Obviously Heroku wants you to think they're PCI compliant by telling you "Heroku’s infrastructure provider is PCI Level 1 compliant" (AWS). https://www.heroku.com/policy/security

But since Heroku runs their own IaaS on top of that, wouldn't Heroku themselves need to be PCI compliant in order for any Heroku-based environment to be PCI compliant as well?

Obviously PCI compliance is more than the hosting provider, but stated another way, is it possible to be PCI compliant using a shopping cart that handles CC information in a Heroku environment?

EDIT: I know hosted payment pages would bypass this problem, so let's assume you must use a shopping cart that communicates with a gateway directly to pass through CC data.

1 Answer 1


It's up to the merchant to ensure he is PCI compliant. So this means that when you as a merchant run a webshop which holds or processes carholder data you are responsible for securing it. Either you do it yourself or you transfer the risk to Heroku. To transfer the risk (or some of it) you would require an attestation from Heroku which specifically shows which controls they implement in regard to PCI-DSS. You can then use this attestation as assurance.

If you look at what they state:

We use PCI compliant payment processor Braintree for encrypting and processing credit card payments. Heroku’s infrastructure provider is PCI Level 1 compliant.

It doesn't mean that their whole environment is usable to store or process card holder data, it just means they, themselves are PCI compliant when they process their clients and their cards. They do not state that Heroku can be used, as is, for applications which process or store card holder data.

So to be able to have assurance from Heroku, the whole Heroku platform should be audited to provide assurance they are PCI compliant. Often these providers offer these types of statements which can cover the PCI-DSS controls in the form of an ISAE3402 (if deemed acceptable by your QSA).

Also they state they can be used for applications which need to conform to the Sarbanes and Oxley Act (SOX). These require SOC reports, which they seem to offer. SOC reports also cover a myriad of security controls which can be used for assurance in terms of PCI DSS by your QSA.

Note that it is up to the QSA to accept or decline the SOC reports, it's in his right to refuse reliance of these reports and perform the audit himself.

  • I see what you're saying I think. If I could paraphrase, it is possible to be PCI compliant on Heroku even if they aren't PCI compliant by combing through their other compliance documentation and finding the corresponding controls that would satisfy the PCI controls in scope for the merchant?
    – J K
    May 13, 2015 at 14:15
  • Yes, with the caveat that it's ultimately up to your qsa to decide if the documentation is acceptable or not. May 13, 2015 at 15:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .