Heroku (Salesforce) DPA Acknowledgement

Status: PENDING OPERATOR ACTION Trigger: Before first EU customer Last updated: 2026-05-19 UTC Note: Heroku's DPA requires a support ticket, not a self-serve dashboard action. File the support ticket FIRST — processing time is 2–5 business days.

Vendor Details

How to Execute — Step by Step

Time estimate: 10 minutes to file the ticket; 2–5 business days for Heroku to return the DPA.

Step 1 — File the Heroku support ticket

1. Log in to the Heroku Dashboard at https://dashboard.heroku.com/
2. Navigate to Help → Submit a ticket (top-right help menu) - Or go directly to: https://help.heroku.com/
3. Create a new support ticket with the following content:

Subject: Data Processing Agreement Request — GDPR Art. 28 — MooseQuest LLC dba Raxx

Body:

Hello Heroku Support,

I am the account owner for the Raxx Heroku organization. I am writing to request
execution of a Salesforce/Heroku Data Processing Agreement (DPA) as required under
GDPR Article 28 for our EU customer data.

Please send me the current Salesforce/Heroku standard DPA for execution, or confirm
the process for signing. We understand that Salesforce includes 2021 EU Commission
Standard Contractual Clauses (Module 2, Controller-to-Processor) in the standard DPA.

Account email: [use the Heroku account email — kris@moosequest.net or the registered Heroku account]
Heroku organization/app prefix: raxx-api-* / raxx-console-* / raxx-velvet-*

Please respond with the DPA document or the execution instructions.

Thank you,
Kristerpher
MooseQuest LLC dba Raxx

Step 2 — Receive and review the DPA

Heroku (Salesforce) will respond with either: - A DPA document to sign (PDF), or - Instructions for accepting the DPA via the Salesforce legal portal

Review the DPA to confirm: - Module 2 Controller-to-Processor SCCs are included - UK Addendum is available (for UK data subjects) - Salesforce's sub-processor list is referenced (at https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Agreements/data-processing-addendum.pdf)

Step 3 — Sign and return

Follow Heroku's instructions to sign (may be DocuSign, Salesforce CPQ portal, or email reply with executed PDF).

Step 4 — Save and record

1. Save the fully countersigned PDF to Google Drive at: legal/DPAs/heroku-salesforce-dpa-<year>.pdf
2. Update this document (fields below) and the summary table in vendor-dpas-status.md.

Execution Record

Fill in this section after signing.

What This Covers

The Salesforce/Heroku DPA covers Heroku's role as infrastructure host for all Raxx application layers:

• Raptor (raxx-api-*): user account data, strategy configurations, audit logs, trading records
• Console (raxx-console-*): operator console data, flag states, deployment records
• Velvet (raxx-velvet-*): token rotation state, Postgres job data

All personal data processed by Raxx transits Heroku infrastructure. This is the broadest-scope DPA on the list.

Version History