How your Odoo server is secured, stated plainly.
This page lists what we actually do on the servers we build and run, and how the AI agent is kept on a short leash. Each item is part of the build or the way we work today. If you want to see any of it on your own server, ask and we show you.
Your accounts, your data
The first control is ownership. The accounts that hold your system are opened in your company's name, so you can see them, and remove us from them, without asking anyone.
| Part | Where it lives |
|---|---|
| Server | A Hetzner Cloud project in your company's name. You give us an API token for it and can delete it at any time. |
| Backups | A private Backblaze B2 bucket in your company's account, created with Backblaze's default encryption turned on. The key on your server can add and read backups but cannot delete them; old copies are removed by the bucket's own lifecycle rule. |
| Code | A git repository in your company's GitHub or GitLab account, with every custom module and every change committed. |
| Keys you send us | Sent through a one-time secure link on this site, encrypted as they arrive, and kept on our server readable by the administrator account only. They are not sent by email. |
The server
Every customer server is built by the same script, so these settings are the same on each one.
Access
- SSH with keys only. Password and keyboard-interactive logins are turned off.
- Two firewalls, Hetzner's cloud firewall and the server's own, let in only SSH, HTTP, HTTPS and ping.
- fail2ban blocks addresses that keep failing to log in over SSH.
- Odoo itself listens only on the server. The outside world reaches it through the web server, over HTTPS.
- The PostgreSQL database is not open to the network.
- Odoo's database manager pages are closed at the web server, and the database list is hidden.
Encryption and updates
- HTTPS with a certificate the web server obtains and renews automatically.
- Ubuntu security updates install automatically. Odoo updates within your major version are tried on a copy first and applied on a schedule you know about.
- Test copies of your database are neutralized before they start: outgoing mail servers, scheduled actions, payment providers and Odoo's in-app services are switched off. During the move, a test server's Odoo account cannot open any connection outside the server at all.
Monitoring and backups
Monitoring runs from our own server, outside your network. Your Odoo login page and its certificate are checked every 5 minutes. Every 15 minutes we check disk space, memory, load, the Odoo and database services, the last backup, pending security updates, failed outgoing email and late scheduled actions. A problem opens a ticket for us automatically.
Response times for those tickets are on the Managed Odoo description, including the optional 24/7 outage response.
Backups run nightly: a database dump and the filestore, copied to your Backblaze bucket. The database's transaction logs are archived to the same bucket as well, so it can be restored to a moment you choose within the last 29 days. A separate check on our server confirms each night that the backup arrived, and emails us when one is missing. Once a month we restore the latest backup onto a scratch server and tell you it worked.
The AI agent's access
The agent is fenced by software, not by instructions in a prompt. The tool below runs on our own Odoo today, and it is set up on your server before the agent is given any access to it. Under our contract (master services agreement, section 5.3), changes outside a short list of pre-approved routine actions need approval from a named person at Allodi, and so, always, does anything that deploys code, touches money, tax, user access or security settings, sends messages from your Odoo, or migrates or restores production. How it works shows the whole approval flow.
- It reads your database through a read-only PostgreSQL role. Password hashes and stored secrets are withheld from that role.
- A proposed data change runs first as a dry run that always rolls back and shows exactly what would change. It is applied only when a person approves the same change, and refused if the records changed in between.
- Through the agent's tool, changes to money, tax, security settings, modules and outgoing messages are refused by the software itself.
- Each access key has only the permissions its holder needs, and every call is written to an audit log against a named person.
- Changes appear in Odoo under a named user, so the record's history shows who made them.
- Ask and we send you the log as a file at any time.
What the agent sees, and which providers process it, is set out in the privacy and data processing note, together with how we tell you about a security incident.
Questions from your IT or security team?
Send them over. We answer them directly, usually within one business day.
- Plans, add-ons and hourly rates are published; larger projects are quoted up front, and the project fees in the free scan's quote are binding for what the scan counts.
- On a move, the start milestone is refunded if your database cannot run on the new server, unless the cause is on your side or a third party refuses to release your data (conditions).
- Managed Odoo is month to month: thirty days' notice, no minimum term.
- Your server, code, backups and credentials are in your company's name.
Or call us: +1 515-644-1400, any time. How to start.