How long does the security review take? How often is it required?

The review process takes about 6–8 weeks, provided that:

• Your documentation is complete and accurate.
• The test environment is complete, fully configured, and includes all necessary information.
• You’ve met all the requirements.
• You’re within the agreement guidelines.

Periodically, we review apps or components again. The timeline varies depending on the security risk of the offering, but it’s usually between six months and two years since the last review. Around the expiry date, Salesforce contacts you to arrange another review.