I want to create an app exchange app that will be integrated with other system. Whenever certain conditions are met, then we will call other system API with some salesforce data like as first name, lastname, mobile number, email etc.
Is it allowed to expose salesforce data to external system from security review perspective?
Please share your views on the same.
Is it allowed to expose salesforce data to external system from security review perspective?
The short answer is Yes.
The review process revolves around identifying security vulnerabilities (viz., XSS, Injection, etc.) in your package which covers the topics as highlighted in the Security Review details.
As Pranay has already highlighted, there are various app exchange products which host data in their specific servers and interact with Salesforce through the package. So from data perspective, Salesforce won't have any "objection" if you expose the data to any external system.
Any data related pieces is directly related to your end client who uses the product. E.g., there are certain clients who don't want to expose data out of Salesforce for certain compliance reasons. This will all depend which sector your product is targeted towards to. If you target your product towards such clients who do not have strict compliance around data, then you are good from that perspective. However that does not mean that your product will not work for any such client who have compliance around data, because that is always that can be reviewed during the process with the client itself.
