Customer Zero on Heroku

Salesforce · Customer Zero

Salesforce runs on Heroku.
Your team can too.

Teams across Salesforce ship internal apps on Heroku every day: demo builds, sales tooling, data apps, and AI agents. Customer Zero gives them a paved path with Okta SSO, private networking, and named ownership built in, so the secure path is also the fastest one.

Find your path See what teams build

Adoption dashboard

Governed Heroku is growing fast

Every new internal app now lives in a team-owned Fir private space. Here's how quickly those spaces have come online since the governed rollout began in July 2026.

New Fir private spaces by month

By business unit, July to October 2026

View as table

Spaces by region

Where governed internal workloads run

View as table

Use cases

What Salesforce teams build on Heroku

Workloads are usually small and need to ship fast. Heroku handles the runtime, scaling, and patching so teams can focus on the app itself.

Sales engineering demos & POCs

Regional Solution Engineering teams across AMER, EMEA, APAC, and LATAM build custom demos and proofs of concept that show customers Salesforce + Heroku in action.

se-* teams · 17 spaces

Sales strategy & ops tooling

COO and Sales Strategy teams run internal tools for planning, territory work, and programs across every major geography.

coo-* teams · 21 spaces

AI agents & MCP-built apps

Developers and citizen developers ship apps with Claude, Cursor, or Codex through the Heroku MCP server, then deploy them into a governed space without learning the platform first.

Agentic development

Data & analytics apps

Data teams build dashboards and data services on Heroku Postgres, with dataclips limited to the salesforce.com domain.

Postgres · dataclips

Platform & internal services

Heroku runs its own internal services on Heroku, including production, staging, and canary environments, all in Fir private spaces.

Dogfooding

Prototypes & quick wins

Small internal-only apps that need one dyno and a standard config: an intake form, a Slack helper, a team dashboard. Most new requests look like this.

Single-dyno apps

Secure by default

Security you don't have to configure

Customer Zero holds internal Heroku to Salesforce's own internal security standards, which are stricter than what external customers get. Developers inherit the controls. They don't have to set them up.

Teams are starting to use outside vendors for this kind of work. Those vendors sit completely outside Salesforce governance. Heroku is managed under the Salesforce umbrella, so Security can see and fix issues in a way it never can with an outside provider.

  • Okta SSO for every identityOne login. No shared passwords and no separate credentials.
  • SCIM provisioningHeroku access ends the same day badge access does.
  • Private spaces & trusted IPsApps are reachable only from trusted networks by default.
  • Encrypted traffic onlyUnencrypted port 80 traffic is dropped in Customer Zero spaces.
  • Domain-scoped dataclipsNo public dataclips on Salesforce databases.
  • Named ownershipEvery governed team has a named owner, which answers "who runs this?" and "who pays?"

Get a team

Three paths onto governed Heroku

Start by joining a team that already exists. Ask for your own team only when you need one. The shared Customer Zero space is the last resort, for the smallest internal apps.

A

Join an existing team

Find a Heroku team under your L3's Enterprise Account on the OrgH dashboard, then ask that team's admin to add you. This is the fastest path.

  • No new cost approval
  • Inherits the team's space and controls
  • If you're denied or get no reply in 3 days, go to Path B or C

B

Dedicated team

For full ownership, multiple apps or dynos, or non-standard integrations and networking. Your org owns the technical, financial, and security side.

  • Finance, Admin Owner, and BISO sign-off
  • Heroku leadership approval
  • Customer-facing apps start here or in A

C

Customer Zero shared space

Last resort for single-dyno, internal-only apps on a standard config. Runs in a Fir space with Security-approved fixed IPs, owned by Heroku Professional Services.

  • Only gate: a named owner + backup
  • 1 app, smallest Fir dyno
  • Apps idle for 120 days are removed (the owner is notified at 90)

Build with AI

Describe it, ship it

The Heroku MCP server connects your AI coding assistant straight to the platform. Ask it to list your apps, provision Postgres, read logs, or deploy. It runs everything through your governed team.

This site is proof. It was built and deployed into the heroku-internal Fir space entirely through the Heroku MCP server.

you › List all the apps in the heroku-internal team.

you › Build a dashboard that shows how Salesforce
      uses Heroku internally, then deploy it to
      the heroku-internal private space.

mcp › deploy_to_heroku  customer-zero-showcase
✓ Build succeeded · Fir · internal routing

Ready to build?

Tell us what you want to ship, and we'll route you to the right path.

Everyone#heroku-business-operations
SE / FDE builders#heroku-for-sales-enablement
Sales Strategy (COO)#heroku-for-global-one-coo-community