Heroku apps that handle callouts from Salesforce can be written in:

A client has an e-commerce application that stores credit card information. The application will run the production. Which security certification does the application need to meet?

Aclient has a data Ina SAP data store. The client uses Heroku External Objects to expose Heroku Postgres tablesin their Salesforce org. They want to perform custom transformations on the SAP data and then expose the transformed data in their Salesforce org. Which solution should an Architect recommend?

When creating a Private Space, what is a valid reason to specify a region other than the default region?

A client is planning to deploy an application to Heroku. The client's IT department requires all applications to be hosted from Australia, where their main office is located. Regulators in Australia require keystroke logs of all engineers who create interactive sessions for the application.
Which should an Architect recommend in this scenario?