Vendors describe a package as native because it installs inside Salesforce. That word says nothing about whether the package makes callouts, so a listing that sends data to an external endpoint gets marketed the same way as one that never leaves the org.
You cannot read the code in a managed package, and Salesforce states that partner applications are non-Salesforce applications, that it makes no guarantees about them regardless of any review, and that customers are responsible for evaluating their quality and security. Agent actions raise the stakes, because they run on their own and chain into other actions with nobody approving each one.
This session replaces the standard vendor questionnaire with questions that produce evidence. Attendees see which questions are meaningless on this platform, what to demand instead, including permission sets with written justification and every external endpoint with the fields sent, and how to test a native claim by removing remote site settings to find what breaks.
Attendees will leave with a Salesforce-specific vendor evaluation to run before the next install, and a way to verify what a listing does rather than accept what it claims.
André van Kampen is a Salesforce MVP Hall of Fame member, Data Quality Advocate at Plauti, and owner of ISV Forum. He joins host Matt Meyers, CTA and CoFounder and CEO of EzProtect. Get your toughest Salesforce security questions answered live.
Register for this event and we will see you online.