I want to create an app exchange app that will be integrated with other system. Whenever certain conditions are met, then we will call other system API with some salesforce data like as first name, lastname, mobile number, email etc.

Is it allowed to expose salesforce data to external system from security review perspective?

Please share your views on the same.

  • 2
    Apps like Conga, Adobe Esign and numerous other apps share data to 3rd party system for processing. I dont think it should be an issue with them Aug 3, 2018 at 10:05
  • 1
    Please, ensure that external application is secure according to ZAP/OWASP scan as mentioned here -- developer.salesforce.com/page/Security_Review
    – kurunve
    Aug 3, 2018 at 10:22

1 Answer 1


Is it allowed to expose salesforce data to external system from security review perspective?

The short answer is Yes.

The review process revolves around identifying security vulnerabilities (viz., XSS, Injection, etc.) in your package which covers the topics as highlighted in the Security Review details.

As Pranay has already highlighted, there are various app exchange products which host data in their specific servers and interact with Salesforce through the package. So from data perspective, Salesforce won't have any "objection" if you expose the data to any external system.

Any data related pieces is directly related to your end client who uses the product. E.g., there are certain clients who don't want to expose data out of Salesforce for certain compliance reasons. This will all depend which sector your product is targeted towards to. If you target your product towards such clients who do not have strict compliance around data, then you are good from that perspective. However that does not mean that your product will not work for any such client who have compliance around data, because that is always that can be reviewed during the process with the client itself.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .