I came across this question in Salesforce Security Review Process. But I am not sure what to choose.

  1. Is your offering a single org solution of hybrid single org solution?


A : Single org solutions have one salesforce Organization for all customer users. This is usually done using Sites.

B : A hybrid single org solution has a package that is installed in the customer org that calls out to a single salesforce org for all customers for part of its functionality.

I am sure my app is not Single Org since we never used sites.

But my app has an embedded iframe which calls my own Domain ( not salesforce domain ). So would my app fall under hybrid single org solution ? or would it be neither since the external domain is not another Saleforce org ?

I left both of this options Unchecked since it would be a safer. I searched everywhere on this but I couldn't get any concrete article stating this options. Please help me understanding the category in which I fall.

  • 1
    I personally would leave both unticked as well, you are for sure not using Sites as you say, and nor do you make callouts to another Salesforce org/endpoint (or more specifically another Salesforce server). In my view you are a 'Hybrid App' because you utilise an external service/endpoint which is not a Salesforce server (which i assume you pass the users session id to). I cannot check easily but you should have been asked if your are a 'Hybrid App' at some point? Sep 20, 2013 at 1:34

1 Answer 1


A single org solution is when all customers log into a single org that you control to get the desired functionality. It does not require sites per se (although using sites is the more straightforward way of doing this). Here there is no package that the customer needs to install in their own org. All the work is happening in a single org you control.

A hybrid single org solution would be when there is a package that they install in their org, and this packages logs into your Salesforce org. So part of the work is done in the customer's org and part in a central org under your control.

A composite app would be one where you have some native code running on force.com and some functionality is provided by a website or webservice. This could be with an iframe in a visualforce page (such as a canvas app, but not necessarily a canvas app). It could also be with a third party webservice that calls into the customer's org or that accepts callouts from the customer org. Connected apps (that call into Salesforce with OAuth) would also fall under this category.

A client app would be one in which code running on the customer's desktop makes callouts to the customer's org.

A mobile app would contain an iOS or Android component making callouts to the Salesforce organization.

It sounds like you have a composite app.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .