When you deploy a managed package, what Metadata is considered IP/Code Protected?

I know that Apex Classes, Triggers, Visualforce pages are protected by Managed Packages, meaning the installer cannot see or edit the code within those components, but they are still able to see things like custom fields and reports. If you deploy flows within a managed package, will they be able to see how those were created as well?

Looking for a breakdown of what is really protected with a managed package and what metadata components are still readable to an installed org.

1 Answer 1


There's Protection and IP Protection. The former makes it impossible to create a hard dependency on a component (e.g. you can't create a lookup from a subscriber Custom Object to a Protected Managed Custom Object), and hides some records like Custom Metadata Type entries. The latter protects most code from being visible, unless marked as "global access". Components Available in Managed Packages goes over all the items for both Protection and IP Protection. Flows are specifically mentioned as IP Protected unless they are templates.

  • You should mention that packaged CMT records can be protected which means that the package code can find them but the subscriber cannot see them. Also worth mentioning that only global classes/interfaces and their global method signatures can be seen.
    – Phil W
    Nov 30, 2022 at 20:58
  • @PhilW That's fair, edited.
    – sfdcfox
    Nov 30, 2022 at 23:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .