> How Heroku, the Salesforce-owned PaaS, processes EU visitor and customer data under GDPR: EU region, Private Spaces, US transfers and a deployment checklist. > > Canonical: https://www.flowconsent.com/en/services/hosting/heroku Hosting # Heroku Unclassified Heroku is a Platform as a Service that has been hosting Ruby, Node.js, Python, PHP, Java, Go and Clojure applications since 2007. Acquired by Salesforce in 2010, Heroku runs on AWS with a European region (eu-west-1 Ireland) and Private Spaces in Frankfurt and Dublin. Heroku itself does not set cookies on the public visitors of a hosted application; the application owner remains responsible for any cookies and analytics it deploys on top of Heroku. [Block Heroku until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=hosting) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Hosting](https://www.flowconsent.com/en/services/hosting) - Consent Unclassified - Prior consent Not required - Documented cookies 0 - Third-party domains 4 - Servers AWS regions selected by the customer: Common Runtime in us-east-1 and eu-west-1 (Ireland); Private Spaces in additional AWS regions (Frankfurt, Dublin, Virginia, Oregon, Tokyo, Sydney); company headquartered in San Francisco (Heroku, a Salesforce company) Overview ## What does Heroku do? ## What Heroku is and how it fits in a website stack Heroku is one of the oldest Platforms as a Service, founded in 2007 and acquired by Salesforce in 2010. It hosts Ruby, Node.js, Python, PHP, Java, Go and Clojure applications on dynos that run on AWS infrastructure, with built in CI/CD, an extensive add on marketplace (Heroku Postgres, Heroku Redis, Heroku Connect, Heroku Data for Redis, third party data and observability tools) and Heroku Shield for HIPAA and PCI workloads. Most customers operate APIs, internal tools and B2B SaaS on Heroku. ## What data Heroku processes Heroku processes the IP address, request URL, HTTP method, headers and TLS handshake parameters needed to route requests to the application dynos. Logs (Logplex) include request metadata and any log line emitted by the application. Heroku Postgres and Heroku Data add ons store the application data the customer chooses to persist. Heroku itself does not set cookies on the public visitors of customer applications. ## GDPR and ePrivacy implications IP addresses processed by the Heroku Router are personal data under the GDPR. Heroku is a processor for the customer application and a controller for limited operational purposes. Pure hosting does not write information to the visitor device, so the ePrivacy consent rule is not triggered. The application owner remains the controller for any cookies, analytics or marketing scripts it loads inside the dyno responses. ## International data transfers Heroku Common Runtime offers a European region (eu-west-1 Ireland); Heroku Private Spaces extend coverage to Frankfurt and Dublin for full EU residency. The control plane, customer support and account data operate from the United States. Transfers rely on the Salesforce Data Processing Addendum, the EU Standard Contractual Clauses under Article 46(2)(c) GDPR and the EU US Data Privacy Framework, with TLS 1.3, encryption at rest, ISO 27001, SOC 2 Type II and Heroku Shield offerings for HIPAA and PCI DSS workloads. ## Practical compliance steps Sign the Salesforce Data Processing Addendum, deploy your applications in the European region (or in a Private Space in Frankfurt or Dublin) for EU residency, configure log retention rules on Logplex, encrypt sensitive columns in Heroku Postgres and consider Heroku Shield for HIPAA and PCI workloads. Document Heroku as a processor in your record of processing activities and mention the US transfer to Salesforce in the privacy notice. Compliance ## Heroku and the GDPR - Legal basis Legitimate Interest (Art. 6(1)(f) GDPR) for hosting and routing the customer application; performance of a contract (Art. 6(1)(b) GDPR) for the underlying contract with Heroku; the application owner remains the controller for end user data stored on dynos and add ons - Risk level medium - Applicable regulations GDPR, ePrivacy Directive (Cookie Law), CCPA, HIPAA (with Salesforce BAA on Shield) ### Impact assessment (DPIA) A DPIA is generally not required for a standard SaaS hosted on Heroku. A DPIA is recommended when the application performs systematic profiling, when Heroku Postgres and Heroku Connect store large volumes of EU personal data, when Heroku Shield is used for HIPAA workloads or when the customer operates in a regulated sector. ### Sample text for your banner > This application is hosted on Heroku, a Platform as a Service operated by Heroku Inc. (a Salesforce company, USA) on AWS in the Ireland region. Heroku processes the IP address, request URL and headers needed to route the traffic. By accepting, you allow this transfer to Heroku and Salesforce servers, including in the United States, under EU Standard Contractual Clauses and the EU US Data Privacy Framework. Cookies and trackers ## What Heroku sets and contacts - Tracking method Platform as a Service (PaaS) hosting Ruby, Node.js, Python, PHP, Java, Go and Clojure applications on dynos backed by AWS; HTTP routing through the Heroku Router - Server location AWS regions selected by the customer: Common Runtime in us-east-1 and eu-west-1 (Ireland); Private Spaces in additional AWS regions (Frankfurt, Dublin, Virginia, Oregon, Tokyo, Sydney); company headquartered in San Francisco (Heroku, a Salesforce company) - Cookieless mode available Yes - Data transferred outside the EU Heroku is a Platform as a Service operated by Heroku Inc., a subsidiary of Salesforce Inc. (USA). The Common Runtime offers a European region (eu-west-1 Ireland), while Private Spaces extend coverage to Frankfurt and Dublin. The control plane, account management, billing and support are operated from the United States. Transfers rely on the Salesforce Data Processing Addendum, the EU Standard Contractual Clauses under Article 46(2)(c) GDPR and the EU US Data Privacy Framework. ### Third-party domains contacted (4) - `heroku.com` - `herokuapp.com` - `heroku-app.com` - `salesforce.com` Questions ## Frequently asked questions about Heroku Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does Heroku set cookies on visitor devices? No. Heroku is a hosting platform and does not set any cookies on the public visitors of customer applications. Cookies on a site hosted on Heroku come from the application code itself or from third party scripts that the application loads. ### Is consent required for Heroku under GDPR and ePrivacy? No. Pure hosting and HTTP routing do not write information to the device, so the ePrivacy consent rule is not triggered. Consent obligations come from the application running on Heroku, not from Heroku itself. ### What is the legal basis for processing data through Heroku? For hosting and routing the application, the legal basis is legitimate interest under Article 6(1)(f) GDPR. The contract with Heroku is processed under Article 6(1)(b) GDPR. Personal data stored in Heroku Postgres or Heroku Connect follows the legal basis chosen by the application owner. ### How are data transfers to the United States protected? Heroku is operated by Salesforce. Salesforce signs the EU Standard Contractual Clauses under Article 46(2)(c) GDPR via its Data Processing Addendum and confirms participation in the EU US Data Privacy Framework. Supplementary measures include TLS 1.3, encryption at rest, ISO 27001 and SOC 2 Type II, with Heroku Shield for HIPAA and PCI workloads. ### Is a DPIA required for Heroku? A DPIA is not required for a standard application on Heroku. A DPIA is recommended when the hosted application performs systematic profiling of EU users, when Heroku Postgres stores large volumes of personal data, when Heroku Shield is used for HIPAA workloads or when the application targets regulated sectors. ### How do I deploy Heroku in a GDPR compliant way? Sign the Salesforce Data Processing Addendum, run production in the eu-west-1 region or in a Frankfurt or Dublin Private Space, configure log retention, encrypt sensitive columns in Heroku Postgres and document Heroku as a processor in your record of processing activities. Mention the US transfer to Salesforce in the privacy notice and audit any add on that processes personal data. ### What are the alternatives to Heroku in Europe? European or open source alternatives include Scaleway Serverless (France), Clever Cloud (France), OVHcloud Web PaaS (France), Render with EU regions, Fly.io with European regions, Coolify (self hosted, open source) and self hosted Kubernetes on Hetzner or Scaleway clusters. ### How do I update the cookie policy when using Heroku? List Heroku (Salesforce) as the hosting processor, mention that the application is deployed in the EU Ireland region or in a Private Space, state that data including IP addresses may be transferred to the United States under SCCs and the EU US Data Privacy Framework, and link to the Salesforce Privacy Policy. Same category ## More services: Hosting [See the whole category](https://www.flowconsent.com/en/services/hosting) ### [Oracle Application Server](https://www.flowconsent.com/en/services/hosting/oracle-application-server) [Oracle Application Server is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Oracle Application Server provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Oracle Application Server ensures optimal performance at scale.](https://www.flowconsent.com/en/services/hosting/oracle-application-server) [Hosting](https://www.flowconsent.com/en/services/hosting/oracle-application-server) · ### [Hyperlane](https://www.flowconsent.com/en/services/hosting/hyperlane) [Hyperlane is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Hyperlane supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Hyperlane enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/hosting/hyperlane) [Hosting](https://www.flowconsent.com/en/services/hosting/hyperlane) · ### [Ferron](https://www.flowconsent.com/en/services/hosting/ferron) [Ferron is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Ferron supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Ferron ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/hosting/ferron) [Hosting](https://www.flowconsent.com/en/services/hosting/ferron) · ### [Lagoon](https://www.flowconsent.com/en/services/hosting/lagoon) [Lagoon is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Lagoon integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Lagoon helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/hosting/lagoon) [Hosting](https://www.flowconsent.com/en/services/hosting/lagoon) · ### [Intel AMT](https://www.flowconsent.com/en/services/hosting/intel-active-management-technology) [Intel Active Management Technology is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Intel Active Management Technology integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Intel Active Management Technology helps organizations.](https://www.flowconsent.com/en/services/hosting/intel-active-management-technology) [Hosting](https://www.flowconsent.com/en/services/hosting/intel-active-management-technology) · ### [JBoss Application Server](https://www.flowconsent.com/en/services/hosting/jboss-application-server) [JBoss Application Server is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. JBoss Application Server provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, JBoss Application Server ensures optimal performance at scale.](https://www.flowconsent.com/en/services/hosting/jboss-application-server) [Hosting](https://www.flowconsent.com/en/services/hosting/jboss-application-server) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)