> What in particular is Heroku missing to pass level 3 and 4? It's mostly documentation. If Heroku has built a secure system and documented it adequately, the

> What in particular is Heroku missing to pass level 3 and 4? It's mostly documentation. If Heroku has built a secure system and documented it adequately, then it would easily pass SAQ A-EP. One easy example: Maybe Heroku keeps logs of all HTTP requests that include params containing credit card numbers. Nobody knows.