Heroku
The original application platform-as-a-service, now part of Salesforce, running apps in managed containers called dynos with a large first-party and third-party add-on catalog.
No free tier; per-dyno monthly tiers for compute (with a sleep-on-inactivity entry tier), separately tiered managed Postgres plans, plus metered third-party add-ons
Proprietary
Appears in 1 guide
Where it ranks
Guides that include Heroku.
Security headers
What Heroku's website sends to your browser.
Scanned 2026-08-25. Grade headers A, scoring 90 out of 100.
+
Content-Security-Policy is set
+
Strict-Transport-Security is set
+
X-Content-Type-Options: nosniff is set
+
X-Frame-Options is set
+
Referrer-Policy is set
+
Permissions-Policy is set
−
No Cross-Origin-Opener-Policy
−
No Cross-Origin-Resource-Policy
+
No server-version or X-Powered-By disclosure
This is one narrow, automated check of the HTTP response headers on the vendor's own website. It says nothing about how the product itself is built, how it stores your data, or whether it has ever been audited. A good grade here is a small signal that somebody was paying attention.