What a Salesforce PDO Does, and When to Hire One

Short answer: a Salesforce PDO (Product Development Outsourcer) is a Salesforce consulting partner that builds commercial apps on the platform for software vendors, packages them, and takes them through security review onto AgentExchange, the marketplace that absorbed AppExchange in April 2026. You hire one when you have a product to ship on Salesforce, not when you are short one developer.

What is a Salesforce PDO?

A Product Development Outsourcer is a Salesforce partner whose speciality is building products on the platform rather than configuring the platform for one company. Salesforce runs PDO as a named partner track, with Master Navigator and Specialist Navigator tiers listed in its own PDO directory, so "Salesforce PDO" is a defined role, not a marketing label. ISVs (independent software vendors) hand a PDO the parts of product delivery that are specific to Salesforce: package architecture, namespace and dependency strategy, licensing, the marketplace listing, and the security review that gates all of it.

The one-line difference:

• A system integrator makes Salesforce fit your business.
• A PDO turns your idea into something other businesses install into theirs.

What does a Salesforce PDO actually do?

• Product architecture. What belongs inside the managed package, what stays in your own service, and what has to be configurable per subscriber.
• Packaging. 1GP or 2GP, namespace registration, cross-package dependencies, and a version strategy you can live with for years. If you have not settled that yet, our guide to Salesforce packaging models for ISVs lays out the trade-offs before a PDO locks them in.
• Security review. Preparation, submission, and remediation when the reviewers come back with findings.
• Licensing and provisioning. The License Management App, trial flows, and the listing itself.
• Release engineering after launch. Patches, upgrades and pushed versions that do not break orgs you cannot see.
• Support design. An ISV supports installs it does not control, which is a different discipline from supporting one org.

Only the first item resembles ordinary Salesforce delivery work. The rest is product operations, and it is where first-time ISVs lose quarters. That full scope, from first design to a listed package, is what our AppExchange app build service covers.

What changed for Salesforce PDOs and ISVs in 2026?

Three platform shifts change what a PDO has to know this year:

• AppExchange became AgentExchange. On 17 April 2026 Salesforce announced AgentExchange, one marketplace that merges AppExchange, the Slack Marketplace and the Agentforce ecosystem, with more than 10,000 Salesforce and partner apps. Every listed solution still goes through security review.
• Connected apps gave way to external client apps. Salesforce's developer docs state that connected app creation is restricted as of Spring '26 and recommend external client apps instead. Trailhead calls the ability to distribute external client apps with second-generation managed packages their greatest advantage, with OAuth consumer credentials kept out of the package.
• The OAuth hardening deadline has passed. Partners had until 11 May 2026 to enable four controls on their apps and self-attest to them. More on that below.

When should you hire a Salesforce PDO?

Five signals, in rough order of urgency:

1. You have a product thesis and a first design partner, but no namespace and no packaging decision on paper. This is the cheapest moment to bring a PDO in, because nothing is locked yet.
2. Your app works in a sandbox and breaks as a package. Namespace prefixes, dynamic SOQL and cross-package dependencies fail in ways unpackaged code never does.
3. You are approaching security review for the first time. The failure mode is rarely a single rejection. It is three rejections and two lost quarters. Our walkthrough of how ISVs pass the AppExchange security review shows where those cycles usually get lost.
4. You are on 1GP and want to move to 2GP. Salesforce made Package Migrations generally available in Summer '25, which converts a 1GP package to 2GP and migrates installed subscribers. The question is no longer whether, but when and in what order, and which 2GP choices are permanent once you make them. External client apps only add to the case, because they are built to ship in 2GP.
5. You have subscribers and every release now carries risk. Once other companies depend on your version numbers, release engineering stops being optional.

Why is hiring a PDO a product decision, not a staffing one?

Staff augmentation answers a capacity question: we need two more Apex developers for six months. A PDO engagement answers a product question: we need version 1.0 listed, reviewed and installable by Q2. The second framing is harder to buy and far better to own, because almost every expensive mistake in ISV delivery is a decision, not a shortage of hands.

A namespace is registered once and stays with the package. The 1GP or 2GP choice sets your release model for years. What you put inside the package determines what you can change later without asking every subscriber for permission. None of that is solved by adding capacity to a team that has never shipped a package.

If your Salesforce work has a roadmap, subscribers and a version number, you are buying product engineering. Buy it that way.

What does Salesforce security review actually gate?

Security review is a product gate, not a code-style check. It looks at how your package handles data, secrets, sharing and access, and it comes back around as the platform's requirements tighten.

The live example is OAuth on connected apps and external client apps. Salesforce's ISVforce guide required partners to enable OAuth PKCE, refresh token rotation, a 30-day idle refresh token time-to-live and a refresh token IP allowlist, and to self-attest to them by 11 May 2026. Once attested, the controls lock and cannot be disabled, and the guide warns that non-compliance can lead to de-listing or suspension of the app's interoperation with Salesforce. If your app missed that date, it is now a remediation item, not a roadmap item, and it is the kind of obligation a PDO tracks for you.

For the review itself, our Salesforce security review checklist lists the common findings to fix in order before you submit, and our security review service takes the submission and remediation off your plate.

How do you choose a Salesforce PDO?

Ask five questions and weigh the answers heavily:

• Which packages have you taken through security review, and in which industries? Regulated sectors raise the bar.
• Show me a 2GP package you maintain today. Building one is not the same as versioning one across subscriber orgs.
• How are you handling external client apps and the 2026 OAuth controls? A current PDO answers this without looking it up.
• Who owns remediation if review comes back with findings? The answer should be them.
• What happens after launch? A partner who disappears at listing leaves you the hardest part.

Tekunda answers those from delivery rather than from a brochure. We are a certified Salesforce SI, ISV and PDO, we have cleared AppExchange security review in healthcare, logistics and manufacturing, and we have shipped and maintained packages in production: the Syntilio managed packages we engineered for an eHealth ISV (2022 to 2025) on the AppExchange, and the 2GP managed package for ASSA ABLOY that carries its connected-device workload. Being an ISV and a PDO also makes us a faster integrator, because product-grade components get reused instead of rebuilt. Talk to us about your app.

FAQ

What does PDO stand for in Salesforce?

Product Development Outsourcer: a Salesforce consulting partner specialised in building, packaging and listing commercial apps for software vendors.

What is the difference between a PDO and a Salesforce implementation partner?

An implementation partner configures Salesforce for one company's own use. A PDO builds a packaged product that many companies install, which adds namespace, versioning, licensing and security review to the job.

Do I need a PDO to pass security review?

No. Plenty of ISVs pass on their own. A PDO mainly buys you fewer review cycles, because the common findings become predictable once you have been through it several times.

Is a Salesforce PDO the same as Plauti PDO?

No. Plauti Data Orchestration, also shortened to PDO, is a Salesforce product from Plauti. A Salesforce PDO is a type of consulting partner.

How early should an ISV bring in a PDO?

Before the namespace and packaging decisions are made. Those are the choices that are expensive to reverse, and they are usually made in week one.