how do i list an app on appexchange which requires the user to download from website

Question

We have an .net app which interacts with salesforce using api. This would need to be downloaded from out website. We want to list this app on appexchange but the download would still happen from our website.

I had a few question regarding the listing.

1. Do we need to have this app as paid app in appexchange? Its paid from our website and all the checkout would happen from our website.

2. Does it need to go through security review? We dont have a package on SF, so how do they do the review?

3. Is there anything else that i need to be aware of

I know we need to signup as a partner for the listing which we are doing.

Update:

Our app would be residing outside of SF and would communicate with SF using API's. A use case would be of hosting online surveys and automatically update the survey results into SF using API's

We dont have any package that needs to be installed in SF, so how would SF do a security review, what would they review?

Answer 1

Do we need to have this app as paid app in appexchange? Its paid from our website and all the checkout would happen from our website.

If you're collecting licensing fees, and you want to pass the security review, and you want to be an ISV partner, then you will be required to pay ISV fees (15-25% of your license fees). The way you choose to process your fees don't affect your ISV agreement, if you have one; if you are an ISV, you're expected to follow the agreement.

Does it need to go through security review?

If you want to be listed on AppExchange, yes, you need a security review. You'll also have to pay the upfront security review fee, plus the yearly maintenance fee. If you decide to not be a partner, your code can still be downloaded, but you won't have an AppExchange listing and the increased visibility/marketing that this can bring to your product.

Is there anything else that i need to be aware of

Not really. The Security Review process is different for an app like this, but the overall publishing flow is the same. Keep in mind that you can choose not to go through Security Review, it just means you don't get AppExchange marketing. You will need to consider if the benefits are worth the cost and time.

Also remember that partners get enhanced ability to access Professional Edition orgs with the API, which can increase your subscriber count. Many partners consider the benefits worth it, but you can be successful without it.