Salesforce's Real Moat Isn't the 10,000 Apps. It's the Data You Can't Take With You.

Ask a CIO why they can't just leave Salesforce, and they'll point at the apps. The plug-ins. The integrations. The years of customizations bolted on by a partner now long gone. It feels true — the marketplace today is cited at more than 10,000 apps, and customers have installed over 13 million of them from 7,000-plus partners.⁹¹⁰ But that's not the wall keeping anyone in. The apps you can rebuild. The thing you can't move is the data underneath them: a decade of every customer interaction, fused across systems until it stopped being a database and became the company's institutional memory.

The official story is that Salesforce locks you in with its ecosystem — the AppExchange (now folded into AgentExchange) that everyone copies and nobody matches. That's the symptom, not the mechanism. The real lock-in is written in flat language in Salesforce's own SEC filing, and it has nothing to do with how many apps are in the store.

Read that as an engineer, not a marketer. "A complete view of customers" means the data isn't sitting in tidy, exportable tables. It's been connected — knitted across sales, service, marketing, commerce, analytics and automation until the value lives in the relationships between records, not the records themselves.⁴ You can export a contact list in an afternoon. You cannot export ten years of stitched-together relationships, workflows, and permissions without rebuilding the nervous system of the business that ran on them. That is the difference between switching cost and data gravity — and it's why leaving Salesforce is a multi-year migration project rather than a procurement decision — and for large enterprises fused across many clouds, the accumulated cost of data migration, workflow reconstruction, and retraining routinely dwarfs any license savings.

Why the app store is the wrong thing to fear

The marketplace gets the headlines because it's countable, and the counts are impressive — an independent crawl found 5,141 unique apps in mid-2024, growing toward 6,000 a year later, before the 2026 rebrand into AgentExchange pushed the cited figure past 10,000.⁷⁸ But every one of those apps is, by definition, replaceable; that's what an app is. A vertical CRM startup can rebuild the dozen integrations a given customer actually uses. What it cannot rebuild is the customer's own accumulated data living somewhere else, in someone else's schema. The marketplace makes Salesforce sticky on the way in. Data gravity makes it nearly immovable on the way out — and those are not the same force, even though the industry keeps calling both of them "the ecosystem."

The backlog that measures how long people stay

If you want to see lock-in on a balance sheet, look at remaining performance obligations — the contracted revenue Salesforce has booked but not yet recognized. It tells you not what customers spent, but how long they've committed to keep spending. That figure was $63 billion at the end of FY2025 and reached $72.4 billion in FY2026, up 14% year over year.³² Layer on the revenue mix: of $34.86 billion in FY2024 revenue, $32.54 billion — about 93% — was subscription and support (a figure that has since ticked up further).¹ This is not a company selling licenses and hoping for renewals. It is a company whose customers have pre-committed years of spend, on data they can't easily take anywhere else.

One honesty check on that number, because it gets abused: a $72 billion backlog is not a churn-proof guarantee. Salesforce itself cautions that RPO isn't necessarily indicative of future growth — it's shaped by contract timing, currency swings, and acquisitions. The Informatica deal alone added roughly four points to the current-RPO growth rate.² So read it as evidence of commitment depth, not destiny. The point isn't that the money is guaranteed; it's that customers were willing to sign multi-year contracts at all, which is exactly what you'd expect from people for whom leaving means moving the data nervous system of the business.

Isn't a wall this high simply unbreakable?

The fair objection runs the other way: if data gravity is this deep, the moat should be widening, and Salesforce should be taking share, not just holding it. It isn't. IDC's 2025 tracker put Salesforce's CRM share at 20.7% for 2024 — down from 21.7% the year before.⁵ Note what that corrects, too: the popular line that Salesforce owns "more than a quarter" of CRM depends entirely on how you measure. Install-base trackers that count deployments rather than revenue do report figures above 25%, but IDC's revenue-share methodology — the industry standard for vendor rankings — puts the number at 20.7%.⁵⁶ The cause of the slip is the most telling number in the whole story: the CRM market grew 12.8% in 2024 while Salesforce's CRM revenue grew only 9.5%.⁶ Growing in absolute terms while shrinking in relative terms is what a strong moat being tested at the edges looks like.

Here's the resolution, and it's the whole spine of the thing. Data gravity is brutally effective at holding the customers you already have — and useless at winning the ones you don't. A nimble vertical or AI-native challenger doesn't have to fight through the switching costs holding an existing Salesforce account in place; it just has to win the next net-new buyer who has no data resident anywhere yet. That's where the share-point is leaking. No single challenger has cracked the ~5% mark, so the giant is in no danger.⁶ But a moat that defends the installed base while the new-customer frontier slowly drifts elsewhere is exactly how dominance erodes — slowly, then all at once, from the edge inward.

Salesforce built the most-copied marketplace in enterprise software, and then quietly built something far harder to copy underneath it: a place where a company's memory comes to live and finds it cannot leave. The apps were always the magic trick — the visible thing everyone watched. The real lock-in was the data settling into the platform like sediment, year after year, until pulling it back out would cost more than staying ever could. That moat will hold the giant's existing customers for a long time. The question is no longer whether anyone can pull them out. It's whether the next generation of customers ever walks in.