Most ERP security incidents are invisible until it is too late. Odoo core keeps only a thin trail of who touched what: res.users has login_date, mail.thread chatter records some field changes on tracked models, and the server log can hold auth lines if you configure it — but there is no unified, in-database record of failed login attempts, the IP and device behind each session, or which user read (not just wrote) a sensitive res.partner, account.move, or hr.payslip. When an auditor asks "who accessed this customer's data on March 3rd, and from where?", the honest answer with a stock database is usually "we can't tell you." That gap fails SOC 2, ISO 27001, GDPR/HIPAA access-log requirements, and internal segregation-of-duties reviews.

We build a dedicated audit module that closes that gap. At its core is a custom model (ecosire.audit.log) written on every relevant event, plus a lightweight ecosire.login.attempt model. Authentication events are captured by overriding res.users._check_credentials / the auth entry points so both successful logins and failed attempts are recorded with timestamp, resolved IP (from the HTTP request/X-Forwarded-For), user agent, and session id — failed attempts are logged even when no user session is created, which core cannot do. Record-level activity is captured by extending the ORM (create, write, unlink, and optionally read) on the specific models you nominate during scoping, so we log high-value objects without drowning the database in noise. Every entry is immutable to end users and enforced through ir.model.access.csv plus record rules that restrict visibility to a dedicated Audit Manager group.

On top of the log we build the analytics and controls your compliance team actually uses: a per-user activity dashboard (OWL/JS views over read-only server data), filtered and grouped list/pivot views, and QWeb PDF reports for period access reviews you can hand to an auditor. Suspicious-activity detection runs as Odoo automated actions / scheduled ir.cron jobs — configurable rules such as N failed logins in M minutes, login from a new IP or outside business hours, or bulk export/read of a protected model — that raise an in-app activity, send an email, or flag the session. Everything is reachable over the standard XML-RPC/JSON-RPC API, so a SIEM or external monitoring stack can pull the audit stream on a schedule.

Because this is build-to-order, you are not downloading a generic binary and hoping it fits. After a short scoping call we confirm exactly which models are audited, your retention and alerting rules, and your Community vs Enterprise baseline (the module targets Odoo 17.0/18.0/19.0; Enterprise-only hooks are used only if you run Enterprise). We build against your version, test on a staging clone, run UAT with you, then install on production with a rollback plan. Typical delivery is one working week from confirmed scope, and you receive the full source and git repository so nothing is locked behind us.