>This is the issue. Chances are Heroku has a very secure infrastructure, but the world will never know unless it allows various audits to be generated for compliance purposes.

Exactly. And, personally, I think this is rather odd. They could solve this in a heartbeat.

>Not true, see below:

Duly noted and thanks for the link, but here's the thing, though: what if you're not eligible for a self-assessment?