Odoo security check: Your Odoo holds the whole business.Check who else can reach it.
Odoo projects are usually about configuration. We also run a cybersecurity practice, so we check your instance the way an attacker would and then fix what we find.
- Odoo-certified consultants
- NDA on request
- A reply within one business day
Partner · Certified consultantsWhere things usually stand
Your Odoo holds customers, prices, bank details, payroll and every invoice you've sent. Few systems in the business are worth more to someone who shouldn't have them.
Yet access rights grow by accident: a former employee still active, an admin account shared by three people, a third-party module nobody has read, a backup that has never been restored.
A review takes days. Finding out the hard way takes much longer.
What's included
Access-rights review
Every user, group and record rule checked against what each person's job needs.
User and role hygiene
Inactive, shared and over-privileged accounts found and closed, API keys listed and scoped.
Two-factor authentication and password policy
Two-factor sign-in enforced for admins and finance users at least, and a password policy that matches your risk.
Hosting hardening
For self-hosted Odoo or Odoo.sh: database manager exposure, HTTPS, proxy and worker settings, server patching and firewall rules.
Backups and a restore test
We confirm backups exist, are stored off the server, and actually restore into a working database.
Module risk review
Third-party and custom modules checked for unsafe code, outdated dependencies and rights they don't need.
Penetration test of the instance
Our cybersecurity team tests your Odoo from outside, and as a logged-in user, for the vulnerabilities a scanner misses.
Report and fixes
Findings ranked by business risk, with the fixes we can make for you and the ones your team can make itself.
How it runs
Timings are typical for a small or mid-sized rollout. Your written plan sets the real dates.
- 1
Scope and access
Day 1We agree what is tested, when, and through which accounts, and sign an NDA if you need one.
- 2
Configuration review
Days 2–3Users, groups, record rules, 2FA, password policy, API keys and installed modules.
- 3
Hosting and backup checks
Days 3–4Server and proxy settings, exposed services, backup location and a real restore test.
- 4
Penetration test
Days 4–8Manual testing of the instance, if included in your scope, on a schedule that avoids busy trading hours.
- 5
Report and walkthrough
A written report and a call with the people who did the work.
- 6
Fix and retest
We fix what you ask us to, then retest those items so the report reflects reality.
What it costs
Odoo Security Check
from$750
What the starting price covers
Access-rights and user review, 2FA and password policy, backup restore test, module risk review and a written report. A full penetration test is quoted separately.
Founding-client price in US dollars. The free assessment ends in a fixed written quote; Odoo licences, where you need them, are paid to Odoo separately.
Odoo security check: questions
What does an Odoo security audit cost?
The Odoo Security Check starts at $750 and covers the configuration, access, backup and module review with a written report. A penetration test of the instance by our cybersecurity team is quoted on top, usually between $1,500 and $4,000 depending on how much is exposed, such as a customer portal, eCommerce or a public API. Fixes are quoted after you've read the report.
Is Odoo Online secure, or do we still need this?
Odoo runs the servers, patching and backups for Odoo Online, and does it well. What Odoo can't see is how your own company uses it: who has admin rights, which former staff are still active, whether 2FA is on and what each user can export. That part is yours, and it's where most real incidents start. On Odoo Online the check focuses there; hosting checks apply to Odoo.sh and self-hosted servers.
Do you host Odoo for us?
No. We don't sell hosting. You stay on Odoo Online, Odoo.sh or your own server, and we review and harden what you have. That keeps our advice independent of a hosting margin.
Will the penetration test disrupt our business?
We agree test windows in advance, avoid destructive tests on production, and can test a staging copy for anything risky. If we find something severe during testing, we tell you the same day rather than waiting for the report.
Can you review third-party modules from the Odoo App Store?
Yes, and it's often where the risk sits. Many App Store modules are written well, but some add public routes, skip access checks or bundle outdated libraries. We read the code of each module you rely on and rate it.
We're self-hosting Odoo Community. What changes?
You carry the whole stack: operating system patches, PostgreSQL, the Odoo source, the proxy and backups. The check covers all of it, and we pay particular attention to the database manager page and the master password, which are common gaps on self-hosted servers.
Start with a free Odoo assessment.
Tell us how the business runs today. A consultant comes back with the apps you need, a realistic timeline and a starting price. No obligation.
- Free, and no obligation to go ahead
- A written scope and fixed quote before any work starts
- Odoo licences paid to Odoo directly, never marked up by us
