS (mTLS)**
    This feature creates a secure and mutually authenticated channel between an external resource and a Heroku Postgres database or Apache Kafka on Heroku cluster running in a Private Space or a Shield Private Space. The external resources can include mTLS-enabled applications or systems running in private data centers or in public clouds.

Encryption Options

  • Automated Certificate Management (ACM)
    ACM allows you to automatically manage TLS certificates for apps by renewing certificates one month before they expire and issuing new certificates when you add or remove a custom domain.

  • Cipher Suites
    Apps in Private Spaces and Shield Private Spaces allow you to configure the cipher suites used to negotiate TLS connections with new clients. By default, apps are configured to only support TLS v1.2. In addition, Heroku also automatically manages secure transport of Salesforce data to Heroku Postgres via Heroku Connect without any additional configuration.

  • Bring Your Own Key (BYOK)**
    Heroku automatically encrypts data-at-rest at the disk level for most Heroku Postgres, Heroku Key-Value Store, and Apache Kafka on Heroku plans; however, for customers with advanced encryption needs we offer the BYOK feature for these Heroku data add-ons in Private Spaces and Shield Spaces. This feature allows customers to create and manage their own Customer Managed Key (CMK) from their AWS KMS Account and the ability to disable the CMK which makes all data encrypted by the key inaccessible.

Data Backups

  • Postgres Rollbacks
    Heroku Postgres allows you to “roll back” the state of your database to a previous point in time during the last 4-7 days, depending on plan, which can help mitigate the risk associated with an accidental data deletion or data overwrite.

  • Postgres Backups
    Apps can be configured to take manual and scheduled backups of attached Heroku Postgres databases, which are used to restore the databases, transfer data between databases or downloaded and stored outside of Heroku. These backups provide additional protection in the event of a catastrophe and helps customers meet various compliance and regulatory requirements.

* This feature is only available as part of Heroku Enterprise.
** This feature is only available for a subset of Heroku Enterprise product offerings.
^ This feature is not yet available for the Fir generation of the Heroku platform.

Keep reading

  • Security

Feedback

Log in to submit feedback.

Information & Support

  • Getting Started
  • Documentation
  • Changelog
  • Compliance Center
  • Training & Education
  • Blog
  • Support Channels
  • Status

Language Reference

  • Node.js
  • Ruby
  • Java
  • PHP
  • Python
  • Go
  • Scala
  • Clojure
  • .NET

Other Resources

  • Careers
  • Elements
  • Products
  • Pricing
  • RSS
    • Dev Center Articles
    • Dev Center Changelog
    • Heroku Blog
    • Heroku News Blog
    • Heroku Engineering Blog
  • Twitter
    • Dev Center Articles
    • Dev Center Changelog
    • Heroku
    • Heroku Status
  • Github
  • LinkedIn
  • © 2025 Salesforce, Inc. All rights reserved. Various trademarks held by their respective owners. Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, United States
  • heroku.com
  • Legal
  • Terms of Service
  • Privacy Information
  • Responsible Disclosure
  • Trust
  • Contact
  • Cookie Preferences
  • Your Privacy Choices