What a Salesforce PDO Does, and When to Hire One

Short answer: a Salesforce PDO (Product Development Outsourcer) is a consulting partner that builds commercial apps on the Salesforce platform for software vendors, packages them properly, and takes them through AppExchange security review. You hire one when you have a product to ship on Salesforce, not when you are short one developer. That distinction changes how the engagement is scoped, priced and judged.

What is a Salesforce PDO?

A Product Development Outsourcer is a Salesforce partner whose speciality is building products on the platform rather than configuring the platform for one company. ISVs (independent software vendors) hand a PDO the parts of product delivery that are specific to Salesforce: package architecture, namespace and dependency strategy, licensing, the AppExchange listing, and the security review that gates all of it.

The one-line difference:

• A system integrator makes Salesforce fit your business.
• A PDO turns your idea into something other businesses install into theirs.

What does a Salesforce PDO actually do?

• Product architecture. What belongs inside the managed package, what stays in your own service, and what has to be configurable per subscriber.
• Packaging. 1GP or 2GP, namespace registration, cross-package dependencies, and a version strategy you can live with for years.
• Security review. Preparation, submission, and remediation when the reviewers come back with findings.
• Licensing and provisioning. The License Management App, trial flows, and the listing itself.
• Release engineering after launch. Patches, upgrades and pushed versions that do not break orgs you cannot see.
• Support design. An ISV supports installs it does not control, which is a different discipline from supporting one org.

Only the first item resembles ordinary Salesforce delivery work. The rest is product operations, and it is where first-time ISVs lose quarters.

When should you hire a Salesforce PDO?

Five signals, in rough order of urgency:

1. You have a product thesis and a first design partner, but no namespace and no packaging decision on paper. This is the cheapest moment to bring a PDO in, because nothing is locked yet.
2. Your app works in a sandbox and breaks as a package. Namespace prefixes, dynamic SOQL and cross-package dependencies fail in ways unpackaged code never does.
3. You are approaching security review for the first time. The failure mode is rarely a single rejection. It is three rejections and two lost quarters.
4. You are on 1GP and want to move to 2GP. Salesforce made Package Migrations generally available in Summer '25, which converts a 1GP package to 2GP and migrates installed subscribers. The question is no longer whether, but when and in what order.
5. You have subscribers and every release now carries risk. Once other companies depend on your version numbers, release engineering stops being optional.

Why is hiring a PDO a product decision, not a staffing one?

Staff augmentation answers a capacity question: we need two more Apex developers for six months. A PDO engagement answers a product question: we need version 1.0 listed, reviewed and installable by Q2. The second framing is harder to buy and far better to own, because almost every expensive mistake in ISV delivery is a decision, not a shortage of hands.

A namespace is registered once and stays with the package. The 1GP or 2GP choice sets your release model for years. What you put inside the package determines what you can change later without asking every subscriber for permission. None of that is solved by adding capacity to a team that has never shipped a package.

If your Salesforce work has a roadmap, subscribers and a version number, you are buying product engineering. Buy it that way.

What does AppExchange security review actually gate?

Security review is a product gate, not a code-style check. It looks at how your package handles data, secrets, sharing and access, and it comes back around as the platform's requirements tighten.

The live example every ISV should have on the roadmap is connected apps. Salesforce's ISVforce guide requires partners to enable OAuth PKCE, refresh token rotation, a 30-day idle refresh token time-to-live and a refresh token IP allowlist, and to self-attest that the app is onboarded to all four, by 11 May 2026. Once attested, the controls lock and cannot be disabled, and non-compliance can lead to de-listing or suspension of the app's interoperation. That is the kind of deadline a PDO tracks on your behalf.

How do you choose a Salesforce PDO?

Ask four questions and weigh the answers heavily:

• Which packages have you taken through security review, and in which industries? Regulated sectors raise the bar.
• Show me a 2GP package you maintain today. Building one is not the same as versioning one across subscriber orgs.
• Who owns remediation if review comes back with findings? The answer should be them.
• What happens after launch? A partner who disappears at listing leaves you the hardest part.

Tekunda answers those from delivery rather than from a brochure. We are a certified Salesforce SI, ISV and PDO, we have cleared AppExchange security review in healthcare, logistics and manufacturing, and we maintain packages in production: Syntilio CareHub serves 12 or more care organisations on the AppExchange, and our 2GP managed package for ASSA ABLOY carries its connected-device workload. Being an ISV and a PDO also makes us a faster integrator, because product-grade components get reused instead of rebuilt. See how we work.

FAQ

What does PDO stand for in Salesforce?

Product Development Outsourcer: a Salesforce consulting partner specialised in building, packaging and listing commercial apps on the AppExchange for software vendors.

What is the difference between a PDO and a Salesforce implementation partner?

An implementation partner configures Salesforce for one company's own use. A PDO builds a packaged product that many companies install, which adds namespace, versioning, licensing and security review to the job.

Do I need a PDO to pass AppExchange security review?

No. Plenty of ISVs pass on their own. A PDO mainly buys you fewer review cycles, because the common findings become predictable once you have been through it several times.

Should a new AppExchange app start on 1GP or 2GP?

2GP is the modern path for new packages. Existing 1GP vendors are not stuck either: Salesforce's Package Migrations feature, generally available since Summer '25, converts a 1GP package to 2GP and migrates installed subscribers.

How early should an ISV bring in a PDO?

Before the namespace and packaging decisions are made. Those are the choices that are expensive to reverse, and they are usually made in week one.