3 ms·
> no site on Heroku will be able to be PCI compliant after Jan 2015 do you have a reference for that?
by cschmidt 12y ago
> no site on Heroku will be able to be PCI compliant after Jan 2015
do you have a reference for that?
- grandalf 12y agoRead the PCI DSS 3.0 SAQ A-EP documentation (and some of the blog posts people have written about it). Heroku has never been able to pass a PCI Level 1 or Level 2 audit, but as of Jan 2014 it will also no longer pass level 3 or level 4 SAQs.
- spitfire 12y agoWhat in particular is Heroku missing to pass level 3 and 4? Hit and run comments aren't really useful. Some detail and if possible some suggestions for improvement really help. Even if they can't be implemented for some reason.
- grandalf 12y ago> What in particular is Heroku missing to pass level 3 and 4? It's mostly documentation. If Heroku has built a secure system and documented it adequately, then it would easily pass SAQ A-EP. One easy example: Maybe Heroku keeps logs of all HTTP requests that include params containing credit card numbers. Nobody knows.