This article mentions whitelisting a connected app, but I have not been able to find any resources on how to begin the whitelisting process, and what is required of my application to be successfully whitelisted. Is the security review part of the whitelisting process? How long does the whitelisting process take? What else do you know about whitelisting? (because I have found very little about it online thus far).
It is my understanding that our connected app be whitelisted before Group Edition and Professional Edition SF orgs can install our connected app (and gain REST API access)
Update: here is a precursor to the original article. Based on the url anchor, whitelisting is the same as the security review process, but I would like something a little more concrete than an url anchor.
Another Update: This article is slightly more helpful.