[verystealthy]

The Heroku situation is more nuanced than it seems. This is not a PCI DSS 3.0 issue. The thing is that Heroku provides a platform and this platform is not PCI DSS compliant (1.21, 2.0, 3.0, you name it) and Heroku is not willing to let QSAs verify their compliance on behalf of their clients (and, yes, I have first hand experience with this very scenario). There's a caveat, however: if your payment platform is completely segregated from your Heroku environment, you might be good to go. Let's say you use a payment gateway and cardholder data never touches your Heroku environment (e.g. you're redirected to Payment Gateway XYZ's app to enter your payment information). In this case your Heroku environment would be potentially out of scope, as you're not transmitting, storing or processing cardholder data. If you're handling cardholder data in any capacity in your Heroku environment, then, yes, you're in for a big compliance surprise.

[grandalf]

> Heroku is not willing to let QSAs verify their compliance on behalf of their clients

This is the issue. Chances are Heroku has a very secure infrastructure, but the world will never know unless it allows various audits to be generated for compliance purposes.

> There's a caveat, however: if your payment platform is completely segregated from your Heroku environment, you might be good to go

Not true, see below:

https://www.pcicomplianceguide.org/new-saq-a-ep-hones-in-on-...

[verystealthy]

>This is the issue. Chances are Heroku has a very secure infrastructure, but the world will never know unless it allows various audits to be generated for compliance purposes.

Exactly. And, personally, I think this is rather odd. They could solve this in a heartbeat.

>Not true, see below:

Duly noted and thanks for the link, but here's the thing, though: what if you're not eligible for a self-assessment?

[grandalf]

> what if you're not eligible for a self-assessment

If you're doing higher transaction volume and are not eligible for a self-assessment, you have to have a certified QSA sign off on an audit of the internal processes.

The QSA will make sure that all the required systems and processes are in place and sign off on it.

PCI is definitely a fairly frustrating thing to deal with but there are some good practices underlying it that many orgs would simply not do if it weren't required by their merchant processor.