Odoo Documents and Sign are excellent at moving files through your business, but they are weak at answering the auditor's question: who did what, to which document, and when. The mail thread on a documents.document captures some field changes and messages, but it does not give you a single, queryable log of downloads, share-link access, folder moves, lock/unlock events, split operations, or the lifecycle of an e-signature request. When a compliance officer needs to prove a controlled document was never altered after approval — or find every user who downloaded a confidential contract — they end up stitching evidence together from mail.message, mail.tracking.value, server logs and the Sign module by hand. Odoo native simply was not built to be your document forensics system.

This module gives Documents a dedicated, immutable audit backbone. We add a document.audit.log model (models.Model) that captures a normalized event stream — event_type (create, write, share, lock, split, download, esign_sent, esign_signed, esign_declined), user_id, document_id, timestamp, source IP where available, and a JSON payload of changed values. Events are captured close to the source: write()/create() overrides and targeted hooks on documents.document, controller-level capture for actual file downloads and share-link hits (not just button clicks), and listeners on sign.request/sign.request.item so every signature field event is tracked with the signer and status. Records are append-only and protected by ir.model.access.csv plus record rules so that even administrators write through the API rather than editing history in place, keeping the trail defensible.

On top of that stream sits an OWL/QWeb dashboard: activity by user, by document and by folder, with drill-down into any single document's full timeline. Filters and group-bys let compliance officers slice by date range, event type, user or workspace, and every view is exportable — CSV/XLSX for spreadsheets and a branded QWeb PDF audit report for evidence packs. Because the log is a normal Odoo model, it is fully reachable over the XML-RPC/JSON-RPC API, so your GRC tooling or SIEM can pull events on a schedule. Finally, Odoo base.automation automated actions turn the log into a control system: a download of a restricted document can raise a mail.activity follow-up, an out-of-policy edit can open a helpdesk ticket or notify a reviewer, and an unsigned request past its deadline can escalate — all configured, not coded, once we wire the triggers.

Because this is build-to-order, you are not downloading a fixed package and hoping it fits. After a short scoping call we confirm exactly which events matter to you, which folders/document types are in scope, your retention rules, and which follow-up workflows to automate. We then build the module against your Odoo edition and version (17.0, 18.0 or 19.0; Community or Enterprise — noting that Documents and Sign are Enterprise apps), test it on a staging copy of your database, run UAT with your team, and deploy with a rollback plan. Typical delivery is one working week from confirmed scope. You receive the full source, the git repository, documentation and training, plus a post-go-live support window.