Heap
What Heap publishes, measured on their own site. Every result below links the page we found it on, or lists the addresses we checked.
- 50out of 100
- 10/10Criteria measured
- 2026-08-31Checked
Vendor site: heap.io · category: Web analytics
Data processing agreement
No data processing agreement found.
Checked 8 addresses on 2026-08-31.
Show the 8 addresses we checked
https://heap.io/legal/dpa– reached, no match (HTTP 404)https://heap.io/dpa– reached, no match (HTTP 404)https://heap.io/legal/data-processing-agreement– reached, no match (HTTP 404)https://heap.io/data-processing-agreement– reached, no match (HTTP 404)https://heap.io/legal/data-processing-addendum– reached, no match (HTTP 404)https://heap.io/legal/gdpr– reached, no match (HTTP 404)https://heap.io/trust/dpa– reached, no match (HTTP 404)https://heap.io/privacy/dpa– reached, no match (HTTP 404)
Subprocessor list
No subprocessor list found.
Checked 7 addresses on 2026-08-31.
Show the 7 addresses we checked
https://heap.io/legal/subprocessors– reached, no match (HTTP 404)https://heap.io/subprocessors– reached, no match (HTTP 404)https://heap.io/sub-processors– reached, no match (HTTP 200)https://heap.io/legal/sub-processors– reached, no match (HTTP 404)https://heap.io/trust/subprocessors– reached, no match (HTTP 404)https://heap.io/privacy/subprocessors– reached, no match (HTTP 404)https://heap.io/legal/subprocessor-list– reached, no match (HTTP 404)
Data location stated
The hosting location is stated on a public page.
Source: https://trust.contentsquare.com/?product=heapio · checked 2026-08-31
Status page with history
A public status page with incident history.
Source: https://status.heap.io/ · checked 2026-08-31
Public pricing
Actual numbers on a public page.
Source: https://www.heap.io/pricing · checked 2026-08-31
Certifications named
SOC 2 or ISO 27001 named on a public page.
Source: https://trust.contentsquare.com/?product=heapio · checked 2026-08-31
Uptime SLA with a figure
No uptime figure found.
Checked 6 addresses on 2026-08-31.
Show the 6 addresses we checked
https://heap.io/legal/sla– reached, no match (HTTP 404)https://heap.io/sla– reached, no match (HTTP 404)https://heap.io/legal/service-level-agreement– reached, no match (HTTP 404)https://heap.io/trust/sla– reached, no match (HTTP 404)https://heap.io/uptime– reached, no match (HTTP 404)https://heap.io/legal/uptime-sla– reached, no match (HTTP 404)
HTTPS enforced with HSTS
HTTP redirects to HTTPS and the HSTS header is set.
Source: https://heap.io/ · checked 2026-08-31
No third-party tracking before consent
No consent-free first load found.
Checked 1 address on 2026-08-31.
Show the 1 address we checked
https://heap.io/– third-party requests before any interaction: ad.doubleclick.net, assets.rampmetrics.com, cdn.cookielaw.org, cdn.jsdelivr.net, contentsquare.chilipiper.com, eu.api.fpjs.io, fpjscdn.net, geolocation.onetrust.com, images.ctfassets.net, marketo.clearbit.com, page.contentsquare.com, pubads.g.doubleclick.net, px.ads.linkedin.com, snap.licdn.com, tag.clearbitscripts.com, www.google.com, www.googletagmanager.com, x.clearbitjs.com
security.txt (RFC 9116)
No security.txt found.
Checked 1 address on 2026-08-31.
Show the 1 address we checked
https://heap.io/.well-known/security.txt– reached, no match (HTTP 404)