Heroku

heroku.com · facts updated 1 hour ago

Privacy facts at a glance

DPA available: Yes
Certifications: PCI DSS Level 1 · HIPAA · ISO 27001 · ISO 27017 · ISO 27018 · SOC 1 · SOC 2 · SOC 3

Tracked documents

https://www.heroku.com/policy/ checked 1 hour ago

https://www.salesforce.com/company/legal/sfdc-website-terms-of-service/ checked 1 hour ago

Data processing agreement

https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Agreements/data-processing-addendum.pdf checked 1 hour ago

Subprocessor list

https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/misc/salesforce-infrastructure-and-subprocessors.pdf checked 1 hour ago

Security / trust page

https://www.heroku.com/compliance/ checked 1 hour ago

Recent changes

major Data processing agreement 1 hour ago

Heroku (Salesforce) DPA document has been removed/replaced entirely, with the full text of the April 2026 revision of the Salesforce Data Processing Addendum being deleted from the tracked source and replaced by a new URL source with no recoverable content.

Public summary; per-account review history visible to subscribers tracking this vendor.

Track Heroku in your workspace.

Get notified when Heroku adds a subprocessor, changes retention, updates their DPA, or quietly amends their privacy posture.

Start tracking — 14-day trial

No card required.