Key Takeaways
- Odoo security operates on multiple layers: authentication, group-based access, record rules, and field-level controls
- Access rights (ir.model.access) control CRUD operations per model per user group
- Record rules filter which specific records within a model each user can see and modify
- Two-factor authentication and IP restrictions add essential protection for sensitive data access
- Audit user group assignments quarterly and revoke terminated employee access immediately
Odoo's Multi-Layer Security Model
Odoo security operates on multiple levels that work together to provide comprehensive data protection. Understanding each layer helps you configure the right balance between security and usability.
| Layer | Mechanism | Scope | Managed By |
|---|---|---|---|
| Authentication | Login credentials + 2FA | System access | Admin |
| Group Access | User groups per module | Module features | Admin |
| Model Access (ACL) | CRUD per model per group | Data operations | Developer |
| Record Rules | Domain filters per group | Record visibility | Developer |
| Field Access | Field-level read/write | Sensitive fields | Developer |
| IP Restriction | Network-level filtering | Connection source | Sysadmin |
Default Odoo installations are permissive. Always review and tighten security groups after installation, especially for accounting, HR, and admin-level access.
User Groups and Access Rights
User groups define functional access within each module. Each module provides default groups (User, Manager, Administrator) that grant progressively more access. Assign users to the minimum groups needed for their responsibilities.
- Access rights (ir.model.access): Define CRUD permissions per model per group
- Implied groups: Groups that automatically include permissions from other groups
- Technical groups: Hidden groups for advanced features like analytic accounting or multi-currency
- Custom groups: Create additional groups when default roles don't match your organizational structure
- Multi-company groups: Control which companies each user can access and switch between
Record rules (ir.rule) filter which records a user can access within a model. For example, salespeople see only their own leads, while sales managers see all team leads. Record rules combine with access rights for fine-grained control.
Field-Level Security and Authentication
Field-level access controls visibility and editability of specific fields. Mark sensitive information (salary, cost prices, margins, personal data) as accessible only to authorized groups to prevent information leakage.
- Enforce minimum password length and complexity requirements for all users
- Enable two-factor authentication (2FA) for administrative and financial users
- Configure session timeout to auto-logout inactive users after a defined period
- Restrict access by IP range for on-premise security or require VPN for remote access
- Use HTTPS exclusively and configure SSL certificates for encrypted communications
Enable 2FA for all users who access financial data, HR records, or administrative settings. The minor inconvenience of 2FA is negligible compared to the risk of unauthorized access.
Audit Logging and Security Reviews
Audit logging tracks who changed what and when. The tracking feature on sensitive fields records value changes with user and timestamp, providing the documentation needed for compliance and troubleshooting.
| Security Task | Frequency | Responsible | Action |
|---|---|---|---|
| User access review | Quarterly | IT Admin | Verify group assignments match current roles |
| Terminated employee audit | On departure | HR + IT | Revoke all access immediately |
| Record rules review | After reorgs | Developer | Update rules for new team structures |
| Password policy check | Semi-annually | IT Admin | Ensure compliance with policy |
| 2FA enrollment | Monthly | IT Admin | Follow up on non-enrolled users |
| Access log review | Monthly | Security | Check for unusual patterns |
Regular security reviews prevent access drift where users accumulate permissions over time as they change roles. Quarterly audits ensure that access rights reflect current responsibilities rather than historical assignments.
Frequently Asked Questions
Related services from Verbsz Technologies
If this article is relevant to a project on your roadmap, these are the services our team typically delivers.