Self-hosted Heroku alternative for HIPAA and PCI workloads

HHS enforces the HIPAA Security Rule through complaints, compliance reviews and audits by its Office for Civil Rights, so the evidence you produce should answer whether your risk analysis and risk management records are current and acted on. Assessors typically ask for the written risk analysis, the risk management plan, the access and audit log policies, and records showing how identified risks were addressed. HIPAA has no certification, so no document you hold is a HIPAA certificate. The penalty range is the reason to keep these records tidy: for penalties assessed on or after January 28, 2026, the inflation-adjusted civil money penalty runs from $145 to $2,190,294 per violation, with a calendar-year cap of $2,190,294, according to 45 CFR 102.3. Confirm the current figures with your counsel before relying on them in a board paper. DeployOpen can prepare the evidence for these controls in your environment, but it does not issue audit reports, attestations or certifications.

Assessors expect written policies for who may reach the platform, how that access is granted and removed, and how activity is logged and reviewed. For HIPAA, the technical safeguards in 45 CFR 164.312 cover unique user identification, emergency access procedures, automatic logoff and encryption, and audit controls sit alongside them. In a self-hosted Dokku, Coolify or Kubernetes environment, you should be able to show:

• Named accounts for every operator, with no shared root logins on servers or the platform dashboard.
• Role assignments and a dated review of who holds administrative rights.
• Centralized logs for SSH sessions, platform actions, proxy access and database access, retained for the period your policy sets.
• Evidence that Kubernetes Secrets are encrypted at rest and that RBAC limits who can list or watch them.

Confirm your own retention periods and log review cadence with your compliance lead, since the rule requires a policy but does not set those numbers for you.

Assessors ask for signed business associate agreements with every vendor that creates, receives, maintains or transmits ePHI for you. Under 45 CFR 164.314(a)(2)(i), the contract must require the business associate to comply with the Security Rule, flow the same terms down to subcontractors that handle ePHI, and report security incidents, including breaches of unsecured PHI. For a self-hosted stack, the list usually includes your cloud or data center provider, any managed backup service, and any implementation partner with access to production systems. Under the DORA regime that applies to EU financial entities, Article 30(2) also requires ICT contracts to state where services are provided and data processed, and to cover data return on termination. Keep these contracts in one register so you can show coverage quickly. Have legal counsel confirm which agreements your regulator expects.

A PCI DSS assessor starts by confirming the cardholder data environment (CDE), meaning every system that stores, processes or transmits cardholder data or sensitive authentication data, and every system that could affect its security. Your diagram should show the CDE boundary, the segmentation controls between it and the rest of the platform, the paths to the database, proxy and reverse proxy layers, and where Traefik, Caddy or nginx terminate TLS. Keep the scope document current whenever you add an app, a database or a server. PCI DSS v4.0.1 is the only active version, and the 51 future-dated v4.0 requirements became effective on March 31, 2025, so check the diagram against those. The assessment itself is documented either as a Report on Compliance by a Qualified Security Assessor or as a Self-Assessment Questionnaire, and each ends with an Attestation of Compliance. The payment brands decide who must validate, and the PCI SSC does not enforce compliance. DeployOpen prepares the scope and network evidence but does not issue the Attestation of Compliance.

Assessors and regulators want recent restore test results, not only a backup schedule. A restore test should name the system, the backup used, the restore target, who ran it, the time it took, and whether the restored data passed a check. On a self-hosted platform, the backup scope is yours: Coolify's guide for teams leaving managed platforms notes that a rollback can redeploy a retained application image but does not restore databases or persistent files. For Kubernetes, etcd needs its own backup plan, taken with etcdctl snapshot save and restored with etcdutl. Record each test, the failures found and the fix. Retain these records with the risk analysis, since they show whether the contingency plan works in practice. Confirm the recovery targets your policy and contracts require before you set the test cadence.

Findings most often trace back to missing or stale evidence rather than to a missing control. Common gaps include:

• A risk analysis that predates the migration and does not list the new server, proxy or cluster components.
• Shared administrator accounts or SSH keys with no owner.
• Secrets stored unencrypted in etcd, or RBAC that lets too many users read them.
• A PCI scope diagram that omits a database, a log collector or a jump host.
• Restore tests that were never run after the platform changed.

HIPAA also has a proposed Security Rule revision, published as 90 FR 898 on January 6, 2025. As of October 2026 no final rule has been published, and the Unified Agenda projects final action for July 2027, so track it with counsel. Keep a dated change log so you can show what changed and when.

DeployOpen prepares the systems, controls and evidence for a compliance assessment, including risk analysis inputs, access and logging configurations, network and scope diagrams, backup and restore test records, and change logs for the environment it builds in your own infrastructure. It does not issue audit reports, attestations or certifications. A Report on Compliance and an Attestation of Compliance come from a Qualified Security Assessor or from the assessed entity through a Self-Assessment Questionnaire, and HIPAA has no certificate at all. Most engagements are fixed-scope, with the evidence list, deliverables and timelines agreed in writing before work starts, so ask for that list in the quote. Your assessor will then decide what is sufficient.

The cost splits into platform labor, hosting, database operations, assessor fees and training. Platform labor covers designing the cluster or PaaS layer, hardening it, building logging and access controls, and documenting evidence. Hosting is the servers, load balancers, storage and backups you rent from your cloud provider or data center, and it recurs every month. Database operations cover backups, restore tests, patching and failover for each PostgreSQL or Redis instance. Assessor fees are paid to the independent Qualified Security Assessor, auditor or certification body, not to DeployOpen. Training covers your operations and on-call staff. Ask each vendor to price these lines separately so you can see which costs are one-time and which recur.

Scope size is the largest driver. The number of systems that store, process or transmit regulated data, and the number of in-scope environments such as production, staging and backups, sets the work. The number of data stores matters because each database, object store and cache needs its own backup, access and patching controls. Existing controls matter too: if your identity provider, logging, secrets handling and change management already meet the relevant requirements, the migration reuses them. If they do not, you pay to build them first. Your cloud or data center contract also shapes hosting cost. Confirm these inputs before requesting a quote.

Some teams can, if they already have engineers who run Kubernetes or Dokku in production, a documented control set, and a compliance lead who can map each control to evidence. Teams without those skills usually need outside help for architecture, hardening and evidence preparation. Whichever route you take, the operator carries the controls that Heroku Shield would otherwise cover, including backups, restores, patching and access reviews. Recurring work after go-live, such as upgrades and security testing, is often the part teams underestimate. Assess your staff against that list before deciding.

A fixed-scope quote should state the scope in writing before work starts. Ask for:

• The list of applications, databases and environments in scope, and which are excluded
• The deliverables, such as architecture, hardening baseline, backup and restore evidence, and runbooks
• Who performs each task and who keeps the accountable control owner role
• What is one-time and what recurs, including hosting, support and retainers
• Assumptions about existing controls and what happens if they are missing
• Timelines, change handling and acceptance criteria
• Whether an independent assessment is included or excluded

DeployOpen does not publish a price list, and a quote follows from the written scope.

No. HHS states that no Security Rule standard requires an entity to certify compliance, and private certifications do not prevent HHS from later finding a violation. HHS enforces the rule through complaints, compliance reviews and audits. Vendors sometimes advertise HIPAA certifications, so ask what they actually attest to and by whom. Assessments you may commission, such as HITRUST, are voluntary and carry their own fees and validity periods. Confirm your obligations with your privacy and legal teams and your business associate contracts.

Assessment cost depends on whether your organization completes a Report on Compliance with a Qualified Security Assessor or a Self-Assessment Questionnaire, each ending in an Attestation of Compliance. The PCI SSC does not set assessor fees, and the payment brands decide who must validate. Ask your acquirer which validation level applies to you and which version of the standard it expects. PCI DSS v4.0.1 is the only active version, so plan for it. Your assessor's fees are a separate line item from DeployOpen's preparation work.

No duration applies to every environment, so ask for one in the written scope. Timing depends on how many systems are in scope, how mature your existing controls are, how many data stores need migrating, and how long your assessor takes to review evidence. Plan for a period of parallel running and a cutover window for databases. Avoid committing to a date before you have an inventory of data flows and an agreed control set. Confirm the timeline with the implementation partner and your assessor in writing.