A recent question had basically two different answers regarding the usage of features, which might not be available at the target org:

  1. Adress the feature in question in a soft way. E.g. use the schema describe to see if a feature or object is available in a particular Org.
  2. Build a base package, which can be installed everywhere (GE, PE, EE) and move the code, which deals with special features to an extension package.

We have always chosen route 1, which is more suitable for our customers (install only one package, a trial can be started right away after installation), but i'm intrigued by route 2.

I write down some questions, which do come to mind, when you are creating a base package plus numerous extensions:

  1. Which packages are listed at the App Exchange? Only the Base or also the Extensions?
  2. Which packages do receive a security review? The base package is an obvious answer, but what do you do with the extensions?
  3. How do you deal with per-user-licensing? Does a customer need to purchase licenses for the base package and each extension he is using?
  • 1
    I'd ask the security review team directly for the best answer on that. Technically, you don't need to have your apps reviewed at all, but then they won't appear on the AppExchange. See Dealmaker as an example of a company that uses a base package plus extensions. For licensing, ISVs are free to choose their own fees for clients, either per-user or per-site, or free. You only pay a fraction of what you receive from your clients, so there's not necessarily a benefit of complicating the pricing structure.
    – sfdcfox
    Oct 16, 2014 at 16:41

1 Answer 1


I'll only comment on the security review portion of your questions, and let others handle the licensing/marketing issues.

  1. Which packages do receive a security review?

Both. The security review is per package -- really per package version. 2 packages = 2 security reviews. Whether one is a base and another is an extension doesn't matter. Obviously when you set up your testing organization, you will install both into the DE org so that the overall offering is functional, but there will be two different reviews. You can use the same testing organization for both reviews.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.