Can I distribute unlocked packages for free to my customers to connect to my org?

Question

Can unlocked packages be used to distribute an app to one's customers, as long as provided without fee? (same question but with fees here) Or would this constitute a commercial distribution in the sense of the "Master Subscription Agreement Developer Services" as long as the app has a commercial purpose?

Assume the packaged app calls a web service on my org, which a) allows my customers to synchronize data with me or b) create orders in my org. Is data synchronization "unlocked okay", order creation "managed only"?

Answer 1

IANAL.

That said, the reading of the MSA seems to be pretty clear cut. As long as you're not charging for the use of the App, you're free to distribute such an app to your customers. This includes even accepting orders through the App; you're not charging for the app, you're accepting payment for the product or service.

However, as the other Q&A mentions, your IP is not protected in an Unlocked Package. That means that anyone with sufficient permissions can read and even modify your code. You have no secrets in this package, including API keys, Named Credentials, or Security Certificates for secure communications. It's even technically possible to cause damage to customer data or metadata (e.g. by using the name of a class, field, etc that already exists in their org).

As such, even though the MSA technically allows your proposed use case, it is strongly recommended that you do not attempt to use Unlocked Packages for this purpose. That is not what they are designed for, and using them for this purpose basically has the same benefits as directly deploying metadata to their organization (which is to say, no extra benefits at all).

For just a few hundred dollars, you can become a Partner, get your Managed Package through Security Review, and then enjoy the extra benefits of being a Partner, including a listing on the AppExchange, improved support by being a Partner, improved security of your app (including Intellectual Property), and avoid any possible legal repercussions by complying with the various Agreements with Salesforce.

It may have been reasonable to do so in the past, but for new apps, you should definitely try to go through the normal channels.

Also note that, even without an ISV/Partner agreement, you can still distribute Managed Packages, which will confer protection of your IP and other secrets. You simply won't be listed on the AppExchange without being a Partner and going through a Security Review. And, of course, you still can't charge for the App unless you're Partner.

If you want to distribute your App for free, doing so with a Managed Package is recommended over an Unlocked Package, as a matter of security for your data and other secrets. There are, of course, some downsides to using Managed Packages, including restricted ability to delete and deprecated components, but these are more of a technical hinderance.

Answer 2

Unlocked packages do not need an ISV agreement for distribution, unlike Managed packages. You are free to distribute them without fees

If you are charging (with fees) and using it for commercial purposes then yes you need that MSA (for charging make sure you are a partner to Salesforce as ISV or System Integrator).

You cannot sell unlocked packages on AppExchange and they do not get the below

• No security review from Salesforce
• Your package code like Apex or Triggers are not IP Protected
• You won't be able to get all the benefits partners to obtain with appexchange. Appexchange apps have features like feature Management, Distribute apps on Appexchange, Collect Leads

Conclusion

it's better to do an MSA if any of the developer resources are used for commercial app distribution. So do not use unlocked packages and distribute the code if it is commercial unless you are partner to Salesforce.