2 ms·
Heroku has lots of single points of failure in its architecture. Heroku also has no transparency into its architecture, which is why no site on Heroku will be
by grandalf 12y ago
Heroku has lots of single points of failure in its architecture.
Heroku also has no transparency into its architecture, which is why no site on Heroku will be able to be PCI compliant after Jan 2015.
I'm not optimistic about Heroku's ability to continue to be a leading PaaS.
- cschmidt 12y ago> no site on Heroku will be able to be PCI compliant after Jan 2015 do you have a reference for that?
- grandalf 12y agoRead the PCI DSS 3.0 SAQ A-EP documentation (and some of the blog posts people have written about it). Heroku has never been able to pass a PCI Level 1 or Level 2 audit, but as of Jan 2014 it will also no longer pass level 3 or level 4 SAQs.
- spitfire 12y agoWhat in particular is Heroku missing to pass level 3 and 4? Hit and run comments aren't really useful. Some detail and if possible some suggestions for improvement really help. Even if they can't be implemented for some reason.
- grandalf 12y ago> What in particular is Heroku missing to pass level 3 and 4? It's mostly documentation. If Heroku has built a secure system and documented it adequately, then it would easily pass SAQ A-EP. One easy example: Maybe Heroku keeps logs of all HTTP requests that include params containing credit card numbers. Nobody knows.