Heroku Due Diligence

Run due diligence on Heroku: check incident history and compliance and get alerts when suppliers change.

United States · www.heroku.com · 17 vendors

Heroku is a cloud platform as a service (PaaS) that enables developers to build, deploy, manage, and scale applications in the cloud. It supports multiple programming languages and provides a fully managed environment for application hosting and deployment, allowing developers to focus on building applications without managing infrastructure. Heroku was acquired by Salesforce in 2010/2011.

Resilience scores

Disruption prediction

Heroku: 1 critical incidents expected in the next three months, based on its recorded incident history.

Forecast estimates are rounded up to whole numbers.

No active incident reported (StatusGator, as of 2026-11-09 17:45 UTC)

9 of Heroku's 17 vendors have incident tracking.

Technology vendors

Services catalogue

7 services in catalogue across 4 categories; runs on 17 sub-vendors.

Insights

Last updated 2026-05-05 · revision 1

17 direct vendors, 192 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

6 in-scope frameworks identified; showing 3.

PCI DSS (source) — Evidence found

Evidence: https://www.heroku.com/compliance/, https://devcenter.heroku.com/articles/security-privacy-compliance

ISAE 3000 (source) — No public evidence

ISO 27001 (source) — Evidence found

Evidence: https://www.heroku.com/compliance/, https://devcenter.heroku.com/articles/security-privacy-compliance

Financials

Three-year financials

Financial Resilience Score: 7/10

Heroku's financial resilience is effectively a function of its parent, Salesforce, Inc., which acquired it in December 2010 for approximately US$212 million. Salesforce is a financially strong, investment-grade parent with FY2025 revenue of approximately US$37.9 billion, GAAP operating income of ~US$7.2 billion, and free cash flow exceeding US$12 billion. This provides Heroku with substantial access to capital, shared infrastructure, and an established enterprise sales channel. However, Heroku's standalone financials are not disclosed in any Salesforce SEC filing — it is consolidated within the broader Subscription & Support / Platform line. The March 2026 announcement that Heroku has transitioned to a 'Sustaining Engineering model' signals the parent is treating it as a mature, cash-generating but no-longer-strategic-growth asset, focusing on maintenance and stability rather than aggressive new-feature development. Combined with the controversial 2022 removal of free tiers and intense competition from hyperscalers (AWS, Azure, GCP) and modern PaaS rivals (Vercel, Render, Fly.io, Railway), Heroku faces meaningful long-term competitive pressure even as its parent remains highly resilient.

Key strengths: Wholly-owned subsidiary of Salesforce (investment-grade parent), Salesforce FY2025 revenue ~US$37.9B with ~US$7.2B operating income, Salesforce free cash flow exceeding US$12B annually, Established PaaS brand with long-tenured enterprise customers, Compliance certifications (PCI, HIPAA, ISO, SOC) supporting regulated-industry retention, Recurring subscription revenue model with sticky workloads

Risk factors: Transition to 'Sustaining Engineering model' announced March 2026 signals reduced strategic investment, 2022 removal of free tiers caused community backlash and customer churn, Intense competition from hyperscalers and modern PaaS rivals (Vercel, Render, Fly.io), No independent financial disclosure — entirely consolidated within Salesforce, Strategic dependence on Salesforce; future divestiture or wind-down at parent's discretion, Developer-community sentiment under pressure

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report