Good news arrived from Salesforce today...

Dear Michael,

Congratulations! Your application is now provisionally Certified. Thank you for your diligent work and amazing effort in achieving AppExchange Certification.

The Salesforce.com Security Team noted a couple extra precautions we must take to become "fully" certified. We're confident these measures can be implemented within 30 days.

Perhaps I'll blog more on this process in the future to share some lessons learned, but suffice to say we're all extremely pleased to reach this milestone. A lot of eyes from Salesforce and Symantec have been reviewing everything; including source code, hosted applications, and internal security policies. It's very gratifying to be validated by such a smart group of folks.

Kudos to Jerry Merfeld, our Support and Operations guru, who spent several days researching the AppExchange Certification Wiki and made changes to our information security processes to ensure our infrastructure is in compliance.