Heap review
by Heap (part of Contentsquare)Product analytics
Autocapture product analytics with SAML SSO on every plan, including Free, and ISO 27001; priced by sessions, with no published prices.
- Free plan
- Self-serve
- Usage-based
- Prices hidden
What you're paying for
- Saves engineering time (main value)
- Compliance included
Events captured automatically from one snippet, with SAML SSO on every plan, including Free, and four ISO certifications.
Heap records clicks, pageviews and form activity from a single snippet without tagging each event in code, so analysis can start on events nobody planned to track. SAML SSO is on every plan, including Free, and Heap lists SOC 2 Type 2, ISO 27001, 27701, 27017 and 27018 and an EU data center. What it costs is not on the page: Heap bills by sessions, Growth shows an estimate only after you install the snippet, and Pro and Premier are priced by sales.
- Autocapture from one snippetA single snippet captures client-side web and mobile events, which can be enriched with custom properties and server-side events through the APIs.Evidence: Infrastructure page and web install docs (2026-10-15)
- SAML SSO on every planThe pricing page lists SSO on Free, and the security page says all customers have access to it; the SAML guide covers Okta, OneLogin, Azure, Google and AWS.Evidence: Pricing page, security page and SAML guide (2026-10-15)
- Four ISO certifications and an EU data centerThe security page lists ISO 27001, 27701, 27017 and 27018 certification; the docs describe an EU data center, and Premier lists region-specific storage.Evidence: Security page, help center and pricing page (2026-10-15)
- Best for
- Teams that want analytics without a tagging project and need SSO from the start, and are ready to get a quote.
- Good to know
- No price is published: Growth shows an estimate after install, and Pro and Premier are priced by sales.
How Heap compares
Against 3 other products we reviewed in Product analytics: what you pay for with each, the five access facts, the plan limits we recorded and each review's bottom line. The note under the table says how each one was checked.
| Metric | Heap | PostHog | Mixpanel | Amplitude |
|---|---|---|---|---|
| What you're paying for | Saves engineering timeEvents captured automatically from one snippet, with SAML SSO on every plan, including Free, and four ISO certifications. | Saves engineering timePer-event rates published for every volume, 7 years of data on paid usage, priced warehouse exports and a HIPAA BAA without a sales contract. | Compliance includedSAML SSO and SCIM on the self-serve Growth plan, two years of data on every plan, and its own SOC 2 Type II and ISO 27001. | Worth the priceThe largest free tier here at 2 million events a month, and the lowest listed price at 10 million: $720 a month, or $576 billed annually. |
| Overall score | 3.7 | 7.8Best | 7.1 | 6.3 |
| Free option | Free plan | Free plan | Free plan | Free plan |
| Card to start | –Not measured | No card needed | No card needed | No card needed |
| Getting access | Self-serve | Self-serve | Self-serve | Self-serve |
| Starter priceCheapest paid plan | –Not measured | $0 | $0 | $0 |
| Pricing model | Usage-based | Usage-based | Tiered | Tiered |
| Pricing page | Prices hidden | Public prices | Public prices | Public prices |
| Free plan | 10,000 sessions/mo; free events not stated | 1M events/mo, unlimited team members | 1M events/mo, unlimited seats | 2M events/mo, unlimited seats |
| Price for 10M events/mo | Not published; billed by sessions | $1,080 identified, $324.40 anonymous (computed) | $1,176 monthly, $840 billed annually (Growth) | $720 monthly, $576 billed annually (Plus) |
| Self-serve prices up to | No price published | No ceiling; rates listed past 250M events | 20M events/mo | 70M events/mo |
| Data retention | 6 months (Free), 12 months (Growth) | 1 year (Free), 7 years (paid) | 2 years on every plan | 1 year (Free), 2 years (Plus) |
| SOC 2 / ISO 27001 | SOC 2 Type 1 and 2; ISO 27001, 27701, 27017, 27018 | SOC 2 Type II; ISO 27001 not listed | SOC 2 Type II, ISO 27001 and ISO 27701 | SOC 2 Type II and ISO 27001 |
| EU data storage | EU data center; region-specific storage on Premier | EU cloud in Frankfurt | Every plan, chosen at project creation | Frankfurt data center, every plan |
| HIPAA BAA | Offered (2023 blog post); plan not stated | Boost package, $250/mo | Enterprise plan | Offered; plan not stated |
| SAML SSO | Every plan, including Free | Scale package, $750/mo | Growth plan (self-serve) | Growth plan (custom price) |
| Warehouse export | Heap Connect: Pro add-on, included in Premier | Batch exports; 1M rows/mo free, then per row | Data Pipelines add-on, fee not listed | S3, Snowflake and others documented; plan not stated |
| Self-hosting | Not listed | Open source (MIT), unsupported | Not listed | Not listed |
| Bottom line | From its public pages, Heap pairs autocapture with SSO on every plan and four ISO certifications. It publishes no prices and bills by sessions, so expect to install the snippet or talk to sales before you know the cost. | From its public pages, PostHog is the most transparent on price and the most open with your data, with a self-serve HIPAA BAA. Identified events carry a second rate, so estimate your mix of identified and anonymous events before comparing bills. | From its public pages, Mixpanel has the most complete self-serve access controls of the three and the clearest written price table. It has the highest listed price at 10 million events, so compare annual billing before you decide. | From its public pages, Amplitude has the largest free tier and the lowest listed price at 10 million events. SSO, longer history and scheduled syncs sit on the custom-priced Growth plan, so check those against your needs first. |
Evidence: Heap: facts checked 2026-10-15 from its public sign-up and pricing pages, no completed hands-on run; PostHog: facts checked 2026-10-15 from its public sign-up and pricing pages, no completed hands-on run; Mixpanel: facts checked 2026-10-15 from its public sign-up and pricing pages, no completed hands-on run; Amplitude: facts checked 2026-10-15 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
Score
- Pricing clarity
- 6.0 / 10, Good
- no self-serve price published; a mid-tier plan priced by sales
- Free tier
- 0.0 / 10, Fair
- free plan metered in another unit (10,000 sessions a month); free events not stated
- Price at 10M events
- 0.0 / 10, Fair
- no published price for 10M events: billed by sessions; Growth is estimated after sign-up, Pro and Premier are priced by sales
- Data retention
- 2.3 / 10, Fair
- 0.5 years on the free plan, 1 year on the entry paid plan
- Compliance and data residency
- 9.0 / 10, Excellent
- own SOC 2 Type II, ISO 27001, EU data storage, HIPAA BAA offered, plan not stated
- Data control
- 5.0 / 10, Fair
- warehouse export as a paid add-on; SAML SSO on a self-serve plan
Review
Review from public pages
Written from Heap's public pages (pricing, security or privacy, and docs) as read on Oct 15, 2026. We did not sign up, and no hands-on run is published yet.
What the public pages show
We read Heap's pricing, security and infrastructure pages, its help center and developer docs on Oct 15, 2026; we did not sign up for this review. The site states that Heap is part of the Contentsquare group, and its paid plans list Contentsquare's Sense AI assistant. There are four plans, all metered by sessions rather than events: Free covers up to 10,000 sessions a month, and a session ends after 30 minutes of inactivity on web or 5 minutes on mobile.
The pricing page publishes no price. Growth says to sign up and install the free snippet to get an estimate, and Pro and Premier say "Custom Session Pricing" with a contact form. Because Heap does not bill by events, we could not place its free plan or its price on the same scale as the other products here.
The security page lists ISO 27001, 27701, 27017 and 27018 certification, a Heap comparison page states SOC 2 Type 1 and Type 2 compliance, and the help center points to the SOC 2 report in Contentsquare's trust portal, which did not load for us. A Heap blog post from Oct 3, 2023 says Heap signs BAAs; none of the pages we read says which plan that needs. Above the plan limit, the FAQ says data is not dropped, but you must upgrade before you can view it again.
Strengths
- SSO on the free plan
SSO is listed on Free, and the security page says all customers have access to it.
vs Amplitude: Mixpanel lists SAML from its self-serve Growth plan; Amplitude from its custom-priced Growth plan.
- Autocapture
Events are captured from one snippet without defining each event in code first, so analysis can start on events nobody planned to track.
- Four ISO certifications
ISO 27001, 27701, 27017 and 27018 are listed on the security page.
vs Amplitude: PostHog does not list ISO 27001; Amplitude and Mixpanel do.
- Data kept when you go over
Above the plan limit, the FAQ says Heap does not drop or throttle data; viewing it requires an upgrade.
Things to know
- No published prices
Growth is estimated after you install the snippet, and Pro and Premier are priced by sales.
Workaround: Amplitude, Mixpanel and PostHog publish self-serve prices.
- Priced by sessions, not events
Free covers 10,000 sessions a month; the pages do not say how many events that is, so it cannot be compared directly with event-based plans.
- Shorter in-app history
Free shows 6 months of data and Growth 12; up to 36 months is an add-on on Pro and Premier.
- Warehouse export on higher plans
Heap Connect is an add-on on Pro and included in Premier, both priced by sales.
Pricing reality
Heap bills by sessions. Free includes up to 10,000 a month, with 6 months of data history. Growth adds unlimited users and reports, CSV exports and 12 months of history; its price appears as an estimate after you sign up and install the snippet. Pro and Premier have custom session pricing.
Session replay, heatmaps and error analysis are add-ons on Pro and Premier, as are Heap Connect on Pro and extended data history (up to 3 years). None of these add-ons has a published price, so we could not compute a figure for 10 million events.
Exit path
Heap Connect syncs raw event data to Snowflake, BigQuery, Redshift or S3, including history from the day Heap was installed; it is an add-on on Pro and included in Premier. Growth includes CSV exports. The docs say data older than 37 months, or the plan’s data history if longer, is deleted.
Compared with
- Pick Heap when
- You want SAML SSO without a sales-priced plan, or events captured without tagging.
- Pick Amplitude when
- You want published prices: Amplitude lists 10 million events for $720 a month and 2 million free events.
- Pick Heap when
- You want SSO on the free plan and autocapture from one snippet.
- Pick Mixpanel when
- You want every self-serve price in writing and two years of data on every plan.
- Pick Heap when
- You want SAML SSO on the free plan and ISO 27001.
- Pick Pendo when
- You want in-app guides with analytics, or 7 years of data on paid plans.
Choose it if
- You want events captured without a tagging project.
- You need SAML SSO from the free plan up.
- Your security review asks for ISO 27001, 27701, 27017 or 27018.
Look elsewhere if
- You want to see prices before you install anything.
- You need more than 12 months of history without a sales-priced plan.
Bottom line
From its public pages, Heap pairs autocapture with SSO on every plan and four ISO certifications. It publishes no prices and bills by sessions, so expect to install the snippet or talk to sales before you know the cost.
Plan limits at a glance
| Limit | As recorded |
|---|---|
| Free plan | 10,000 sessions/mo; free events not stated |
| Price for 10M events/mo | Not published; billed by sessions |
| Self-serve prices up to | No price published |
| Data retention | 6 months (Free), 12 months (Growth) |
| SOC 2 / ISO 27001 | SOC 2 Type 1 and 2; ISO 27001, 27701, 27017, 27018 |
| EU data storage | EU data center; region-specific storage on Premier |
| HIPAA BAA | Offered (2023 blog post); plan not stated |
| SAML SSO | Every plan, including Free |
| Warehouse export | Heap Connect: Pro add-on, included in Premier |
| Self-hosting | Not listed |
Read from the vendor's public pages on Oct 15, 2026. No hands-on run is published yet. How we check
We have not published a sign-up run for Heap yet. The access facts above were read from its sign-up and pricing pages on Oct 15, 2026.
We have not published API calls for Heap yet.
Heap lists 4 plans.
- HeapFreeFree$0/moUp to 10,000 sessions/mo
- Core analytics charts
- SSO
- 6 months of data history
- Unlimited enrichment sources
- HeapGrowthNot publishedPriced by sessions; estimate shown after you sign up and install the snippet
- Unlimited users and reports
- CSV exports
- 12 months of data history
- Email support
- HeapProCustomCustom session pricing
- Account analytics
- Report alerts
- Heap Connect and session replay as add-ons
- 2 environments
- HeapPremierCustomCustom session pricing
- Data warehouse integration (Heap Connect)
- Region-specific storage
- Advanced user permissions
- Dedicated CSM
Prices as listed, USD, excluding tax; observed 2026-10-15.
Source: heap.io pricing page. Prices change; the observed date above is when our agent read them.