Heroku Private Spaces Pricing in 2026: The Real Monthly Cost, Line by Line

Key takeaways

• Prices checked September 2026. Heroku Private Spaces do not have a separate flat "space fee" line on the public pricing page today. The cost of the space is folded into the Private dyno price, which starts at $125/month for a Private-S. So the real monthly floor is set by the smallest Private dyno plus a verified account tier, not by a standalone four-figure SKU.
• Private Spaces are sold to verified Heroku Teams and Heroku Enterprise, not on the free or basic self-serve tier. The largest deals and every Shield space are quoted by Heroku sales, so the 2026 budget question is the contract total: Private dynos + private data add-ons, multiplied by spaces, regions, and environments.
• Cost multiplies per environment and per region, because one Private Space is one runtime in one of 10 regions. Prod + staging + a compliance region means three sets of Private dynos and three private databases, not one. That multiplication, not dyno size, is where most Private Spaces budgets break.
• Shield Private Spaces carry a flat 20% premium on every dyno rate (Shield-M is $300 vs Private-M at $250) in exchange for HIPAA/PCI-oriented controls, encrypted dyno storage, and stricter logging. Budget Shield as its own line, not a checkbox on an existing space.
• Heroku's Fir generation reached general availability and runs Private Spaces on Kubernetes (Amazon EKS) with Cloud Native Buildpacks and native OpenTelemetry, so a 2026 quote depends on which generation you provision. Ask for pricing per generation, Cedar vs Fir, not just per plan.
• If you buy Private Spaces for VPC isolation, peering, stable outbound IPs, and compliance rather than for Heroku's developer experience, an internal developer platform such as Qovery running in your own AWS, GCP, Azure, Scaleway, or existing Kubernetes account gives you the same isolation primitives while the cloud bill and any Savings Plans or CUDs stay in your name.

What does Heroku Private Spaces cost per month in 2026?

Heroku Private Spaces cost the per-dyno price of the Private or Shield dynos you run inside them, starting at $125/month for a single Private-S, plus the price of any private-tier add-ons, and they are only available to verified Heroku Teams and Heroku Enterprise. Prices checked September 2026 against heroku.com/pricing.

Here is the part that surprises people who last priced this a few years ago: Heroku's public pricing page no longer lists a standalone flat "space fee" separate from the dynos. The cost of the isolated runtime is carried inside the Private dyno price. So the honest monthly floor is one Private-S at $125 on a verified account, and the realistic floor for anything production-shaped is several Private dynos plus a private database, which lands in four figures fast. Where a number is quote-only, I say so and link the page rather than inventing a figure.

The Private dyno tiers, line by line (Heroku dyno types): Private-S at $125/month (1 GB RAM), Private-M at $250 (2.5 GB), Private-L at $500 (14 GB), Private-L-RAM at $500 (30 GB), Private-XL at $750 (62 GB), and Private-2XL at $1,500 (126 GB). Every Private and Shield dyno runs at a 100% dedicated CPU share, which is the whole point of the tier.

The Shield premium is easy to remember because it is uniform: Shield dynos cost exactly 20% more than their Private equivalents at every size. Shield-S is $150 (vs $125), Shield-M is $300 (vs $250), Shield-L is $600 (vs $500), Shield-XL is $900 (vs $750), and Shield-2XL is $1,800 (vs $1,500).

Billing mechanics in plain language. Private and Shield dynos bill on usage, prorated to the second, at the monthly rate divided across the hours in the month. A dyno you run for half a month costs roughly half its monthly figure; a dyno deleted the same day costs a few dollars. The dedicated compute is what you pay for, so an idle app still bills for every second its dynos exist.

What the dyno price does NOT include, and this is where invoices balloon: Heroku Postgres, Key-Value Store, and Apache Kafka in their Private and Shield tiers, data transfer, Heroku Connect, and any third-party add-ons from Elements. Private-tier data services start well above their Common Runtime cousins: private Heroku Postgres starts at Private-0 for $300/month, the private Key-Value Store starts at Private-3 for $150/month, and private Apache Kafka starts at private-standard-0 for $1,800/month. For contrast, Common Runtime Postgres starts at $5/month for Essential-0 on the same page.

And to be explicit about availability, since it shapes the whole conversation: Private Spaces are available only for verified Heroku Teams and Heroku Enterprise. There is no free-tier path into a Private Space, and Shield spaces plus larger commitments are negotiated through Heroku sales. Published list prices are the ceiling for that negotiation, not a coupon.

Prices verified as of September 2026. Shield space and Enterprise totals are sales-quoted; list prices are the ceiling.

What is the real monthly bill for a typical Private Spaces setup?

A single production Private Space with four Private-M dynos and one Private Postgres lands at $1,300/month ($15,600/year), and because isolation is almost never needed in only one environment, the realistic entry point for most teams is two or three of these stacks. Here are three worked scenarios, each liftable on its own.

Scenario 1 - one production space, small app. 1 production space = 4 x Private-M ($250) + 1 x Private Postgres Private-0 ($300) = $1,300/month, $15,600/year.

Scenario 2 - prod + staging. Prod (4 x Private-M) + staging (2 x Private-M) + 2 x Private Postgres = 6 x Private-M ($250) + 2 x Private Postgres ($300) = $2,100/month, $25,200/year.

Scenario 3 - prod + staging + a Shield space for regulated data. 6 x Private-M ($250) + 4 x Shield-M ($300) + 3 private-tier databases (from $300 each) = from $3,600/month, from $43,200/year, before Shield's higher data-tier and any Kafka premium.

The per-dyno-hour math matters if your workload is spiky or autoscaled. Heroku bills the monthly rate spread across the roughly 730 hours in a month, so a Private-M at $250/month works out to about $0.34 per dyno-hour. Run that dyno for only 200 hours in the month and it costs about $68, not $250. Scale to ten dynos for a load test and you can read the cost straight off the hourly rate.

The multipliers teams forget are the expensive ones. One Private Space is one runtime pinned to one of 10 regions, so prod, staging, and a second region for data residency are three separate spaces with three separate dyno bills and three separate private databases. Review apps behave differently inside Private Spaces than in the Common Runtime, and each environment you isolate is billed as its own space. The line that breaks budgets is not "which dyno size," it is "how many spaces."

Before you sign, sanity-check consolidation against Heroku's documented per-space limits. A Cedar space allows up to 25 apps and 100 dynos; a Fir space allows up to 200 apps and 500 dynos, with increases available by support ticket. Those ceilings decide how many apps you can pack into one space fee before you are forced to open a second.

One transparency note. Heroku Enterprise contracts are negotiated, so list price is the ceiling rather than what every team pays. What does not change with a discount is the shape of the bill: dedicated dynos first, private data services second, multiplied by every isolated environment you run.

Every cell traces to the price sheet above. Prices verified September 2026; Shield data tiers and Kafka list higher and are sales-quoted.

How much more does a Shield Private Space cost, and when do you actually need one?

A Shield Private Space costs 20% more per dyno than a standard Private Space (Shield-M at $300 vs Private-M at $250, per Heroku dyno types), and you only need it when regulated data (HIPAA PHI, PCI cardholder data) sits in the runtime and requires Heroku's documented Shield controls, not merely because you want a private network. The 20% delta holds at every dyno size, and Shield data add-ons list higher than their private equivalents too.

What the premium buys, from Heroku's compliance docs: encrypted ephemeral dyno storage, restricted logging and audit behaviour, Shield-tier add-ons, and Heroku's stated HIPAA and PCI DSS posture with a Business Associate Addendum available through sales. Salesforce signs the BAA; the attestations live with the platform.

What the premium does not buy is your own compliance. Shield does not make your application HIPAA or PCI compliant. Your code, access control, data handling, and audit evidence are still yours to produce and defend. Shield gets you a compliant substrate, not a compliant product.

Here is the decision rule you can apply in one line. PHI or cardholder data in the runtime, you need Shield. Internal network isolation and stable egress IPs only, a standard Private Space is enough. Neither of those, the Common Runtime with Performance dynos does the same job at a fraction of the cost, since Performance-M is $250 and Performance-L is $500 with no space premium at all.

The mixed-estate pattern is where teams claw money back. Keep regulated workloads in a Shield space and move everything else to a standard space or the Common Runtime. Take staging from Scenario 2: two Private-M dynos plus a Private Postgres is $800/month, but the same staging environment on Common Runtime Standard-2X dynos ($50 each) with a Standard Postgres ($50) is about $150/month. That single move saves roughly $650/month, $7,800/year, on one non-production environment.

Prices verified September 2026 from heroku.com/pricing and dyno types.

Does Heroku Fir change Private Spaces pricing compared to Cedar?

Fir reached general availability and is currently available only as a Private Space, runs on Kubernetes (Amazon EKS) with OCI images built by Cloud Native Buildpacks, and is provisioned as its own space type, so what you pay in 2026 depends on which generation you provision. Ask your Heroku rep for a quote per generation, because the public dyno price list is written for Cedar.

The factual Fir vs Cedar summary, from Heroku's generations doc: Fir is Kubernetes-based on Amazon EKS with a choice of Intel/AMD and Graviton architectures, Private Spaces only for now (Common Runtime on Fir is listed as "to be added"), builds exclusively with Cloud Native Buildpacks producing OCI containers, and ships native OpenTelemetry for traces, metrics, and logs with drains at the app and space level. Cedar is the older generation and still runs the Private and Shield dyno tiers priced above.

On which prices apply to which generation, I will not guess. The dyno types page lists Private and Shield tiers under the Cedar generation, and the generations doc describes Fir's architecture choices (AMD/x86 and Graviton/ARM) without publishing a separate Fir dyno price list. If Heroku has not posted a Fir-specific figure for your region and size, that is a question for your rep, not a number to assume.

The practical consequence is that moving Cedar to Fir is a platform migration, not a billing toggle. Buildpack changes to Cloud Native Buildpacks, add-on compatibility, logging and telemetry moving to OpenTelemetry, and the networking differences below all cost engineering time. Note one of those networking differences directly: VPC peering and internal routing are Cedar features, while stable outbound IPs and trusted IP ranges are the Fir networking primitives. Budget the migration work, not just the runtime.

On Cedar's future, I will quote the doc rather than invent a deadline. Heroku states: "While Cedar remains a reliable choice, Heroku recommends [migrating to Fir] for new applications and actively developed projects" (generations). There is no published end-of-life date for Cedar as of September 2026, and I am not going to imply one.

The budgeting consequence worth saying out loud: once Fir is in play, Kubernetes is underneath either way. So the honest 2026 comparison is managed Kubernetes billed by Salesforce versus managed Kubernetes running in your own cloud account, which is exactly the choice the last two sections are about.

Facts and limits from generations and private space limits, checked September 2026.

Why do teams buy Private Spaces, and can you get the same isolation cheaper?

Teams buy Private Spaces for four concrete primitives - a dedicated runtime in a private network, private-tier data add-ons, VPC peering with stable outbound IPs, and Shield's compliance posture - and every one of those exists natively on AWS, GCP, Azure, and Scaleway at raw infrastructure cost. What the dyno premium actually buys is the operations layered on top, and that labor is real.

The Private Spaces feature set, from Heroku's docs: a dedicated single-tenant runtime, a private network, trusted IP ranges, VPC peering to a cloud VPC you control (Cedar), stable outbound IPs, internal routing (Cedar), and Shield for regulated workloads. Map each to its native cloud equivalent and the picture gets concrete. A private network is a VPC with private subnets (free to create). Stable egress is a NAT gateway. Peering is VPC peering or PrivateLink. A managed encrypted database is Amazon RDS or Cloud SQL. Audit is IAM plus your own log trail.

Now anchor the bring-your-own-cloud baseline honestly, because self-hosting is not free. The Amazon EKS control plane is $0.10 per cluster-hour, about $73/month (GKE and AKS are comparable, and Scaleway Kapsule's control plane is free on its managed offering). A NAT gateway is $0.045/hour plus $0.045 per GB processed, roughly $33/month before traffic. Internet egress is $0.09 per GB. A managed RDS db.m7g.large for PostgreSQL is $0.168/hour, about $123/month single-AZ, plus storage. Add those up and a real isolated stack in your own account is a few hundred dollars of infrastructure before anyone deploys.

Be fair about what the Heroku premium covers, because pretending it is pure margin is how these comparisons lose credibility. Heroku absorbs platform upgrades, on-call, buildpack maintenance, add-on operation, and security patching. That is a platform team's worth of work you do not staff. A DevOps engineer's median total compensation is around $150,000 on Levels.fyi, and the Stack Overflow 2025 Developer Survey puts US cloud infrastructure engineers near $189,000. That is the bill Heroku is quietly paying on your behalf.

So the real choice is three-way: keep paying the platform premium, hire a platform team and build the layer yourself, or run an internal developer platform on your own cloud account. That third path is where Qovery fits. It deploys and operates your apps inside your own AWS, GCP, Azure, Scaleway, or existing Kubernetes cluster, so the isolation boundary and the compliance boundary stay yours, and the cloud invoice stays in your name with your Savings Plans or committed-use discounts intact. To be precise about compliance: Qovery does not hold HIPAA or PCI certification on your behalf. Your cloud account, your VPC, your keys, and your audit controls define the boundary, and Qovery runs the workflow on top.

How does Heroku Private Spaces pricing compare to the alternatives in 2026?

On a like-for-like isolated-runtime workload, Heroku Private Spaces sit at the top of the 2026 price range because you pay dedicated Private dyno rates before you optimize anything; compliance-first PaaS like Aptible sits in the middle with a base fee plus usage; and bring-your-own-cloud platforms like Qovery put you at raw cloud cost plus a platform fee, with cloud discounts still applying to your own account. Prices checked September 2026 on each vendor's page.

Say plainly who wins where, because none of these is a bad product. Heroku wins on zero-ops maturity and the deepest add-on ecosystem. Aptible wins on turnkey compliance workflows and BAAs, with a production plan from $499/month plus usage and HIPAA controls applied automatically. Render and Northflank win on price-to-DX for non-regulated teams, with Render's Pro workspace at $25/month and Northflank charging pure consumption with no seat fee. Fly.io wins on edge and regional latency, with shared machines from a few dollars a month. Qovery wins on cost control and cloud portability, keeping Savings Plans and CUDs on your own bill.

The pricing-model insight that matters most is how each curve behaves as you add the third, fourth, and fifth environment. Flat dedicated-dyno pricing (Heroku) multiplies per space. Pay-for-what-you-run (Aptible, Render, Fly.io, Northflank) scales with usage but stays on the vendor's cloud account. Cloud-cost-plus-platform-fee (Qovery, Northflank BYOC) adds environments at your discounted cloud rate, so the platform fee amortizes as you grow rather than multiplying.

Every figure verifiable on the linked vendor page, checked September 2026.

When is Private Spaces worth the money, and when should you move off it?

Private Spaces is worth it while the annual Private dyno and data spend stays below the fully loaded cost of the platform engineer you would otherwise hire, and it stops adding up once you need three or more spaces, multiple regions, or workloads Heroku does not run, such as GPUs and heavy data tooling. The trigger is rarely the raw dyno delta; it is one capability the platform boundary cannot hand you.

Stay signals, as a scannable list:

• One or two environments, and no platform engineer on staff.
• A near-term compliance deadline that Shield with a Salesforce BAA already satisfies.
• Deep dependency on Heroku add-ons and Heroku Connect.
• Predictable, steady load in a single region.

Move signals:

• Three or more spaces, or annual Heroku spend approaching a senior platform hire.
• GPU or ML workloads, or data tooling Heroku does not run.
• Multi-cloud or data-residency requirements beyond the 10 Private Space regions.
• Savings Plans, Reserved Instances, or committed-use discounts you want applied to your own bill.

Here is a break-even you can apply directly. Stay on Heroku while your annual Private dyno plus private data spend is less than the discounted cloud cost of the same workload plus a platform fee plus the fraction of an engineer you would need to run it. Worked: Scenario 2 at $25,200/year on Heroku, versus the same two environments on your own cloud at maybe $700-900/month of infrastructure (about $9,000-11,000/year), plus a platform subscription, plus a slice of one engineer. Once your Heroku total clears the cost of that whole self-run stack, the account boundary is costing you money, not saving it.

Be honest about what a migration involves, because that is where timelines slip. You containerize services (or reuse Fir's CNB-built OCI images), move Heroku Postgres to managed cloud Postgres, replace add-ons with cloud equivalents, reproduce review apps as preview environments, re-point DNS, and re-run your compliance evidence in the new account. None of those is hard alone; together they are a quarter, not a weekend.

Where Qovery fits, using verified capabilities only: git-push deployments, a preview or ephemeral environment per pull request, environment auto-stop for non-production, managed cluster upgrades, per-environment RBAC, and databases backed by your cloud's own managed services - on AWS, GCP, Azure, Scaleway, or your own Kubernetes cluster. The workflow feels like Heroku; the account is yours.

And be straight about Qovery's cost. It is not free. A platform fee sits on top of your cloud bill (see qovery.com/pricing, which lists a free trial and paid plans billed by users and clusters). The savings do not come from magic; they come from cloud committed-use discounts, non-production auto-stop, and right-sizing that a fixed dyno price cannot reach.

How do you cut a Heroku Private Spaces bill without leaving Heroku?

You cannot scale a fixed dyno rate down, so the real savings inside Heroku come from removing whole spaces, right-sizing Private dynos, moving non-production out of Private Spaces, and auditing private-tier add-ons. Expect these levers to trim a meaningful slice of the bill, not to change its order of magnitude.

The biggest single lever is moving staging and review apps to the Common Runtime wherever your compliance scope allows. That removes an entire environment's worth of dedicated dynos and its private database, not a percentage of one. From Scenario 2, shifting staging off a Private Space saves roughly $650/month, $7,800/year, on that one environment, using the numbers from the Shield section above.

The other levers, in order of impact:

• Consolidate spaces. Pack more apps into fewer spaces within the documented per-space limits (25 apps / 100 dynos on Cedar, 200 / 500 on Fir) so you are not paying for dedicated dynos across half-empty spaces.
• Right-size and schedule dynos. Drop over-provisioned Private-L dynos to Private-M, use autoscaling where Heroku supports it, and shut non-production dynos down overnight and at weekends. Because Private dynos bill per second at about the monthly rate over 730 hours, cutting a Private-M from 24x7 to a 50-hour work week takes it from $250 to roughly $17 for that dyno.
• Audit private-tier add-ons. Private and Shield Postgres, Key-Value Store, and Kafka are the quietest cost driver on an Enterprise invoice; a single private Kafka at $1,800/month can outweigh your dynos.
• Renegotiate at renewal with real usage data in hand, and ask for pricing per generation if Fir is on your roadmap.

The honest caveat: because dedicated dyno pricing is structural, these levers trim a modest percentage. Non-production scheduling matters because non-prod runs idle most of the week, and Flexera's 2026 State of the Cloud report still puts wasted cloud spend near 29%. If you need to change the order of magnitude rather than shave it, you are changing platforms, not settings.

How much does a Heroku Private Space cost per month in 2026?

Heroku's public pricing page does not list a standalone Private Space fee in 2026; the cost is carried in the Private dyno price, which starts at $125/month for a Private-S (1 GB). A realistic production space with four Private-M dynos ($250 each) and one Private Postgres (from $300) lands at about $1,300/month. Private Spaces require a verified Heroku Team or Heroku Enterprise, so there is no free-tier path in.

Is Heroku Private Spaces included in Heroku Enterprise, or is it billed separately?

Private Spaces are available to verified Heroku Teams and Heroku Enterprise, and you are billed for the Private or Shield dynos and private add-ons you run inside them. Enterprise agreements are negotiated with Heroku sales, and Shield spaces in particular are quote-based. The published list prices are the ceiling for that negotiation, not an all-in bundled figure.

What is the difference between Private Spaces and Shield Private Spaces pricing?

A Shield Private Space costs exactly 20% more per dyno than a standard Private Space at every size: Shield-M is $300 versus Private-M at $250, and Shield-2XL is $1,800 versus $1,500. The premium buys encrypted ephemeral dyno storage, restricted logging, and Heroku's HIPAA/PCI posture with a BAA via sales. You only need Shield when regulated data actually sits in the runtime.

Do I need a separate Private Space for every environment and every region?

Yes. One Private Space is one runtime in one of 10 regions, so prod, staging, and a second region for data residency are three separate spaces, each with its own dedicated dynos and its own private database. That per-environment and per-region multiplication, not dyno size, is what drives most Private Spaces budgets. Packing more apps into fewer spaces within the per-space limits is the main way to contain it.

Does Heroku Fir change Private Spaces pricing compared to Cedar?

Fir is generally available, Private Spaces only for now, and runs on Kubernetes (Amazon EKS) with Cloud Native Buildpacks and native OpenTelemetry. The public dyno price list is written for Cedar, and Heroku does not publish a separate Fir dyno price sheet, so ask your rep for a quote per generation. Cedar has no published end-of-life date as of September 2026; Heroku only recommends Fir for new and actively developed apps.

What are the cheapest alternatives to Heroku Private Spaces that still provide VPC isolation and compliance support?

For turnkey compliance, Aptible offers dedicated stacks and signs a BAA from $499/month plus usage. For your own cloud account with full discount eligibility, bring-your-own-cloud platforms like Qovery and Northflank run isolated workloads in your own VPC on AWS, GCP, Azure, Scaleway, or existing Kubernetes, so Savings Plans and committed-use discounts stay on your bill. For non-regulated teams that just want cheaper DX, Render and Fly.io start at a few dollars per service.

I have watched a lot of teams price this exact decision. Private Spaces is a legitimate product, and for one or two environments in a single region the dedicated dyno bill genuinely can cost less than the engineer you would hire to replace it. The moment you are running your third space, spreading across regions, or watching cloud discounts you cannot touch, the account boundary stops being a detail and becomes the decision. That is the line to watch, and it is worth re-checking every renewal.