Free Odoo
Security Assessment

01

Do you have a record of who changed what in Odoo, beyond the chatter on individual records?

Odoo tracks a chosen few fields per model in the chatter. It is not an audit trail, and it is editable by anyone who can delete a message.

02

Do you know exactly how many people hold administrator or Settings access today?

Administrator counts grow quietly. Access granted for one migration weekend is rarely taken back.

03

When something high-risk happens in Odoo, does someone find out without going looking?

A log nobody reads is a record for the post-mortem, not a control. The gap between an incident and someone noticing it is where the damage happens.

04

When someone leaves or stops using Odoo, is their access removed promptly?

A dormant account with live credentials is the cheapest way into a system, and nobody is watching it because nobody is using it.

05

Is two-factor authentication in force for your administrators, at least?

Administrator access to an ERP is access to payroll, pricing, banking details and the customer list. A password alone is a thin defence for that.

06

If a supplier's bank account number changed today, would you see who changed it and what the previous value was?

Invoice redirection fraud is a field edit, not a break-in. It looks exactly like ordinary work, which is why it succeeds.

07

Would you know if someone exported several thousand customer records last week?

Exports leave almost no trace in a standard Odoo. The data leaves as a spreadsheet and the system carries on as though nothing happened.

08

Do you have a record of deletions of critical records?

A deleted record takes its own history with it. Whatever it was, whoever changed it and when — all gone in the same click.

09

Are changes to user permissions recorded, with who granted them?

Almost every serious internal incident is preceded by a permission change. It is the step that makes the rest of it possible.

10

Do you monitor repeated failed login attempts?

A burst of failures against one account is the loudest signal a system produces, and the one most often unheard.

11

Would you spot an account that was created but never used?

An account nobody has ever signed into is either an oversight or someone else’s way in. Both are worth ten minutes.

12

Would you notice a sign-in from an unfamiliar location or IP address?

Not every unfamiliar address is an attack — most are a new laptop or a holiday. The point is being able to tell the difference.