You haven't really stated why they're using CloudFlare - is it for the free TLS? To be honest if they can't afford the $240/year to get TLS added to Heroku per

You haven't really stated why they're using CloudFlare - is it for the free TLS? To be honest if they can't afford the $240/year to get TLS added to Heroku perhaps they've got bigger problems?