We are currently distributing managed packages to our customers without any appexchange listing and hence without paying sales commission to Salesforce.
A potential new customer now requires our application be Security Reviewed by Salesforce for their internal compliance.
Is it possible to have the app Security Reviewed but not listed on AppExchange? From looking at the process it seems there is no necessity to actually put the offering "live" on Appexchange.
If it is indeed possible to do so, do we not have to pay commission to Salesforce for the revenue generated by the app? From browsing the documentation, it seems that is the case.