Is Heroku PCI Compliant?

Question

Obviously Heroku wants you to think they're PCI compliant by telling you "Heroku’s infrastructure provider is PCI Level 1 compliant" (AWS). https://www.heroku.com/policy/security

But since Heroku runs their own IaaS on top of that, wouldn't Heroku themselves need to be PCI compliant in order for any Heroku-based environment to be PCI compliant as well?

Obviously PCI compliance is more than the hosting provider, but stated another way, is it possible to be PCI compliant using a shopping cart that handles CC information in a Heroku environment?

EDIT: I know hosted payment pages would bypass this problem, so let's assume you must use a shopping cart that communicates with a gateway directly to pass through CC data.

Answer 1

It's up to the merchant to ensure he is PCI compliant. So this means that when you as a merchant run a webshop which holds or processes carholder data you are responsible for securing it. Either you do it yourself or you transfer the risk to Heroku. To transfer the risk (or some of it) you would require an attestation from Heroku which specifically shows which controls they implement in regard to PCI-DSS. You can then use this attestation as assurance.

If you look at what they state:

We use PCI compliant payment processor Braintree for encrypting and processing credit card payments. Heroku’s infrastructure provider is PCI Level 1 compliant.

It doesn't mean that their whole environment is usable to store or process card holder data, it just means they, themselves are PCI compliant when they process their clients and their cards. They do not state that Heroku can be used, as is, for applications which process or store card holder data.

So to be able to have assurance from Heroku, the whole Heroku platform should be audited to provide assurance they are PCI compliant. Often these providers offer these types of statements which can cover the PCI-DSS controls in the form of an ISAE3402 (if deemed acceptable by your QSA).

Also they state they can be used for applications which need to conform to the Sarbanes and Oxley Act (SOX). These require SOC reports, which they seem to offer. SOC reports also cover a myriad of security controls which can be used for assurance in terms of PCI DSS by your QSA.

Note that it is up to the QSA to accept or decline the SOC reports, it's in his right to refuse reliance of these reports and perform the audit himself.