Will I be breaking any TOS by giving contacts a username (email) and password (generated) to sign into a visualforce page to access an app I build. I want to do this without buying any customer portal licenses. I read a year or so ago that doing this would break salesforce TOS, and cause a violation that could end in being shutoff. I just need some clarification on what I can and cannot do regarding this use case.


1 Answer 1


It's my understanding that custom authentication schemes invalidate the confidentiality clause of the Salesforce.com Master Subscription Agreement and thus would violate your TOS.

If you are building an app for the AppExchange, you would not pass security review.

  • 1
    TY. What about if I build an external site and authenticate via api?
    – fourq
    Commented Jan 2, 2014 at 16:15
  • 1
    Are you an ISV partner? This is typically a good question for your ISV rep.
    – greenstork
    Commented Jan 2, 2014 at 16:18
  • You can use a standard login authentication mechanism, such as the Customer Portal licenses if you require a login for the site usage. Additional fees will apply.
    – sfdcfox
    Commented Jan 2, 2014 at 16:20
  • 1
    No we're not. I had plans to write my acct manager about this, but I thought I'd SE it first. Thanks you've been helpful.
    – fourq
    Commented Jan 2, 2014 at 16:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .