Salesforce AppExchange: Evaluate and Install Safely

The Salesforce AppExchange is Salesforce's marketplace for apps, components and consultants, which Salesforce's own documentation now brands AgentExchange. Treat every install as hiring a vendor with access to your data. Salesforce's security review is the floor, not the verdict, so check permissions, data flow and price, then install in a sandbox first.

Key takeaways

• Treat every Salesforce AppExchange install as hiring a vendor who gets a login to your data, not as downloading an app.
• Salesforce's security review is the floor, not the verdict: you still have to check permissions, data flow and the real price.
• Install in a sandbox first, limit access to admins, then roll out by permission set.
• Ask first whether a native feature or a small Flow would do the job, because every installed package is a dependency you own.

The Salesforce AppExchange makes installing software feel like installing a phone app. Click, approve, done. That ease is the risk.

My argument is simple. An AppExchange app is a vendor with access to your data, and you should evaluate it that way. The marketplace helps you, but it doesn't do your due diligence. This guide is the checklist I'd hand any admin or buyer before the first click.

What is the Salesforce AppExchange, and what is it called now?

It's Salesforce's marketplace for apps, components and consultants, and Salesforce's own documentation now brands it AgentExchange.

Salesforce describes it as over 9,000 pre-built and customisable apps with more than 13 million installs and 142K+ peer reviews (figures from its December 2023 explainer, so likely higher now). The current Trailhead install module and the Application Installation Guide FAQ both use "AgentExchange". Salesforce has also added skills and plugins for AI agents to the same storefront.

People still search "Salesforce AppExchange", so I'll use that name here. The evaluation is identical whatever the sign says.

The five-gate checklist for Salesforce AppExchange apps

Run every candidate through five gates in order, and stop at the first one it fails.

Gate	Question	Where to look
1. Fit	Could a native feature or a small Flow do this?	Your own org, Setup
2. Security	Has it passed Salesforce's review, and what does it access?	Listing, vendor security documents
3. Data	Where does our data go, and who can see it?	Vendor's data-flow answers, install screen
4. Price	What's the bill at our user and data volume in year two?	Listing pricing, vendor quote
5. Exit	What happens to our data and automations if we uninstall?	Install guide FAQ, vendor contract

Gate 1: do you need an app at all?

Every package you install is a dependency you'll maintain, so beat the native option first.

Write the requirement as one sentence. Then check whether standard Salesforce, a Flow, or a few days of build covers 80% of it. Installed automation also runs alongside yours, so read the order of execution in Salesforce before adding a package that ships triggers or flows to an object you've already automated.

Gate 2: what the security review does and doesn't tell you

Salesforce's security review for listed apps is a useful filter, but it's a point-in-time check by Salesforce, not a guarantee about the vendor's behaviour tomorrow.

That's my judgement, not Salesforce's wording, but it's how I'd treat it. A reviewed listing is a better starting point than an unlisted package. The Application Installation Guide (Summer '26, version 67.0, last updated 24 July 2026) even has a chapter on unauthorized managed packages. Read it before anyone installs a package from a link in an email.

Beyond the badge, ask the vendor for:

• What data objects and fields the app reads and writes, and why.
• Whether data leaves Salesforce, to which systems and in which region.
• How they handle a security incident and how fast they'd tell you.
• Whether they connect through OAuth or a connected app, and how tokens are revoked.

A good vendor answers these in a day. A vendor who dodges them has told you something.

How to use Salesforce AppExchange without regretting an install

Read the listing like a contract: recent reviews, requirements, support terms and pricing model, in that order.

With 142K+ reviews on the platform, sort by most recent, not highest rated. Look for reviews from orgs your size and edition. Check the listed requirements (edition, other packages, Experience Cloud or Data 360 needs). Use the free trial or test drive if there is one, but remember a demo org has none of your messy data.

My take: The best signal on a listing isn't the star rating, it's how the vendor replies to one-star reviews. I'd choose a 4.2 with honest, fast replies over a 4.9 with nothing underneath.

Gate 4: price the app at year two, not day one

The quote you get is for today's headcount, so ask what it costs when you double your users or records.

Ask these before signing:

1. Is it per user, per record, per transaction or flat? What's the unit?
2. Which Salesforce licences or add-ons does it require on top?
3. What's the renewal uplift, and is it capped in writing?
4. What happens to the price if you add a sandbox or a second org?
5. For agent skills and plugins, what's metered? My Agentforce pricing calculator helps you estimate consumption-based costs before you commit.

If you're also choosing an implementation partner for the app, these ten questions apply there too.

How to install an AppExchange app safely, step by step

Install into a sandbox first, for admins only, then widen access by permission set once it's tested.

Salesforce's install guide FAQ and Trailhead module cover the mechanics. My sequence:

1. Get it in a sandbox. On the listing, choose to install in a sandbox, not production. Use a full or partial copy if the app touches real data volumes.
2. Choose "Install for Admins Only" when the installer offers install options. Don't pick "all users" by reflex.
3. Read the third-party access prompt. If the package asks to reach external sites, check those domains match what the vendor told you at Gate 3.
4. Check Setup > Installed Packages afterwards. Note the version, namespace and licence counts.
5. Test your own scenarios, including a bulk data load and your existing Flows, with a few real-looking records.
6. Grant access through permission sets, only to the pilot group. Avoid editing profiles.
7. Repeat in production in a quiet window, with a written rollback note and a named owner.

Know the package type too. Managed packages are locked: you can configure them but can't read or change their code, so you depend on the vendor for fixes. Unmanaged packages are copied into your org and become yours to maintain. The Trailhead unit explains the difference.

My take: I'd pay for a partial sandbox just to test one important app. Rolling back in production is far more expensive, in staff time and trust, than a sandbox refresh. I've worked on Salesforce since 2008 and the cheap shortcut has almost never been the cheap one.

Common AppExchange mistakes admins make

Most install problems come from skipping a step, not from bad apps.

• Installing for all users by default. It's the fastest way to expose fields to the wrong people.
• Trusting the badge alone. A reviewed listing doesn't tell you what the app does with your data.
• No owner. Nobody tracks upgrades, licences or the contract renewal date.
• Ignoring the exit. Check the FAQ on uninstalling before you install. Export anything you need before you uninstall.
• Testing the happy path only. The failure shows up on the first bulk load or the first overlap with your own Flow. If that happens, here's how to debug a Salesforce Flow.
• Installing from a link someone sent. Always start from the vendor's listing.

Try this week:

• List every installed package in Setup > Installed Packages and write an owner and renewal date next to each.
• Remove or review any package nobody can explain.
• Draft a one-page evaluation template from the five gates above and use it for the next request.
• Ask your top three vendors where your data goes and how they'd notify you of an incident.

If you'd like a second pair of eyes on an app shortlist or an install plan, get in touch.

Frequently asked questions

Is the Salesforce AppExchange safe?

It's safer than installing software from random sources, because listed apps go through a Salesforce security review. But safe isn't automatic. You still need to check what data the app accesses, where it goes and what the vendor commits to in the contract.

What is the difference between a managed and an unmanaged package?

A managed package is locked: you can configure it, but you can't view or change its code, and the vendor ships upgrades. An unmanaged package is copied into your org and you maintain it yourself. Salesforce's Trailhead install unit explains both.

Can I uninstall an AppExchange app?

Yes, Salesforce's install FAQ covers uninstalling. Export what you need and check dependencies first.

Should I install an AppExchange app in production or a sandbox first?

A sandbox, always. Test with your own data volumes and automations, then install in production in a quiet window with a rollback note.

Has AppExchange been renamed?

Salesforce's current documentation refers to it as AgentExchange, now including skills and plugins for AI agents. Most people still search for "Salesforce AppExchange", and the evaluation steps are the same.