Salesforce ISV engineering

AppExchange app development services

Your product, built to pass security review and live on the AppExchange, by engineers who've shipped there before.

What is AppExchange app development?

AppExchange app development is building a product that installs into other companies' Salesforce orgs, distributed through Salesforce's marketplace. It's product engineering with extra rules: managed packages, namespace isolation, governor limits at someone else's scale, and a security review that rejects most apps the first time. Codiot's engineers have built and shipped multiple AppExchange products, and we bring that experience to ISVs building their first listing or rebuilding an existing one.

No partner badge. Shipped products instead.

We're not a Salesforce consulting-partner logo on a slide. What we have is engineers who have taken multiple products through AppExchange security review and into customers' orgs, and a decade of Salesforce implementation work (CPQ, Sales Cloud, CLM) that means we know how your app behaves inside real, messy orgs, because we live in them.

Capabilities

What we build.

Product architecture for managed packages

Second-generation packaging (2GP), namespacing, upgrade paths, and the decisions that are expensive to reverse later.

Full-cycle build

Apex, Lightning Web Components, Flows, and the platform patterns that survive other people's org configurations.

Security review preparation

Secure coding against the review checklist from sprint one, penetration-test readiness, false-positive triage, and remediation when findings come back.

Listing and licensing setup

License Management App (LMA), trial orgs, version management, and the listing itself.

Post-listing engineering

Release cadence across Salesforce's three annual platform updates, support for the orgs that install you, and roadmap features.

Integrations

External APIs, middleware, and off-platform services connected without tripping review requirements.

How it works

How it works with Codiot.

Product scope, not project scope
We define the installable product: editions supported, org shapes assumed, and what version one deliberately excludes.
Build against the review
Security review requirements are engineering constraints from the first sprint, not a pre-submission scramble.
List, license, iterate
Through review, onto the marketplace, then a release rhythm that keeps pace with Salesforce's own.

Why Codiot

Stack we use, and why teams choose us.

ApexLightning Web ComponentsSecond-generation packaging (2GP)Salesforce FlowLicense Management AppSFDX

·Engineers who have taken multiple products through AppExchange security review and into customers' orgs.
·A decade of Salesforce implementation work (CPQ, Sales Cloud, CLM) behind the packaging decisions.
·We build against the review checklist from the first sprint, not in a pre-submission scramble.
·Remediation of failed reviews, ours or someone else's, is a well-worn path, not a first attempt.

Is this right for you?

When it fits, and when it doesn't.

Signs you need this

·You've validated demand inside one or two orgs, and now it needs to become an installable product, not a consulting artifact.
·Salesforce's security review came back with findings, and the remediation list reads like a second project.
·Your app works, but it's first-generation packaging and tech debt, and every release is getting slower.
·You have a consulting build you want to turn into a product other companies can install.

What's included

·Product architecture, full build, and the managed-package decisions.
·Security review preparation and remediation support when findings come back.
·Listing and License Management App (LMA) setup, with a documented handover.

What's not

·The Salesforce ISV and partner-program enrollment and fees, which you, the listing owner, hold directly.
·Your pricing and go-to-market strategy: we advise, you decide.
·AppExchange marketing beyond the listing itself.

When this isn't the right fit

·The app only ever needs to run in your own org, which is custom Salesforce development, and cheaper.
·You want a white-labeled product someone else lists.
·Demand is unvalidated and a paper prototype would answer the question faster.

FAQ

Common questions, answered plainly.

How much does an AppExchange app cost to build?

A focused first version is a much smaller build than a full product suite. We scope against your edition support and integration list, and we'll tell you plainly if you're not ready for the investment yet.

How long does the security review take?

Plan for 4-8 weeks from submission, longer if findings come back. The real schedule risk isn't the review queue, it's remediation on apps that weren't built against the checklist. Building for review from day one is most of our value.

Managed or unmanaged package?

Managed (2GP) for anything you'll sell, upgrade, and protect IP on, which is nearly every real product. Unmanaged only for templates and internal distribution where the recipient owning the code is the point.

Do we need to become a Salesforce partner?

Yes, the listing owner enrolls in Salesforce's ISV program and holds that relationship, revenue share, and the listing directly. We build the product; the partnership and the listing are yours.

Who owns the IP and the listing?

You do, entirely: code, namespace, listing, and the customer relationships that come from it.

Can you fix an app that failed security review?

Yes, remediation of someone else's findings is a well-worn path for us. Send the report; we'll give you an honest read on effort before you commit.

Explore related work.

Salesforce development services Custom software development Hire Salesforce developers Contact

Start

Let's talk about AppExchange app development.

Tell us what you're building. We'll reply within two business days with an honest take on scope, timeline, and cost.

Get a free estimate

Salesforce, AppExchange, and Agentforce are trademarks of Salesforce, Inc.