Implementing Odoo is a significant investment for any business. While choosing the right implementation partner is important, ensuring that your company retains ownership and control of its Odoo environment is even more critical.

Many organisations focus on functionality, timelines and cost during the implementation phase, only to encounter problems later when they need to change implementation partners, migrate to another hosting provider or recover from an unexpected situation. In some cases, businesses discover they do not own their source code, cannot access their server, or are unable to download their own database backups.

This guide outlines the essential Do's, Don'ts and security precautions every business should follow before, during and after an Odoo implementation to protect its data, infrastructure and intellectual property.

Your Odoo subscription is one of your most valuable business assets. It should always remain under your company's control.

Do

• Purchase the Odoo Enterprise subscription using your company's email address.

• Ensure your company is the owner of the Odoo subscription.

• Keep access to the Odoo Customer Portal.

• Store subscription information securely.

• Keep licence renewal reminders under your company's control.

Don't

• Don't purchase licences using an agency's email address.

• Don't rely on an implementation partner to permanently manage your subscription.

• Don't allow only one person outside your organisation to control licence renewals.

If you are using Odoo.sh, ensure your company has complete administrative control over the project.

Do

• Purchase Odoo.sh using your company's Odoo subscription.

• Ensure your company is the owner of the Odoo.sh project.

• Maintain at least two trusted company administrators.

• Verify that your administrators can:

  • Access the Odoo.sh dashboard.

  • Create and manage projects.

  • Manage Git repositories and branches.

  • Deploy builds.

  • Restore and download backups.

  • Manage staging and production environments.

  • Add or remove users.

• Regularly review who has administrator access.

Don't

• Don't rely solely on an implementation partner's Odoo account.

• Don't allow the agency to be the only administrator.

• Don't assume you can access backups or deployments if the agency owns the project.

Why This Matters

Without administrator access to Odoo.sh, your business may lose control over:

• Production environment

• Staging environment

• Database backups

• Filestore backups

• Deployment history

• Git repository integration

• Build logs

• User management

Always ensure your company is the primary administrator of every Odoo.sh project.

Whether you host Odoo on-premise or in the cloud, your infrastructure should always belong to your organisation.

Do

• Host production using a company-owned cloud account.

• Use providers such as AWS, Azure, Google Cloud, DigitalOcean, Hetzner or OVH.

• Grant agencies temporary access only when required.

Don't

• Don't let production servers run permanently under an agency's cloud account.

• Don't allow agencies to keep exclusive control of hosting credentials.

Every custom module developed specifically for your business should belong to your organisation once payment has been completed.

Do

• Maintain all custom code in a company-owned Git repository.

• Use GitHub, GitLab or Bitbucket owned by your organisation.

• Require agencies to commit code regularly.

• Maintain documentation for every custom module.

Don't

• Don't allow customisations to exist only on the production server.

• Don't accept projects where source code is withheld.

• Don't depend on developers who refuse to use version control.

A Git repository is often more valuable than the server itself because it contains the complete development history.

Do

Ensure your company has:

• Repository ownership

• Administrator access

• Ability to add and remove developers

• Access to branches

• Access to tags

• Access to release history

Grant only the permissions required for each role.

Best Practice

 Create separate accounts for each developer.

Avoid sharing:

    • Root password

    • Master administrator account

    • SSH private keys

Use:

    • Individual SSH keys

    • Individual user accounts

    • Role-based permissions

Remove access immediately after project completion.

Every developer should have an individual Odoo account.

Avoid:

• Shared Administrator accounts

• Shared passwords

This provides:

• Better auditing

• Better accountability

• Easier access management

Your database contains your entire business.

Back up regularly:

• PostgreSQL database

• Filestore

• Custom modules

• Configuration files

Store backups securely outside the production server.

A database backup may contain:

• Customer information

• Vendor information

• Employee records

• Payroll

• Accounting

• Sales history

• Purchase history

• Manufacturing data

• Product costs

• Attachments

• Internal discussions

• API credentials

• SMTP configuration

• Third-party integration settings

Treat every database backup as confidential business information.

If an implementation partner requires a copy of your database for troubleshooting or development, take appropriate precautions.

Recommended Steps

Remove or Mask Sensitive Information

Where possible, anonymise:

• Customer details

• Employee salaries

• Bank accounts

• Payment information

• Personal information

Disable Outgoing Emails

Prevent accidental emails being sent to real users.

Disable:

• SMTP server

• Marketing automation

• Scheduled email actions

Disable Payment Gateways

Place payment providers into sandbox mode or disable them completely.

Examples include:

• Stripe

• PayPal

• Razorpay

• Authorize.Net

Disable SMS and Messaging Integrations

Temporarily disable:

• WhatsApp

• SMS gateways

• Push notifications

Disable External API Integrations

Examples include:

• Shipping providers

• CRM integrations

• ERP integrations

• Accounting integrations

• Marketplace integrations

Request complete documentation covering:

• Installation

• Deployment

• Server configuration

• Odoo configuration

• Custom modules

• APIs

• Scheduled actions

• Integrations

• Backup procedures

• Disaster recovery

Documentation makes future maintenance much easier.

Maintain separate environments for:

• Development

• Testing

• User Acceptance Testing (UAT)

• Production

Never allow development directly on the production database.

Enable:

• Firewall

• HTTPS

• SSL certificates

• SSH key authentication

• Automatic security updates

• Server monitoring

• Fail2Ban (or equivalent intrusion prevention)

Disable:

• Root SSH login

• Password-based SSH authentication (where practical)

• Unused network ports

Before work begins, ensure there is a written agreement covering:

• Scope of work

• Payment milestones

• Intellectual property ownership

• Source code ownership

• Confidentiality (NDA)

• Warranty period

• Support terms

• Exit process

• Handover requirements

Ask your implementation partner to follow recognised development practices.

This includes:

• Clean coding standards

• Proper documentation

• Automated testing where appropriate

• Version control

• Peer reviews

• Modular architecture

Avoid creating a situation where only one developer understands your system.

Ensure:

• Documentation exists.

• Multiple people understand deployments.

• Multiple administrators have access.

• Source code is regularly reviewed.

Before concluding the project, verify that your organisation has received:

• Complete source code

• Latest Git repository

• Database backup

• Filestore backup

• Configuration files

• Server credentials

• Cloud account ownership

• Domain ownership

• DNS access

• SSL certificates

• Odoo subscription ownership

• Odoo.sh administrator access (if applicable)

• Technical documentation

• Deployment guide

• Custom module documentation

• Integration documentation

• API documentation

• List of installed modules

• Removal of unnecessary agency accounts

• Updated passwords where appropriate

Many businesses unknowingly create long-term risks by:

Avoiding these mistakes can save significant time, cost and disruption in the future.

An Odoo implementation is not just a software project—it is the foundation of your business operations. Protecting your licences, infrastructure, source code and business data should be considered a core part of every implementation.

Whether you work with an Odoo Partner, a freelancer or an in-house team, always ensure that your company remains the legal owner and primary administrator of your Odoo subscription, Odoo.sh projects, cloud infrastructure, Git repositories and production environments.

By following the practices outlined in this guide, you can reduce security risks, simplify future upgrades, make it easier to change implementation partners when necessary, and ensure your organisation retains full control over its Odoo investment for years to come.