Screens, data or workflow inside ServiceNow: build a scoped Store app

• Your users work inside ServiceNow and need your screens, lists or workspace.
• You store your own records in ServiceNow.
• You automate work across ServiceNow processes.

• Custom tables. ServiceNow’s Custom Table Guide (October 2025) says paid partner-built apps “transacted on the ServiceNow Store with a contract value greater than zero dollars ($0), do not consume Custom Tables”, and that free apps of type Integration “are exempted from the Custom Table count”. Other free apps need App Engine entitlement, and either exemption ends once the app “is expanded with the creation of additional Custom Tables”.
• If your app reads or writes a licensed product’s tables, such as ITSM, CSM or HR, the customer needs that product. In the customer’s instance, Application Manager can show your app as “Not Licensed”; ServiceNow lists “A required dependency is not licensed” among the possible causes.

• Build Program membership and your vendor instances. ServiceNow’s KB0794197 says “every partner receives two vendor instances”, initially provisioned on the release family “two releases prior to the current release (N-2)”.
• Your vendor prefix, and a scope name you’ll keep for the life of the app.

Certification reviews your documents as well as your app, and in our experience it’s the part most teams miss. ServiceNow’s certification guide says “Certification has two tracks”: an app review and a listing review.

• For the app review, ServiceNow asks for a “Design Document (for certification team only)”, a “Test Plan with results (for certification team only)” and an “Installation Guide (customer facing)”. Write the design document and test plan on ServiceNow’s templates; it provides a recommended template for the installation guide too.
• For the listing review, your Store listing “consists of marketing documentation, demo videos, and other resources”, and the team inspects it for “Accuracy” and “Adherence to branding guidelines”.

ServiceNow lists “How well you documented your architecture in your Design Documentation” among the things that decide how long certification takes. The calendar gives the documents a week of their own.

Plan on roughly 7–11 weeks from the start of design to a Store listing.

Not in ServiceNow’s Build Program yet? Add admission first: in our experience it takes 2–6 weeks, because ServiceNow reviews each application.

Weeks for design, build, documents and any programme steps come from our own projects. The review range is ServiceNow’s: certification “typically requires 3-5 weeks”, and no service level is published.

• Security added late: missing ACLs, and client-callable script includes or UI pages without ACLs.
• Records created outside your scope, which don’t ship with the app.
• Deleting application files after the first version. ServiceNow says “Deletion entries are not packaged as part of app file”: set the file inactive, or mark it deprecated where there’s no active field. In our experience the certification team accepts a deletion if you commit to giving existing customers an update set that removes it; with no customers yet, you don’t need one.
• UI actions with no condition or role, and modules without roles.
• List layouts personalised while your app was selected, which get captured into it.

• Maintenance is a release certification for each family release: retest on the new release and submit a revised test plan. ServiceNow’s Upgrade Policy says it “generally releases two new release families per year”. Any change to the app is a recertification, planned as new work. Test on the releases customers actually run, not only yours.
• Platform behaviour changes under you. Australia, for example, turned the read-only checkbox into a four-option choice.

• Which roles the app adds, and what data those roles can see.
• Whether it writes anything outside its own scope.
• Whether it’s certified, and what that covers. Certification is strict on most security and performance issues, but it isn’t a full security audit, and the Store’s terms still leave use at the customer’s own risk. Have your own security answers ready.