Comment by xal

You cannot be PCI DSS compliant on Heroku unless you only use paypal express or google checkout for your payment backend. Be mindful of that before you commit to something like spree. I recommend Shopify instead :D