Softcat Limited

Salesforce - Heroku

Heroku, a Salesforce company enables developers to focus on application code and data instead of managing servers or operations. Code with agility in open source: Ruby, Node.js, Java, PHP and more. Deploy and scale on demand. Extend apps with 100s of different add-ons. Includes EU Model Contract Clauses. SFDC2019GC11


  • Fully managed container runtime environment
  • Scale, dynamically scale up or down instantly to meet demand
  • Build packs, open source supported and supplied or build own
  • Config, manage specific configurations separately from your source code
  • Deploy, with Git. We'll handle compilation, dependencies, assets and executables
  • Fork, creates a duplicate instance of your application immediately
  • Extend, over 100 add-ons, integrated to Heroku. SFGC10
  • Region, US, Europe and APAC, EU Model Contract Clauses supported
  • Data sync into Salesforce Sales, Service, & Marketing Clouds
  • Open source, Ruby, Node.js, Python, Java, PHP, Scala or Clojure


  • Efficient, Developers can focus on the app, not the infrastructure
  • Skills, prevalent in the market giving you greater choice
  • Community, active to help you learn and share code
  • Cost, cheaper than hosting and supporting your own environment
  • Agile, create new apps, then deploy on demand
  • Platform, API automate/extend with services in a programmatic manner
  • Security, Virtual Private Cloud, SSO with OAuth SAML
  • Flexibility, listed here avoiding lengthy credit-card approvals
  • Heroku, Connect pre-built integration to the best of Salesforce
  • Speed, scales to millions, exploit the AWS underpin

Service scope

Service scope
Service constraints "Usage Limits
Services and content are subject to usage limits, including, for example, the quantities specified in order forms.
A user’s password may not be shared with any other individual.

If you exceed a contractual usage limit, we may work with you to seek a reduction in your usage so that it conforms to that limit. If, notwithstanding our efforts, you are unable or unwilling to abide by a contractual usage limit, you will execute an order form for additional quantities of the applicable services or content promptly upon our request.

Full details are contained in our terms and conditions."
System requirements
  • Heroku Dashboard - web based use any browser
  • Heroku CLI - for Mac OSX, Windows, Debian/Ubuntu and standalone
  • Heroku API - connect programmatically

User support

User support
Email or online ticketing support Email or online ticketing
Support response times Guaranteed 30 minute response time on urgent issues. Urgent support available 24x7. Within Business Hours receive deployment consultations, architectural guidance and best practices from Customer Solutions Architects.
User can manage status and priority of support tickets Yes
Online ticketing support accessibility None or don’t know
Phone support Yes
Phone support availability 24 hours, 7 days a week
Web chat support No
Onsite support No
Support levels N/A
Support available to third parties Yes

Onboarding and offboarding

Onboarding and offboarding
Getting started Customer Solutions Architects proactively assist customers onboard to the service - providing guidance on initial access and setup and continue to provide white glove support on an ongoing basis
Service documentation Yes
Documentation formats
  • HTML
  • PDF
End-of-contract data extraction Dependent on the service being consumed. Code should always exist outside of Heroku and should already be available - if not it can be extracted from applications on Heroku. Data stored in data services can be extracted using standard tools for the service being used. Extraction for add-on services will vary.
End-of-contract process Off-boarding from the service will be specific to the nature of the code and service as deployed. The customer therefore always has access to the code, and the data held within the PaaS offering. Typically most customers use the supported databases in conjunction with Heroku, and as such data exports and backups can be taken as required. Code can be saved to GitHub such that off-boarding from Heroku is predictable. Being open source based Heroku can make your data available via an industry standard and easily readable format to make it as easy as possible for you to migrate to another service if you wish to do so.

Using the service

Using the service
Web browser interface Yes
Using the web interface The Heroku Dashboard is the web user interface for Heroku’s core features and functionality. It provides UI support for things like creating/renaming/deleting apps, configuring add-ons, managing Heroku Teams, creating Heroku Pipelines, deploying your application, viewing and responding to application metrics, and accessing usage, invoices and billing information.
Web interface accessibility standard None or don’t know
How the web interface is accessible Heroku Services are developed with accessibility standard awareness - automated testing tools are used to validate errors and changes are made where necessary.
Web interface accessibility testing No public information available.
What users can and can't do using the API The platform API empowers developers to automate, extend and combine Heroku with other services. You can use the platform API to programmatically create apps, provision add-ons and perform other tasks that could previously only be accomplished with Heroku toolbelt or dashboard.
API automation tools
  • Ansible
  • Chef
  • Terraform
  • Puppet
  • Other
Other API automation tools
  • Jenkins
  • Bamboo
  • Codeship
  • Travis
  • Capistrano
  • CircleCI
  • VisualStudio
  • Otto
API documentation Yes
API documentation formats
  • Open API (also known as Swagger)
  • HTML
  • PDF
Command line interface Yes
Command line interface compatibility
  • Linux or Unix
  • Windows
  • MacOS
Using the command line interface The Heroku Command Line Interface (CLI), formerly known as the Heroku Toolbelt, is a tool for creating and managing Heroku apps from the command line / shell of various operating systems. All capabilities available in the API are available via the CLI.


Scaling available Yes
Scaling type Automatic
Independence of resources Heroku provides both single and multi-tenant instances. Single tenant instances are dedicated only for single customer use and isolated from the risk of 'noisy neighbours'. As a platform Heroku serves many billions of requests on a monthly basis.
Usage notifications No


Infrastructure or application metrics Yes
Metrics types
  • CPU
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
  • Other
Other metrics Request Throughput
Reporting types Real-time dashboards


Supplier type Reseller (no extras)
Organisation whose services are being resold Salesforce

Staff security

Staff security
Staff security clearance Other security clearance
Government security clearance None

Asset protection

Asset protection
Knowledge of data storage and processing locations Yes
Data storage and processing locations EU-US Privacy Shield agreement locations
User control over data storage and processing locations Yes
Datacentre security standards Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency At least every 6 months
Penetration testing approach Another external penetration testing organisation
Protecting data at rest
  • Encryption of all physical media
  • Other
Other data at rest protection approach Data is encrypted at rest by using AES-256, block-level storage encryption. Data encryption is implemented using the AWS EBS disk encryption feature. Encryption keys are fully managed by AWS and are not visible to Heroku or Heroku customers. Access credentials are also encrypted at rest.
Data sanitisation process Yes
Data sanitisation type Deleted data can’t be directly accessed
Equipment disposal approach Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

Backup and recovery
Backup and recovery Yes
What’s backed up
  • Configuration - application configuration and settings
  • Data - data stored in Heroku managed data services
  • Other - backup capabilities of add-ons vary by provider
Backup controls Heroku performs automatic backups of the platform, customer application configuration, and Heroku data services attached to applications. Customers can trigger additional backups on a manual or scheduled basis. The capabilities of 3rd party add-ons will vary dependant on the service used.
Datacentre setup Multiple datacentres with disaster recovery
Scheduling backups Supplier controls the whole backup schedule
Backup recovery Users can recover backups themselves, for example through a web interface

Data-in-transit protection

Data-in-transit protection
Data protection between buyer and supplier networks TLS (version 1.2 or above)
Data protection within supplier network
  • TLS (version 1.2 or above)
  • Other
Other protection within supplier network "Each application on the Heroku platform runs within its own isolated environment and cannot
interact with other applications or areas of the system. This restrictive operating environment
is designed to prevent security and stability issues. These self-contained environments isolate
processes, memory, and the file system using Linux containers (LXC), while host-based firewalls
restrict applications from establishing local network connections."

Availability and resilience

Availability and resilience
Guaranteed availability We'll do everything we can to achieve 100% uptime. We will never achieve 100% uptime, but when we fall short, we'll explain why and how we'll do better next time. Heroku Enterprise Platform Uptime SLA available subject to additional signed SLA document; subject to approval on a per contract basis.
Approach to resilience "The Heroku platform is designed for stability, scaling, and inherently mitigates common issues that lead to outages while maintaining recovery capabilities. The platform maintains redundancy to prevent single points of failure, is able to automatically replace failed components, and utilises multiple data centres designed for resiliency.

In the case of an outage, the platform is deployed across multiple data centres using current system images and data is restored from backups. Heroku reviews platform issues to understand the root cause, impact to customers, and improve the platform and processes. In the event of an interruption of Heroku services, details are posted on the status page:

The Heroku platform itself is designed to provide highly available and redundant services, so that applications and databases may be replicated quickly in the event of an outage."
Outage reporting Status website, RSS feed and Twitter

Identity and authentication

Identity and authentication
User authentication
  • 2-factor authentication
  • Identity federation with existing provider (for example Google apps)
  • Username or password
  • Other
Other user authentication Authentication method depends on access method - dashboard access is username/password with 2FA or SSO; API is OAUTH.
Access restrictions in management interfaces and support channels Management access to services is restricted to specific personnel - fine grained control over which systems they have access to is in-place. Strong security rotation policies are in place and access to maintain the platform is only completed from authorised machines over secure channels. Heroku Support personnel only have access to customer applications if the customer gives them permission to do so.
Access restriction testing frequency At least every 6 months
Management access authentication
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
Devices users manage the service through Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

Audit information for users
Access to user activity audit information Users have access to real-time audit information
How long user audit data is stored for Between 1 month and 6 months
Access to supplier activity audit information Users have access to real-time audit information
How long supplier audit data is stored for Between 1 month and 6 months
How long system logs are stored for Between 1 month and 6 months

Standards and certifications

Standards and certifications
ISO/IEC 27001 certification No
ISO 28000:2007 certification No
CSA STAR certification No
PCI certification No
Other security certifications Yes
Any other security certifications Cyber Essentials PLUS

Security governance

Security governance
Named board-level person responsible for service security Yes
Security governance certified No
Security governance approach N/A
Information security policies and processes Heroku manages it's service in accordance with the requirements of ISO27001 and other standards and is currently on a compliance journey to achieve relevant certifications including PCI and ISO compliance.

Operational security

Operational security
Configuration and change management standard Supplier-defined controls
Configuration and change management approach The Heroku Security team manages and maintains a complete Change Control framework for the management and capture of change to the Heroku platform - this is not a public document but answers to specific questions are available on request.
Vulnerability management type Supplier-defined controls
Vulnerability management approach Our vulnerability management process is designed to remediate risks without customer interaction or impact. Heroku is notified of vulnerabilities through internal and external assessments, system patch monitoring, and third party mailing lists and services. Each vulnerability is reviewed to determine if it is applicable to Heroku’s environment, ranked based on risk, and assigned to the appropriate team for resolution.
Protective monitoring type Supplier-defined controls
Protective monitoring approach Heroku security and engineering staff monitor various tools and log feeds to detect anomalous behaviour. The teams review authentication events, sudo requests, data traffic patterns, and other data sources. More detail to specific questions available on request.
Incident management type Supplier-defined controls
Incident management approach Heroku maintains a formal incident response plan that describes procedures used to respond to a system breach - this is not a public document but answers to specific questions are available on request.

Secure development

Secure development
Approach to secure software development best practice Conforms to a recognised standard, but self-assessed

Separation between users

Separation between users
Virtualisation technology used to keep applications and users sharing the same infrastructure apart Yes
Who implements virtualisation Supplier
Virtualisation technologies used Other
Other virtualisation technology used LXC
How shared infrastructure is kept separate Each application on the Heroku platform runs within its own isolated environment and cannot interact with other applications or areas of the system. This restrictive operating environment is designed to prevent security and stability issues. These self-contained environments isolate processes, memory, and the file system using Linux containers (LXC), while host-based firewalls restrict applications from establishing local network connections. Infrastructure uses a fully virtualized hardware provided by AWS.

Energy efficiency

Energy efficiency
Energy-efficient datacentres Yes
Description of energy efficient datacentres AWS Based


Price £25.42 per instance per month
Discount for educational organisations No
Free trial available Yes
Description of free trial Customers can sign-up and use Heroku for free - lightweight 'free' dynos are available and most add-on services offer a free-tier to support testing of the service and capabilities.
Link to free trial

Service documents

pdf document: Pricing document pdf document: Skills Framework for the Information Age rate card pdf document: Service definition document pdf document: Terms and conditions pdf document: Modern Slavery statement
Service documents
Return to top ↑