1

We have an .net app which interacts with salesforce using api. This would need to be downloaded from out website. We want to list this app on appexchange but the download would still happen from our website.

I had a few question regarding the listing.

  1. Do we need to have this app as paid app in appexchange? Its paid from our website and all the checkout would happen from our website.

  2. Does it need to go through security review? We dont have a package on SF, so how do they do the review?

  3. Is there anything else that i need to be aware of

I know we need to signup as a partner for the listing which we are doing.

Update:

Our app would be residing outside of SF and would communicate with SF using API's. A use case would be of hosting online surveys and automatically update the survey results into SF using API's

We dont have any package that needs to be installed in SF, so how would SF do a security review, what would they review?

Improve this question

1 Answer 1

Reset to default
0

Do we need to have this app as paid app in appexchange? Its paid from our website and all the checkout would happen from our website.

If you're collecting licensing fees, and you want to pass the security review, and you want to be an ISV partner, then you will be required to pay ISV fees (15-25% of your license fees). The way you choose to process your fees don't affect your ISV agreement, if you have one; if you are an ISV, you're expected to follow the agreement.

Does it need to go through security review?

If you want to be listed on AppExchange, yes, you need a security review. You'll also have to pay the upfront security review fee, plus the yearly maintenance fee. If you decide to not be a partner, your code can still be downloaded, but you won't have an AppExchange listing and the increased visibility/marketing that this can bring to your product.

Is there anything else that i need to be aware of

Not really. The Security Review process is different for an app like this, but the overall publishing flow is the same. Keep in mind that you can choose not to go through Security Review, it just means you don't get AppExchange marketing. You will need to consider if the benefits are worth the cost and time.

Also remember that partners get enhanced ability to access Professional Edition orgs with the API, which can increase your subscriber count. Many partners consider the benefits worth it, but you can be successful without it.

Improve this answer
2
  • The clients would already have a Sf license, our .net app would reside outside of SF and would update clients SF instances. A use case would be of hosting online surverys and automatically update the survey results into SF. There are no objects residing within SF so we really dont have a package on which the security review could happen unless they want to run through the .net code. This is where i am thinking do we need to go through the security review or how would they do a security review in this case?
    – Prady
    Nov 18, 2018 at 10:10
  • @Prady There is indeed a separate process for verifying binaries, but you would still have a security review if you want to be listed. You can start from here to get an idea, but yes, they will review your app for security leaks, such as using usernames and passwords, leaking customer data, etc.
    – sfdcfox
    Nov 18, 2018 at 13:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.