Skip to main content

​
How the review works

Every app listed in the marketplace has passed Twenty’s security and quality review. Publishing to npm does not list an app on its own: it stays unlisted until the review is complete. See Publishing for how listing works. Listed apps may be reassessed as they, their dependencies, or the services they rely on evolve, and can be unlisted if they stop meeting the checklist.

​
Review checklist

All applicable items must pass. We recommend using an agent to self-evaluate each criterion with evidence and required fixes before submitting.
  • Publisher. Claim your app and publish with provenance.
  • Security. Pass Twenty’s internal security review and resolve blocking findings.
  • Permissions. Request only the permissions needed for the app’s features.
  • Functionality. Setup and core workflows are easy to follow and work as advertised, without crashes, lost work, or duplicate records. No placeholder features or broken controls.
  • Performance. Respect shared API/job rate limits, handle throttling, and follow the app development good practices.
  • Usefulness. Complete a meaningful CRM task for a broader audience than one customer’s setup. Small connectors and headless automations qualify.
  • Native experience. Reuse native objects, views, and workflows where appropriate. If the app has a UI, use twenty-ui and match Twenty’s layouts, interactions, and accessibility conventions.
  • Privacy. Explain what data leaves the workspace, where it goes and why, including AI providers, how long it is kept, and how it can be deleted.
  • Maintenance and compatibility. Declare supported Twenty versions, keep entity identifiers stable, and fix critical bugs and broken integrations over time.
  • Logo and gallery. Provide an original, recognizable logo and polished images of the actual app. Follow the image guidelines.
  • Listing and README. Accurately describe features and affiliations in the name, description, and screenshots. Keep the README short, well-formatted, and focused on the app’s value.
  • Pricing. Clearly state whether the app is free or paid, plan prices, billing frequency, and any required paid third-party services.
  • Documentation and support. Provide setup instructions, a working example, and a support contact. If using shared routes, complete setup and verify events reach the correct workspace.