We are currently distributing managed packages to our customers without any appexchange listing and hence without paying sales commission to Salesforce.

A potential new customer now requires our application be Security Reviewed by Salesforce for their internal compliance.

Is it possible to have the app Security Reviewed but not listed on AppExchange? From looking at the process it seems there is no necessity to actually put the offering "live" on Appexchange.

If it is indeed possible to do so, do we not have to pay commission to Salesforce for the revenue generated by the app? From browsing the documentation, it seems that is the case.


  • 3
    You will have to discuss this with salesforce ISV team to see how this works out . – Mohith Shrivastava Aug 21 '16 at 19:58
  • Would they accept a security scanner result as proof of security? I'm thinking a formal review is probably overkill for most policies. – sfdcfox Aug 22 '16 at 1:46
  • @sfdcfox unfortunately no. We offered that solution, but it was not sufficient for them. – hofimax Aug 22 '16 at 7:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.