Every released version, what changed in it, and the date it went out. This page is generated from the module’s own changelog, which is the same file shipped inside security_audit_center and rendered on its Odoo Apps Store listing.
Launch price: $79 to $59. The catalogue has no reviews yet, and an unknown vendor's price is the first objection a buyer has to get past. This is a deliberate, reversible move to buy the first sales and the first reviews, not a permanent valuation of the module. It is reviewed once there are five reviews across the catalogue, or at the end of 2026, whichever comes first.
18.0.1.0.4
Notes
Documentation. No functional code change.
Changed
The customer documentation now ships inside the module. Eleven documents moved from the repository root into security_audit_center/docs/, which is where the Odoo Apps Store reads them and where a buyer who downloads the module finds them.
Ten commercial papers were deliberately left at the repository root — pricing, the invoice template and the seller worksheet among them. They are ours, not the buyer's, and packaging them into a paid download would hand every customer our margin arithmetic.
18.0.1.0.3
Notes
Second accuracy fix from the same audit. No functional code change.
Fixed
Store panel 04 overstated the export-fidelity test. It read "there is an automated test asserting the exported bytes are byte-for-byte unchanged". test_export_content_is_not_altered_by_monitoring drives a real CSV export through Odoo's own endpoint and asserts the response is a 200 and that the exported content comes back intact — it does not diff the bytes against an unmonitored baseline. The panel now says what the test actually does, and states the structural reason the export cannot be altered: the wrapper returns Odoo's own response object untouched and records afterwards.
The stronger claim was not needed. "We hand back Odoo's response object unmodified" is a better argument than a byte comparison, and it is true.
18.0.1.0.2
Notes
Accuracy release. No functional code change — the correction is to what the product says about itself.
Fixed
The published security statement was wrong about session storage. It read "raw session identifiers are never stored; only a salted, non-reversible digest". The module does store a raw identifier: session_identifier holds sid[:42], restricted to Security Administrators, because session_store.delete_from_identifiers() is the only way to revoke a session and it accepts nothing else. The digest claim was true of session_hash and was wrongly extended to cover both columns.
The copy now says what is actually true and why it is safe: the session cookie is never stored, and the stored identifier is half of an 84-character key that is_valid_key() rejects on its own, so it cannot sign anyone in. It is the same value Odoo core keeps in res.device.log.
Corrected in the description page, store panel 07 (re-rendered), the store listing copy, the README, ARCHITECTURE.md and SECURITY.md. No code changed: the implementation was already correct and already group-restricted — only the sentence describing it was false.
SECURITY.md quoted 15 of the 19 names in NEVER_LOG_VALUE_FIELDS, omitting confirm_password, apikey and secret_key. Now quoted in full. Redaction behaviour was always correct.
Added
docs/CLAIM_VALIDATION.md — every published claim checked against the shipped code, with the evidence for each. This is how the two items above were found.
18.0.1.0.1
Notes
Commercial listing release. No functional code change — the only edit to the module's Python, views, data and tests is the copyright header line, which now reads TechnoVision. Verified with git diff v18.0.1.0.0 v18.0.1.0.1 -- security_audit_center: 84 files, one line each, all of them that header.
Changed
Positioning
Repositioned from "another audit log" to an Odoo Security & Risk Monitoring Center, led by the four differentiators: Security Score, sensitive data monitoring, export risk detection and security alerts.
Manifest summary rewritten to carry the positioning, since the module name is what appears in the customer's own Apps list after purchase and is kept short deliberately.
Manifest description rewritten to match.
Store assets
Eight new store panels (01_security_dashboard.png … 08_configuration.png), 1600 px wide, built from assets/store/*.part.html in the TechnoVision palette.
Icon and banner rebuilt in the TechnoVision palette (navy / blue / light blue), replacing the previous teal accent.
The three unretouched Odoo screenshots are kept, renamed ui_01_dashboard.png, ui_02_charts.png and ui_03_score.png, and labelled as such on the description page so designed panels and real captures are never confused.
images in the manifest now lists the banner plus all eight panels.
Description page
Rebuilt static/description/index.html: hero, four differentiators, the eight feature sections in commercial order, a capability comparison, a "who is this for?" section, a trust section, a security and privacy statement, compatibility, the honest-limitations list, a fifteen-question FAQ, and a closing CTA.
Score example updated from 82 (Good) to 72 (Needs Attention), matching the product's own score bands rather than an illustrative number.
Added
docs/COMPATIBILITY.md — what has actually been verified per Odoo series, and the exact port checklist for 19.0 and 17.0. No series is claimed before it has been installed and tested on a clean database.
docs/ROADMAP_TAMPER_EVIDENT.md — design and threat model for a hash-chained, HMAC-verified audit trail. Deliberately not in this release.
docs/DEMO_VIDEO_SCRIPT.md — 95-second demo script and scene list.
assets/store/ — the HTML sources and build.py that render every store asset, so they can be rebuilt rather than redrawn.
assets/port/to_17.py — the mechanical <list> → <tree> conversion an Odoo 17 branch would need, with a --check dry run.
18.0.1.0.0
Notes
First public release. Targets Odoo 18.0, Community and Enterprise.
Added
Security Score engine
Score from 0 to 100 with five status bands, always traceable to the rules and measurements that produced it.
Twelve configurable checks: administrator count, dormant accounts, never-used accounts, two-factor coverage, unresolved high/critical alerts, sensitive changes, large exports, critical deletions, access-right changes, new-IP sign-ins, and whether anything is monitored at all.
Per-rule weight, threshold, look-back window and severity.
Daily snapshots with the full finding list, powering a 30-day trend.
PDF Security Summary report.
Activity auditing
Opt-in create/write/unlink capture per model, with per-operation severity.
Field-level old and new values, or change-only recording with no content.
Deletion capture that preserves the record's identity before it vanishes.
Bulk circuit breaker: past a configurable limit, one summary event replaces per-record events, and the truncation is itself recorded.
Sensitive field monitoring
Any field of any model can be registered as sensitive; registering it starts monitoring immediately, with no separate audit rule needed.
Four masking policies: none, partial, full, and irreversible fingerprint.
Optional unmasked column restricted to Security Administrators by Odoo group, enforced on read, search, export and the external API.
Credential-bearing fields are redacted unconditionally, whatever the policy.
Export monitoring
Every CSV and Excel export through Odoo's standard endpoints, with record count, field list, format, filter and origin.
Configurable medium / high / critical thresholds.
Strictly observational: never blocks, alters or delays an export.
Sessions, devices and logins
Successful and failed sign-ins, including attempts on non-existent accounts, with categorised failure reasons and no credential material.
Browser, operating system and device class from a dependency-free parser.
New-IP and new-device detection against the user's own history.
Brute-force correlation per address and per account.
Session termination through Odoo's own session store, itself audited.
Activity reconciled from Odoo's res.device.log by a scheduled action, so the module adds nothing to the cost of an HTTP request.
Access-right monitoring
Group grants and revocations, account activation, company access, password changes — recorded as plain sentences rather than field diffs.
Changes to the definition of access: model ACLs, record rules, group inheritance.
Runs independently of audit rules; on by default.
Alerting
Eleven detections with configurable severity, threshold, time window, cooldown and recipients.
Triage workflow (New → Acknowledged → Investigating → Resolved / Ignored) with chatter, assignment and investigation notes.
Role-gated: Analysts triage, Managers close.
Odoo inbox and optional email through your own mail server.
Dashboard
Security Score gauge, top risks in business language, twelve clickable KPI tiles, activity trend, risk distribution, most active users, most affected records, score trend, recent events.
Dependency-free inline SVG charts; follows the active Odoo theme including dark mode; responsive.
Configuration
Six-step first-run wizard with safe, explained defaults.
Exclusions by user, model, field and IP/CIDR range.
Retention horizons per data type, enforced in bounded batches.
Full settings panel under the Odoo settings app.
Security model
Five roles: Viewer, Analyst, Manager, Administrator, and an orthogonal Global Officer flag for cross-company visibility.
Record rules on every log model, so multi-company isolation holds through the API and exports.
Immutable audit trail: writes rejected for every role.
Reporting
List, form, pivot and graph views throughout, with date, severity, user, model, action, IP, company and status filters, and group-by on all of them.
Six report entry points plus a printable Security Summary.
Technical notes
Extends Odoo's base abstract model rather than patching core functions — the same mechanism web, website, sms and base_sparse_field use.
No eval, no raw SQL, no new HTTP routes, no external Python dependencies, no outbound connections.
Configuration cached per registry with automatic invalidation; the guard on a non-audited model costs about 20 µs per ORM call.
Verified
176 automated tests, 0 failures, on a freshly created Odoo 18.0 database.
Security review with 2 Medium and 3 Low findings, all fixed before release, all covered by regression tests. See SECURITY_REVIEW.md.
Performance measured with interleaved A/B sampling. See PERFORMANCE.md.
Known limitations
Documented rather than hidden — see the Known limitations section of the README. In summary: exports outside Odoo's standard endpoints are not captured; session revocation takes effect on a worker's next request; non-sensitive fields changed only by a stored compute are not captured; binary fields are not value-captured; the two-factor check needs Odoo's TOTP module; and proxy_mode is required for correct client addresses behind a proxy.
[18.0.1.1.0]
Scheduled email digest of the Security Score and open findings.
Log forwarding to an external collector (syslog / webhook), so the trail can live outside the database being audited.
Read auditing for a small, explicitly chosen set of models, where the cost is justified.
Per-user activity baselines, to flag behaviour that is unusual for that person rather than unusual in absolute terms.