AppExchange App Development
Managed packages built to pass security review — architecture, packaging, listing and the release train that keeps the app alive after launch.
01
The problem
Why people call us about this.
A
You have a product idea and no route through Salesforce security review.
B
A failed review has stalled your listing and the feedback reads like a wall.
C
An existing package works but every release is a manual scramble.
02
What’s covered
The Salesforce we actually configure.
Building for the AppExchange is a different discipline from building for one org: multi-tenant safety, namespace discipline and a review Salesforce actually enforces.
03
The route
How an app gets onto the AppExchange
An app reaches the AppExchange in six steps: join the Salesforce Partner Program, build in a namespaced second-generation managed package, pass Salesforce’s security review, publish a listing, manage licences with the License Management App, and keep shipping upgrades. The build is rarely what stalls a launch. The review and the decisions made before it usually are.
-
Join the Partner Program as an ISV
That gives you a Partner Business Org, the org where your listing, licences and partner tooling live, and access to the Partner Console.
-
Build in a namespace, as a second-generation managed package
The namespace and package structure are the decisions you cannot undo later, so they are made first, with a Dev Hub linked to the Partner Business Org.
-
Pass security review
Salesforce scans the code, tests any external endpoints the app calls, and reviews the architecture against its multi-tenant security rules. Scanner findings are usually quick to fix; architectural objections are the ones that cost weeks. Budget six to ten weeks from submission, including remediation.
-
Publish the listing
Description, screenshots, pricing model, a demo and, if you want trials, a test drive or Trialforce template, all managed in the Partner Console.
-
Manage licences
The License Management App in your Partner Business Org records every install and controls seats and expiry for each subscriber.
-
Keep the release train running
Versioned releases, push upgrades to subscribers, and a fresh security review whenever the app changes enough to need one.
Salesforce’s partner fees and revenue share are set in the partner agreement and change over time, so check them in the Partner Community before building a business case rather than trusting a number in a blog post.
Evaluating AppExchange apps rather than building one? Read what the Salesforce AppExchange is and how to install an app safely.
04
How it runs
Five phases, and what you see at the end of each.
01 · Week 1
Inventory
What exists, who owns it, and which system is really the source of truth. Almost always surfaces something nobody knew was live.
A written map
02 · Weeks 2–3
Contract
The design in writing, with each decision and its reversal cost named. This is where we argue with the brief — before money is spent.
A signed scope
03 · Middle
Build
Built against the contract and reviewed against it. You see working software every two weeks, in your own sandbox.
Fortnightly demos
04 · Late
Prove
Volume testing at twice expected load, deliberate failure injection, and a replay run with your team watching.
A test evidence pack
05 · Final week
Hand over
Runbook, monitoring, escalation path and a named owner on your side — then a month watching it together before we step back.
Runbook and owner
05
First call
Thirty minutes. Three answers.
You speak to a certified architect, not a sales engineer. No deck, no discovery fee, and no obligation to go further — you leave the call with three things whether you hire us or not.
Whether this is even the right line
About a third of the time it is not, and we say so. Usually the ask is custom development when the real problem sits in the data model underneath.
A shape and a range
Roughly how long, roughly how many people, and the band it falls in. The firm number follows discovery about two weeks later, and it holds.
The two risks we would flag
The things most likely to blow the timeline on a project like yours — named on the call, before anyone has signed anything.
Book it for this week.
Pick a slot directly in the calendar — most questions get answered inside the thirty minutes.
06
FAQ
Asked on nearly every call.
Will you get us through security review?
We prepare for it and remediate the findings. Nobody can guarantee a Salesforce decision, but we have not had a listing fail a second review.
How long does review take?
Budget six to ten weeks from submission including remediation. Scanner findings are usually quick to clear; architectural objections are the ones that cost time.
Do we need a Partner Business Org?
Yes, plus the Licence Management App to handle subscriber licences. We set both up if you do not have them, and get the package linked properly before first submission.
Can you take over an existing package?
Yes. We start with a packaging and namespace audit, because that is where the decisions you cannot undo live — and it changes what is realistic afterwards.
Other lines