Salesforce's Real Moat Isn't the CRM. It's the 3,668 Developers Who Can't Afford to Leave.

A company finally decides it has had enough of Salesforce. The contract is steep, the renewal is brutal, and a rival CRM is cheaper. Then someone in the room asks the question that ends the conversation: what happens to the eleven add-on apps we run on top of it? The billing connector, the document generator, the territory planner, the e-signature flow — each one was bought from a different vendor, each one was built to live on the Salesforce platform, and not one of them moves. Migrating the CRM is a project. Migrating the eleven things bolted to it is a war. The meeting ends. The renewal gets signed.

The official story is that Salesforce locks customers in with its CRM — the data, the dashboards, the years of sales history nobody wants to re-enter. That's real, but it's the shallow trap. The deeper one is the marketplace bolted onto the product: AppExchange. The CRM is what you'd switch away from. The ecosystem is what makes switching unthinkable.

The marketplace that was never really about the apps

Salesforce introduced AppExchange at its Dreamforce conference in September 2005 — years before Apple's consumer App Store, and arguably the moment enterprise software distribution changed.¹⁸ The pitch to developers was irresistible: stop building standalone software nobody can find, and instead build on the Salesforce platform, where a waiting market of customers is already standing.⁸ By the end of that first fiscal year the marketplace already held 575 apps from 250 independent software vendors.¹ Two decades later it hosted thousands of apps from thousands of developers, and the reach is the part that matters: roughly nine in ten Salesforce customers, and a similar share of the Fortune 500, run at least one AppExchange app.⁶

Read that last number again, because it is the whole game. When 91% of your customers have installed someone else's software inside your product, you are no longer selling a CRM. You are renting them an operating system they have furnished with their own tools — and a furnished house is far harder to leave than an empty one.

How a 15% toll became a moat

Here is the move most people miss. Salesforce's cut of an AppExchange sale is small: the standard revenue share through AppExchange Checkout is 15% per transaction, with no setup fees and no minimum.⁵ If the goal were to maximize the toll, that number would be far higher. It stays modest on purpose. Salesforce is not trying to get rich off the apps — it is trying to make building apps on its platform the most attractive option a developer has, so that thousands of them do, and so that the customer's world fills up with software that only runs in one place.

The genius is who ends up defending the moat. When Salesforce told partners how lucrative the platform could be, it framed the relationship in dollars: a commissioned 2019 IDC study projected the partner ecosystem would see $5.80 in gains for every $1 Salesforce itself earned, alongside a forecast of $1.2 trillion in new business revenues and 4.2 million jobs through 2024.⁴ Treat those as the projections they were, not realized fact — but the framing did its work regardless. A developer who believes their livelihood scales with the platform has no incentive to make their app portable. They build deeper in, not wider out. The lock-in isn't enforced by Salesforce. It's volunteered by the people who sell on top of it.

Salesforce says the quiet part in its own filing. The 10-K names 'leverage our partner ecosystem' as a growth strategy and describes a platform that lets third-party developers build and sell cloud apps through AppExchange.¹⁰ In SEC language that reads like boilerplate. In strategy terms it is a confession: the ecosystem is not a side business. It is the business model wearing a marketplace as a disguise.

Isn't a marketplace just a feature anyone can copy?

The fair objection is that an app marketplace is hardly unique — Microsoft has one, every major platform has one, and a determined rival could stand up an AppExchange clone in a quarter. True, and beside the point. The asset was never the marketplace software; it was the twenty-year head start in convincing developers to build there first and customers to install nothing else. A competitor can copy the storefront overnight. It cannot copy the 3,668 developers who already wrote their code against Salesforce's platform, nor the years of installed apps sitting inside customers' orgs.⁶ Network effects don't respawn on demand.

The honest counter is more dangerous, and it isn't a rival marketplace — it's AI. A large share of AppExchange apps exist to do unglamorous integration work: connect this to that, move data here, automate a step. The top category by volume is Sales tooling, and Salesforce itself, via Salesforce Labs, accounts for nearly a tenth of all listings.⁷ If AI agents can generate those point-to-point integrations on demand, the reason to install a third-party app — and the switching cost it created — starts to dissolve. The moat was built from the very thing AI is best at commoditizing.

Salesforce clearly sees it. In March 2025 it launched AgentExchange, a dedicated section of AppExchange for agentic AI components, debuting with more than 200 partner solutions.⁹ Read it as defense, not expansion: an attempt to re-pour the same lock-in into the agentic era, getting partners to build their AI on Salesforce's rails before those rails become optional. Whether the old trick works on a new technology is the open question — and it's the right one to be nervous about.

Salesforce sells a CRM the way a mall sells square footage — the rent is real, but the value is the foot traffic. It spent twenty years getting an entire industry to build its livelihood on top of one platform, then let that industry do the locking-in for free. The CRM was always the easy thing to leave. The hard thing to leave was the world everyone else built on top of it. Now AI threatens to make that world trivial to rebuild somewhere else — and Salesforce is racing to lay new rails before its own bodyguards discover they no longer need the building.