Odoo Security Package

Quoted on your environment

We put a fixed price on this after a few questions about your environment, not before. The licences are $199, bought from the Odoo Apps Store into your own account.

The problem

You cannot currently answer three questions about your own Odoo: who changed that record, who can reach it today once inherited groups are resolved, and who is stopped from deleting or exporting it. The modules answer them — once somebody has decided what counts as sensitive, agreed the restrictions, and read the result.

What you end up with

Sensitive-field monitoring configured against your actual data, an effective-permission review of your real groups, delete and export restrictions agreed per group and tested, and one written report of what the first scan found.

What is included

• Audit Log & Security Center, Access X-Ray and Restrict Delete & Export licences — bought into your own Odoo account
• Remote installation of all three on your instance
• Initial configuration, including retention
• Security-score setup with thresholds set against your own readings
• Sensitive-field configuration — chosen with you, not guessed
• Export monitoring switched on and verified
• An effective-permission review of your groups, including what inheritance quietly grants
• Delete, export and print restrictions agreed per group and tested against a real user account
• Administrator-access review, with the findings written down
• One management report of what the first scan found
• 30 days of support after handover

What this does not cover

• Penetration testing, or any assessment of your network or servers
• A compliance certification. This produces evidence; it does not certify you
• Remediation of what the review finds — we report it and quote separately
• Odoo upgrades, or fixing an instance that will not start

How it runs

1. 1Scoping call, 30 minutesWhat you run, who has access, what you are worried about.
2. 2Install and baselineThe module goes on, the first scan runs, and we read it before you do.
3. 3Configure against your dataSensitive fields, thresholds and retention, set from your readings rather than from defaults.
4. 4Administrator reviewWho can do what, resolved through inherited groups — and what we think should change.
5. 5Agree and test the restrictionsDelete, export and print limits set per group, then checked from a real user account rather than assumed.
6. 6Report and handoverOne written report, one walkthrough, and 30 days to come back with questions.

What we need from you

• Odoo 18.0, Community or Enterprise
• An administrator account for the duration, or a screen-share session
• Someone who can say which fields are commercially sensitive, and who should be restricted
• A test user account per affected group, so restrictions are verified rather than assumed
• Agreement on who receives the report

How we both know it is finished

• A change to a field you nominated as sensitive appears in the audit log with the old and the new value.
• An export from a monitored model appears in the export log with the user and the row count.
• The security score renders with its findings, and you can say what each finding means.
• An alert rule you chose fires on a test event and reaches the right person.
• You have a written note of what is and is not being watched, so a gap is a decision rather than a surprise.

What you do while it runs

Separate from the list above, which is what you supply before it starts. A missing prerequisite stops the work beginning; a missing one of these stalls it halfway, which is the one that turns a fixed price into an argument.

• Decide which models and fields count as sensitive — we advise, you own the answer.
• Name who receives alerts, and confirm they can act on them.
• Give us a staging or test database first where one exists; we do not make the first configuration change in production.
• Accept that monitoring records new activity from the moment it is switched on — it cannot recover history from before.

The licences

You buy these from the Odoo Apps Store into your own account, so you own them outright and keep them whatever happens to this engagement.

Questions