2

I want to create an app exchange app that will be integrated with other system. Whenever certain conditions are met, then we will call other system API with some salesforce data like as first name, lastname, mobile number, email etc.

Is it allowed to expose salesforce data to external system from security review perspective?

Please share your views on the same.

  • 2
    Apps like Conga, Adobe Esign and numerous other apps share data to 3rd party system for processing. I dont think it should be an issue with them – Pranay Jaiswal Aug 3 '18 at 10:05
  • 1
    Please, ensure that external application is secure according to ZAP/OWASP scan as mentioned here -- developer.salesforce.com/page/Security_Review – kurunve Aug 3 '18 at 10:22
3

Is it allowed to expose salesforce data to external system from security review perspective?

The short answer is Yes.

The review process revolves around identifying security vulnerabilities (viz., XSS, Injection, etc.) in your package which covers the topics as highlighted in the Security Review details.

As Pranay has already highlighted, there are various app exchange products which host data in their specific servers and interact with Salesforce through the package. So from data perspective, Salesforce won't have any "objection" if you expose the data to any external system.

Any data related pieces is directly related to your end client who uses the product. E.g., there are certain clients who don't want to expose data out of Salesforce for certain compliance reasons. This will all depend which sector your product is targeted towards to. If you target your product towards such clients who do not have strict compliance around data, then you are good from that perspective. However that does not mean that your product will not work for any such client who have compliance around data, because that is always that can be reviewed during the process with the client itself.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.