XMA Limited

XMA Salesforce - Heroku

Heroku, a Salesforce company enables developers to focus on application code and data instead of managing servers or operations. Code with agility in open source: Ruby, Node.js, Java, PHP and more. Deploy and scale on demand. Extend apps with 100s of different add-ons. Includes EU Model Contract Clauses. SFDCX2022GC13

Features

• Fully managed container runtime environment
• Scale, dynamically scale up or down instantly to meet demand
• Buildpacks, open source supported and supplied or build your own
• Config, manage specific configurations separately from your source code
• Deploy, with Git. We'll handle compilation, dependencies, assets and executables
• Fork, creates a duplicate instance of your application immediately
• Extend, over 100 add-ons, integrated to Heroku.
• Region, US, Europe and APAC, EU Model Contract Clauses supported
• Data sync into Salesforce Sales, Service, & Marketing Clouds
• Open source, Ruby, Node.js, Python, Java, PHP, Scala or Clojure

Benefits

• Efficient, Developers can focus on the app, not the infrastructure
• Skills, prevalent in the market giving you greater choice
• Community, active to help you learn and share code
• Cost, cheaper than hosting and supporting your own environment
• Agile, create new apps, then deploy on demand
• Platform, API automate/extend with services in a programmatic manner
• Security, Virtual Private Cloud, SSO with OAuth SAML & GDPR
• Flexibility, listed here avoiding lengthy credit-card approvals
• Heroku, Connect pre-built integration to the best of Salesforce
• Speed, scales to millions, exploit the AWS underpin

£25.42 a unit a month

• Free trial available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@xma.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

990301406892068

Contact

Nancy Clayton-Schofield
0115 846 4000
bidteam@xma.co.uk

Service scope

• Service constraints: Usage Limits; Services and content are subject to usage limits, including, for example, the quantities specified in order forms.; A user’s password may not be shared with any other individual.; ; If you exceed a contractual usage limit, we may work with you to seek a reduction in your usage so that it conforms to that limit. If, notwithstanding our efforts, you are unable or unwilling to abide by a contractual usage limit, you will execute an order form for additional quantities of the applicable services or content promptly upon our request.; ; Full details are contained in our terms and conditions.
• System requirements:
  • Heroku Dashboard - web based use any browser
  • Heroku CLI - for Mac OSX, Windows, Debian/Ubuntu and standalone
  • Heroku API - connect programatically

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Guaranteed 30 minute response time on urgent issues. Urgent support available 24x7. Within Business Hours receive deployment consultations, architectural guidance and best practices from Customer Solutions Architects.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: No
• Web chat support: No
• Onsite support: No
• Support levels: Urgent support available 24x7. Within Business Hours receive deployment consultations, architectural guidance and best practices from Customer Solutions Architects.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Customer Solutions Architects proactively assist customers onboard to the service - providing guidance on initial access and setup and continue to provide white glove support on an ongoing basis
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Dependent on the service being consumed. Code should alway exist outside of Heroku and should already be available - if not it can be extracted from applications on Heroku. Data stored in data services can be extracted using standard tools for the service being used. Extraction for add-on services will vary.
• End-of-contract process: Off-boarding from the service will be specific to the nature of the code and service as deployed. The customer therefore always has access to the code, and the data held within the PaaS offering. Typically most customers use the supported databases in conjunction with Heroku, and as such data exports and backups can be taken as required. Code can be saved to GitHub such that off-boarding from Heroku is predictable. Being open source based Heroku can make your data available via an industry standard and easily readable format to make it as easy as possible for you to migrate to another service if you wish to do so.

Using the service

• Web browser interface: Yes
• Using the web interface: The Heroku Dashboard is the web user interface for Heroku’s core features and functionality. It provides UI support for things like creating/renaming/deleting apps, configuring add-ons, managing Heroku Teams, creating Heroku Pipelines, deploying your application, viewing and responding to application metrics, and accessing usage, invoices and billing information.
• Web interface accessibility standard: None or don’t know
• How the web interface is accessible: Heroku Services are developed with accessibility standard awareness - automated testing tools are used to validate errors and changes are made where necessary.
• Web interface accessibility testing: No public information available.
• API: Yes
• What users can and can't do using the API: The platform API empowers developers to automate, extend and combine Heroku with other services. You can use the platform API to programmatically create apps, provision add-ons and perform other tasks that could previously only be accomplished with Heroku toolbelt or dashboard.
• API automation tools:
  • Ansible
  • Chef
  • Terraform
  • Puppet
  • Other
• Other API automation tools:
  • Jenkins
  • Bamboo
  • Codeship
  • Travis
  • Capistrano
  • CircleCI
  • VisualStudio
  • Otto
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
  • Other
• Command line interface: Yes
• Command line interface compatibility:
  • Linux or Unix
  • Windows
  • MacOS
• Using the command line interface: The Heroku Command Line Interface (CLI), formerly known as the Heroku Toolbelt, is a tool for creating and managing Heroku apps from the command line / shell of various operating systems. All capabilities available in the API are available via the CLI.

Scaling

• Scaling available: Yes
• Scaling type: Automatic
• Independence of resources: Heroku provides both single and multi-tenant instances. Single tenant instances are dedicated only for single customer use and isolated from the risk of 'noisy neighbours'. As a platform Heroku serves many billions of requests on a monthly basis.
• Usage notifications: No

Analytics

• Infrastructure or application metrics: Yes
• Metrics types:
  • CPU
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
  • Other
• Other metrics: Request Throughput
• Reporting types: Real-time dashboards

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Salesforce

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: Data is encrypted at rest by using AES-256, block-level storage encryption. Data encryption is implemented using the AWS EBS disk encryption feature. Encryption keys are fully managed by AWS and are not visible to Heroku or Heroku customers. Access credentials are also encrypted at rest.
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

• Backup and recovery: Yes
• What’s backed up:
  • Configuration - application configuration and settings
  • Data - data stored in Heroku managed data services
  • Other - backup capabilities of add-ons vary by provider
• Backup controls: Heroku performs automatic backups of the platform, customer application configuration, and Heroku data services attached to applications. Customers can trigger additional backups on a manual or scheduled basis. The capabilities of 3rd party add-ons will vary dependant on the service used.
• Datacentre setup: Multiple datacentres with disaster recovery
• Scheduling backups: Supplier controls the whole backup schedule
• Backup recovery: Users can recover backups themselves, for example through a web interface

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: Each application on the Heroku platform runs within its own isolated environment and cannot interact with other applications or areas of the system. This restrictive operating environment is designed to prevent security and stability issues. These self-contained environments isolate processes, memory, and the file system using Linux containers (LXC), while host-based firewalls restrict applications from establishing local network connections.

Availability and resilience

• Guaranteed availability: We'll do everything we can to achieve 100% uptime. We will never achieve 100% uptime, but when we fall short, we'll explain why and how we'll do better next time. Heroku Enterprise Platform Uptime SLA available subject to additional signed SLA document; subject to approval on a per contract basis.
• Approach to resilience: The Heroku platform is designed for stability, scaling, and inherently mitigates common issues that lead to outages while maintaining recovery capabilities. The platform maintains redundancy to prevent single points of failure, is able to automatically replace failed components, and utilises multiple data centres designed for resiliency. In the case of an outage, the platform is deployed across multiple data centres using current system images and data is restored from backups. Heroku reviews platform issues to understand the root cause, impact to customers, and improve the platform and processes. In the event of an interruption of Heroku services, details are posted on the status page: https://status.heroku.com/. The Heroku platform itself is designed to provide highly available and redundant services, so that applications and databases may be replicated quickly in the event of an outage.
• Outage reporting: Status website, RSS feed and Twitter

Identity and authentication

• User authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google apps)
  • Username or password
  • Other
• Other user authentication: Authentication method depends on access method - dashboard access is username/password with 2FA or SSO; API is OAUTH.
• Access restrictions in management interfaces and support channels: Management access to services is restricted to specific personnel - fine grained control over which systems they have access to is in-place. Strong security rotation policies are in place and access to maintain the platform is only completed from authorised machines over secure channels. Heroku Support personnel only have access to customer applications if the customer gives them permission to do so.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Devices users manage the service through: Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: Yes
• Any other security certifications:
  • ISO27001, ISO27017, ISO27018
  • Asip Sante HDS
  • NEN-7510-1:2017
  • PCI:DSS
  • UK Cyber Essentials Plus
  • SSAE18/ ISAE 3402
  • ISMAP
  • APEC Processor Seal

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: Salesforce operates an information security management system (ISMS) for Heroku in accordance with the ISO 27001 international standard. Salesforce has achieved ISO 27001/27017/27018 certification for its ISMS from an independent third party. Information Security is the responsibility of the Security team led by the Chief Trust Officer (equivalent to CISO). The Security team plans, implements, and runs information security operations; creates and maintains security documentation and framework compliance (ISO 27002); identifies applicable laws and regulations in security and privacy, maintains the security awareness program; and performs information security risk assessments.
• Information security policies and processes: Salesforce's information security policies are based on the ISO 27002 framework of best practices and are ISO 27001 certified. The EVP of Security has responsibility for the information security policies and ISMS. The Salesforce Security Steering Committee approves/authorizes all changes to the policies, the Statement of Applicability (SoA), the information security manual, and any separate policy statements. During the ISO 27001 audit process (as well as other audits such as SOX and SSAE 16 SOC 1), Senior Management for various departments are involved in verifying that policies and procedures are in place and adhered to. Policies are reviewed/approved at least annually.

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: The Heroku Security team performs change management in line with the Salesforce change management standards which closely align with the ITIL framework. Change Management processes dictate that system changes and maintenance are documented in Salesforce’s internal ticketing system. Changes require approval, security impact and risk analysis and testing prior to deployment
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Our vulnerability management process is designed to remediate risks without customer interaction or impact. Heroku is notified of vulnerabilities through internal and external assessments, system patch monitoring, and third party mailing lists and services. Each vulnerability is reviewed to determine if it is applicable to Heroku’s environment, ranked based on risk, and assigned to the appropriate team for resolution.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Heroku security and engineering staff monitor various tools and log feeds to detect anomalous behaviour. The teams review authentication events, sudo requests, data traffic patterns, and other data sources. More detail to specific questions available on request.
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: Salesforce has a formal Incident Management Process that guides the Salesforce Computer Security Incident Response team in investigation, management, communication, and resolution activities.; ; Salesforce will promptly notify the customer in the event of any security breach of the Service resulting in an actual or reasonably suspected unauthorized disclosure of Customer Data. Notification may include phone contact by Salesforce support, email to customer's administrator and Security Contact and public posting on trust.salesforce.com.; ; Salesforce.com is a member of the prestigious Forum of Incident Response and Security Teams (FIRST) and complies with the FIRST framework and best practices for incident response.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
• Who implements virtualisation: Supplier
• Virtualisation technologies used: Other
• Other virtualisation technology used: LXC
• How shared infrastructure is kept separate: Each application on the Heroku platform runs within its own isolated environment and cannot interact with other applications or areas of the system. This restrictive operating environment is designed to prevent security and stability issues. These self-contained environments isolate processes, memory, and the file system using Linux containers (LXC), while host-based firewalls restrict applications from establishing local network connections. Infrastructure uses a fully virtualized hardware provided by AWS.

Energy efficiency

• Energy-efficient datacentres: Yes
• Description of energy efficient datacentres: AWS based

Social Value

• Fighting climate change:

  Fighting climate change

  In 2021, Salesforce achieved net zero across its full value chain and reached 100% renewable energy. This means Salesforce has purchased enough renewable energy to match all electricity it uses globally. ; ; Since first committing to this goal in 2013, Salesforce has been working to accelerate the global transition to clean and renewable sources of electricity with the aim for a future where renewable energy is powering the world around the clock.; ; Furthermore, Salesforce is on a mission to help conserve, restore, and grow 1 trillion trees by 2030.; ; Efforts include helping drive toward a 1.5°C future with its Climate Action Plan. Salesforce is focusing on six sustainability priorities — emissions reduction, carbon removal, trillion trees & ecosystem restoration, education & mobilisation, innovation, and regulation & policy — offering others a blueprint to accelerate their journey to Net Zero. In line with these priorities, Salesforce helped found 1t.org, a global movement to conserve, restore and grow 1 trillion trees by 2030 and launched an Ocean Sustainability Program to help protect our ocean.
• Covid-19 recovery:

  Covid-19 recovery

  Businesses are under pressure to find ways to innovate quickly, while providing seamless user experiences and increased security to accommodate the all-digital, work-from-anywhere world. At Salesforce, we have responded to our customers’ needs faster than ever. We launched Work.com in May to help organisations navigate the complexity of safe office return. It included apps for manual contact tracing, employee wellness checks, shift scheduling, employee learning platform and command centre to help leaders visualise the data and make informed decisions. We built an entirely new suite of solutions in just eight weeks." More details: https://www.salesforce.com/news/stories/how-salesforce-built-work-com-in-8-weeks/. We also launched Vaccine Cloud in 2021 to help monitor health in the community.; ; Returning to the office; As the pandemic changed the way we work and live, we used our technology like Work.com and expertise to safely reopen our offices world-wide, and welcome our employees in a safe environment.; The Salesforce's approach is more than just reopening offices, for Brent Hyder (former Salesforce President and CPO) it is ‘’an opportunity to create a workspace and an employee experience that makes us more connected, healthy, innovative and productive.’’; For more information: https://www.salesforce.com/news/stories/global-return-to-the-office-the-salesforce-approach/; ; Vaccine Cloud; Introduced in early 2021, this cloud-based solution is designed to help organisations, workplaces, schools, and non-profits make data-driven decisions based on health status so they can open safely. ; Vaccine Cloud helps businesses and organisations quickly scale vaccine operations. The solution features capabilities ranging from recipient registration and scheduling to inventory management and public health outreach. Salesforce built Vaccine Cloud because legacy systems were built too simplistic to handle this epidemic; Vaccine Cloud is a technology that helps:; • Mitigate short-term risks and stabilise operations; • Plan and orchestrate a return-to-work; • Engage customers, partners, and suppliers at every-point
• Tackling economic inequality:

  Tackling economic inequality

  Based on World Economic Forum’s “The Future of Jobs Report 2020,” 50% of employees will need new skills in the next five years to keep up with the technology. ; More than 3 million people are already skilling up with Trailhead.; Anyone ready to take their skills to the next level can sign up for a free Trailhead account at www.Trailhead.com ; ; Trailhead offers free learning, helping to create new pathways into tech for diverse talent. This shapes a more inclusive future. ; ; 9 out of 10 customers rely on our partner apps and experts. 70% of Salesforce implementations are led by 1 of 132,000 Salesforce experts. Our partnership ecosystem is predicted to create 9.3M jobs and $1.6T in new business revenue by 2026, according to IDC (source:https://www.salesforce.com/news/press-releases/2021/09/20/idc-salesforce-economy-2021/?sfdc-redirect=430). ; ; Sustainable supply; Sustainability is integral to Salesforce’s procurement strategy and our supplier relationships. On Trailhead we outline our expectations of suppliers.; ; Our commitment to Equality extends to our supply chain. Our suppliers are critical for our success and innovation, share our values, operate with integrity, respect, and transparency.; ; Partnering with small businesses and diverse suppliers is not just the right thing to do; it is smart business. We seek certified diverse suppliers bringing innovation to positively impact local communities, ecosystems, and the environment. ; ; We are active partners with diverse community-based organisations to provide development, education, and resources. We are proud members and sponsors of Disability:IN, the National LGBT Chamber of Commerce, the National Minority Supplier Development Council, the National Veteran Business Development Council, and the Women’s Business Enterprise National Council. As we expand our initiative globally, we are proud to join the Minority Supplier Development UK and Supply Nation.; ; Learn more: https://www.salesforce.com/company/supplier-diversity/
• Equal opportunity:

  Equal opportunity

  The Valuable 500 is a global call to action for 500 world’s most influential businesses to include disability on their agenda and end bias toward disability. ; We joined the group in 2019 to create inclusive workplaces where everyone feels valued, respected and comfortable. ; ; Equality is a core value at Salesforce. It empowers us to innovate, build deeper connections with our customers, and ultimately become a better company.; ; We strive to create a workplace that reflects the diverse communities around us. Together we can build a more equal workplace and world for all.; ; We set a goal in 2019 to have 50% of our U.S. employees from underrepresented groups by 2023. In 2020, we included additional public representation goals to continue to accelerate this work, and we’re evaluating new goals to help hold us accountable.; ; Our Equality Groups are employee-led organisations that build community, educate allies, and drive equality. We continue to offer recognition and compensation for globally elected Equality Group leaders. More information: https://www.salesforce.com/company/equality/equality-groups/ .; ; Equality Examples; ; New gender inclusive benefits; Transgender people face barriers and inequality — including access to healthcare. We want to help remove some of those barriers to ensure our transgender and non-binary employees can get the care they need and live as their true, authentic selves by providing critical financial and emotional support they deserve.; ; Equal pay; Salesforce has spent $16 million to date to ensure equal pay for equal work among its global workforce. In 2015, the company committed to investigating and addressing any gender pay gaps. Since then, Salesforce has continued to improve upon its processes and broaden the scope of assessment to include bonuses, promotions, and stock, as well as race and ethnicity in the United States, in addition to gender globally.
• Wellbeing:

  Wellbeing

  We bring mental health conversations into the workplace. ; For example, our CPO Brent Hyder hosted a virtual Mental Health Town Hall for our global employee base, featuring leaders from across the spectrum talking about mental health.; ; We recognize that health equity concerns are especially problematic in the context of mental health. We see how the problems facing humanity such as nutrition insecurity, housing insecurity, climate action, health equity, mental health, wellbeing, and workforce development all intersect.; These are complex problems and we have to work all together towards solutions that span more than one axis.; ; Pledge 1% is a global movement that inspires, educates, and empowers every entrepreneur, company, and employee to be a force for good. Over 10,000 members in 100 countries have used Pledge 1%’s flexible framework to ignite half a billion dollars in new philanthropy.; ; Pledge 1% founding partners include Salesforce, Atlassian, and Rally, three companies that know first-hand how pledging a small portion of future success today can have an enormous impact tomorrow. In 2014, they came together with the Entrepreneurs Foundation of Colorado to accelerate a shared vision of every business around the globe integrating philanthropy into its corporate DNA. In 2016, Pledge 1% became a special initiative of Tides, a leading global philanthropic partner and non-profit accelerator.; ; Salesforce.org powers the purpose of people dedicated to solving our world’s biggest problems. A global community of nonprofits and educational institutions relies on our technology to help them operate effectively, raise funds, and build more meaningful relationships with those they serve.; - $1.5 Billion in technology given for free; - $23 Million in Pro Bono value to the sector in FY21; - 87% customers have improved their ability to achieve their mission

Pricing

• Price: £25.42 a unit a month
• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Customers can sign-up and use Heroku for free - lightweight 'free' dynos are available and most add-on services offer a free-tier to support testing of the service and capabilities.
• Link to free trial: https://www.heroku.com/free

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@xma.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.