Heroku

United States · www.heroku.com · 20 vendors

Heroku is a cloud platform as a service (PaaS) that enables developers to build, deploy, manage, and scale applications in the cloud. It supports multiple programming languages and provides a fully managed environment for application hosting and deployment, allowing developers to focus on building applications without managing infrastructure. Heroku was acquired by Salesforce in 2010/2011.

Resilience scores

Disruption prediction

Heroku has a 24% probability of disruption in the next 6 months.

12 of Heroku's 20 vendors monitored for disruptions.

Technology vendors

Services catalogue

8 services in catalogue across 5 categories; runs on 20 sub-vendors.

Insights

Last updated 2026-05-05 · revision 1

20 direct vendors, 265 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 9/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Heroku exhibits high migration readiness primarily due to its inherently cloud-native, containerized, and microservices-oriented architecture. As a Platform as a Service (PaaS) built on AWS and utilizing Docker containers (Dynos), its systems are designed for portability and scalability across modern cloud environments. The platform's support for a wide array of programming languages (Node.js, Ruby, Java, PHP, Python, Go, Scala, Clojure, .NET) ensures flexibility for migrating diverse application portfolios. Heroku's mature continuous delivery practices, facilitated by Heroku Flow (Pipelines, Review Apps, GitHub integration), streamline deployment and can significantly ease migration efforts. The internal tech stack's reliance on widely adopted open-source components like PostgreSQL, Apache Kafka, Valkey, Docker, and Git further reduces proprietary lock-in, making it easier to transition to alternative platforms. Heroku's experience with stringent compliance requirements (PCI DSS, HIPAA, ISO, SOC) also indicates a capability to manage regulatory complexities during a migration. Additionally, established integrations with Salesforce via Heroku Connect and AppLink can simplify data and application migration for Salesforce-centric operations. Potential challenges include the 'Unknown' vendor lock-in risk for Heroku's own internal vendors, particularly concerning its deep integration with AWS, which could introduce complexity in decoupling. The absence of financial data (revenue concentration, growth history) also means Heroku's capacity to fund a large-scale migration cannot be fully assessed. Data residency requirements are 'Not specified,' which could become a significant factor if strict mandates emerge.

Compliance

6 in-scope frameworks identified; showing 3.

PCI DSS (source) — Compliant

Heroku maintains PCI DSS Level 1 Service Provider compliance for Shield services only. Risk is medium because PCI compliance is limited to Shield services and requires specific configuration, with significant penalties for non-compliance in payment processing scenarios.

Evidence: https://www.heroku.com/compliance/, https://devcenter.heroku.com/articles/security-privacy-compliance

ISAE 3000 (source) — Assessment Required

No specific ISAE 3000 compliance information found in Heroku documentation. However, risk is low because Heroku maintains comprehensive SOC and ISO certifications that cover similar assurance requirements, and ISAE 3000 is not typically required for cloud platform providers.

HIPAA (source) — Compliant

Heroku offers HIPAA compliance through Heroku Shield services for healthcare applications. Risk is medium because HIPAA compliance requires specific configuration (Shield services) and Business Associate Agreements, and non-compliance can result in significant penalties in the healthcare sector.

Evidence: https://www.heroku.com/compliance/, https://devcenter.heroku.com/articles/security-privacy-compliance

Financials

Three-year financials

Financial Resilience Score: 7/10

Heroku's financial resilience is effectively a function of its parent, Salesforce, Inc., which acquired it in December 2010 for approximately US$212 million. Salesforce is a financially strong, investment-grade parent with FY2025 revenue of approximately US$37.9 billion, GAAP operating income of ~US$7.2 billion, and free cash flow exceeding US$12 billion. This provides Heroku with substantial access to capital, shared infrastructure, and an established enterprise sales channel. However, Heroku's standalone financials are not disclosed in any Salesforce SEC filing — it is consolidated within the broader Subscription & Support / Platform line. The March 2026 announcement that Heroku has transitioned to a 'Sustaining Engineering model' signals the parent is treating it as a mature, cash-generating but no-longer-strategic-growth asset, focusing on maintenance and stability rather than aggressive new-feature development. Combined with the controversial 2022 removal of free tiers and intense competition from hyperscalers (AWS, Azure, GCP) and modern PaaS rivals (Vercel, Render, Fly.io, Railway), Heroku faces meaningful long-term competitive pressure even as its parent remains highly resilient.

Key strengths: Wholly-owned subsidiary of Salesforce (investment-grade parent), Salesforce FY2025 revenue ~US$37.9B with ~US$7.2B operating income, Salesforce free cash flow exceeding US$12B annually, Established PaaS brand with long-tenured enterprise customers, Compliance certifications (PCI, HIPAA, ISO, SOC) supporting regulated-industry retention, Recurring subscription revenue model with sticky workloads

Risk factors: Transition to 'Sustaining Engineering model' announced March 2026 signals reduced strategic investment, 2022 removal of free tiers caused community backlash and customer churn, Intense competition from hyperscalers and modern PaaS rivals (Vercel, Render, Fly.io), No independent financial disclosure — entirely consolidated within Salesforce, Strategic dependence on Salesforce; future divestiture or wind-down at parent's discretion, Developer-community sentiment under pressure

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report