seancoleman

I'm working with a small, fast-growing SaaS startup running a Rails app on Heroku. Our dyno usage/spend is accelerating ($3k+ per month) plus we're looking at getting SOC 2 compliant this year, so we're evaluating a move to AWS (Elastic Beanstalk or ECS).

We don't have a dedicated DevOps or infrastructure person (small team of 4 engineers) so taking on the complexity and risk with lower-level AWS concerns me (especially considering our SaaS is mission critical for customers). The standard Heroku offering doesn't offer the security features necessary for SOC 2. AWS options would save a ton of $$ and allow us to hit all the security needs, but would require so much engineering bandwidth to set up and manage.

Heroku has their enterprise offering which meets our security needs. I'm curious what others' experience with Heroku Enterprise has been. Has it been worth the increased costs compared to cheaper infrastructure options? Would you do things differently? Have you switched from Heroku to AWS options — what has your experience been with that?

It seems like Heroku has been dying on a vine. The platform is still incredible and unmatched in Developer Experience, but recent security incidents (along with a severely prolonged resolution), downtime, and (just yesterday) a DNS-related issue is making me reconsider and quite possibly will move some mission-critical apps to AWS.

Are you migrating away from Heroku? If so, which cloud provider are you using (AWS, Google Cloud, Azure, etc)? What's your stack and what service are you migrating to (ECS, Elastic Beanstalk, etc)?

I'm consulting with a small, bootstrapped company, and a security researcher responsibly disclosed an extremely serious issue that leaked root database credentials. Based on the vulnerability, I doubt this researcher spent a ton of time discovering the exploit, but the value to the company is (obviously) tremendous.

I want to formally recommend a reward amount, but I know the company doesn't have much free cash. There is no bug bounty program in place. How do you go about thinking through pricing, especially for a non-BigCo? Thanks!