I am writing an adapter for SalesForce which functionality will be to post information about particular events happened in the CRM to the external WebService.

While I think I understood development part I am still a bit lost regarding distribution part. I see following options:

1) Unmanaged Package - build a free, unmanaged package and distribute it via my company website

2) Managed Package - build a managed package and still distribute it via my company website

3)Managed Package on AppExchange - build a managed package and distribute it via AppExchange

As my package is really pretty technical but I want to benefit from managed package I tend to select second option. The two questions I have are:

  • Do I still need to pass Security Review if it will be distributed for free?
  • Do I still need to sign any partner contact with SalesForce?

BTW - I assume that both answers are "Yes".

If nevertheless I will want to distribute it for a limited group of "trusted" deployments as an unmanaged package - what will be the answer on the same two questions.

2 Answers 2


While its good practice to demonstrate to yourself and your clients that your code passes the Security Review standards. No you don't have to go through the formal submission process or be a partner for managed or unmanaged packages you care to distribute via your own means. However if your package is free, the Security Review process is free and you will thus get added exposure via App Exchange.

Running the Scanner for yourself: You can infact run the same Security Scanner software for free at anytime your self via the self serve web site or an Eclipse plugin (there is also a good blog here about the tool). So regardless I would still personally recommend you try it out for your own quality procedures. Especially since you are making external call outs. It also helps with spotting some programming best practice observations, such as DML or SOQL in loops btw.

  • Thank you and Sven for clarification, It was just hard for me to believe that there is a backdoor like this - one can create commercial managed packages and distribute/charge for them without paying anything to SalesForce. I thought they have some legal regulations against that. Commented Dec 19, 2013 at 15:56

Well Security review and contract is not based on managed or unmanaged package it is based on ISVForce or Force.com Embedded program signup. So if you want to publish your app on appexchange then you are obliged to do a security review.

On an Unmanaged package you just upload your package and your customers that have the link can install it in their orgs. Be aware that an unmanaged package is open so meaning anybody can modify the code.

Managed packages are locked down for editing so they can't see the source code but you don't need to put this on appexchange. If it is ofcourse a commercial product appexchange is ideal for marketing your app.

on below links there is a good explanation on the difference between un/managed packages

difference between both options http://wiki.developerforce.com/page/An_Introduction_to_Packaging

appexchange programs http://www.salesforce.com/partners/isv/program-models/

security review faq http://wiki.developerforce.com/page/Security_Review_FAQ


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .