I'm working on getting an app listed on the AppExchange, and we are just about ready to go into the Security Review. We were wondering if it is going to be a problem that we sell our app for free on the AppExchange, but to get our (required) web service a subscription is required. How does that work as far as paying for the security review and getting it passed?
A few things come to mind, The first and most important is are you a registered ISV? If not I think you should join right away.
Being a registered ISV means you have someone within Salesforce that you can talk to about these kind of issues.
I just went and took a look at one of the apps we currently have in security review and the help text regarding paid or free apps is as follows:
Indicate if you charge for your app or if it is free for all to use. Free downloads, free trials and pay-per-use apps are considered paid. For paid apps, we will collect a fee.
I read this as, despite your app being free on the app exchange you still charge for it elsewhere, making it a paid app as far as Salesforce is concerned.