Skip to content
Trimble Marketplace

Marketplace Certification

To ensure a standard of quality and trust for Trimble customers, all applications must undergo a certification process to verify functionality, security, and production readiness.

1. Compliance Review

Section titled “1. Compliance Review”

Before your application can be fully certified or your “Coming Soon” page published, you must complete the Third Party Compliance Review.

  • Submit your verification request via the NaveX One portal to complete Business Onboarding and the Code of Conduct Attestation.

2. Pre-Read Documentation

Section titled “2. Pre-Read Documentation”

Prior to your live demonstration meeting, you must provide documentation covering:

  • Application Scope: Document object-level data movement and define which system is the source of truth for each object.
  • Deployment & Support: Provide documentation for the deployment and onboarding processes, as well as customer support materials.

3. Security & Application Testing

Section titled “3. Security & Application Testing”

Marketplace Partners must establish industry-standard safeguards to protect customer data.

  • DAST Scan: Complete a Dynamic Application Security Testing (DAST) scan to confirm the solution is free of OWASP Top 10 vulnerabilities. You must remediate any critical or high-priority items prior to listing your app.
  • App Server Configuration: Disable caching on SSL pages, enforce HTTPS, disable TRACE and other unused HTTP methods, and ensure all OS and web-server security patches are up to date.
  • Cookie Security: Ensure all App session cookies are set to Secure and HTTPOnly.

4. Live Demonstration

Section titled “4. Live Demonstration”

The final step is a live, recorded demonstration of your application with a Trimble representative. You must be prepared to prove:

  • Application Functionality: A live demo verifying that features are delivered as described in your scope documentation.
  • Production Readiness: Confirmation that end-to-end testing is complete and the application is ready to deploy.
  • API & Data Management: Demonstration of proper API rate limit handling, error resilience, and secure storage of credentials.
  • AI Vetting: If your product uses AI, you must prepare for an additional 20-minute vetting section during your demo to cover base models, drift prevention, and privacy DPAs/consent.