Security
What Customer Statements & Ageing can read and write, what it stores, and what leaves your instance.
Nothing leaves your instance
No external service, no API key, no outbound HTTP, no telemetry. The module adds no controller and opens no route. It does not email anybody: there is no dunning engine here, so installing it cannot start sending mail to your customers.
Record rules are respected, not bypassed
The Statements User group implies account.group_account_readonly rather than the module reaching for sudo() to read the ledger.
That is the security decision in this module worth stating. sudo() would have been simpler and would have made statements a neat way around multi-company rules: generate a statement for a partner in a company you cannot see, and read their invoices off the PDF.
Because the read happens as the user, somebody who cannot see another company's invoices cannot see them on a statement either.
Groups
| Group | Can |
|---|---|
| Statements User | Generate statements, flag disputes, print |
| Statements Manager | The above, plus exclusions and configuration |
Exclusion is a manager power on purpose: leaving a document off a customer's statement changes what you are telling them they owe.
Multi-company
A global record rule on every model — statements and their lines.
What is stored
Statements are snapshots: the lines as they were when generated, the balances, the ageing. They hold customer names, document references, dates and amounts — the same data as the invoices they derive from, and no more.
They are snapshots by design. A statement you sent last month should still say what you sent, not recompute itself against today's ledger.
The dispute flag crosses a module boundary safely
statement_excluded and the dispute flag live on account.move, where they belong. technovision_payment_reminders reads the dispute flag to stop chasing an invoice under query.
Neither module depends on the other and neither calls the other. The shared state is a field on the record they both already read, which is the only coupling that does not break when one is uninstalled.
What it does not protect against
- A user with Settings access, who can change group membership.
- Anyone who can already read the invoices. A statement shows what its reader was already entitled to see; it does not grant new access.
- Deletion of the module. Uninstalling removes statements and their lines. Invoices are untouched.