When an auditor, a regulator, or your own finance lead asks "who changed this price, this bank account, or this posted journal entry — and when?", most Odoo databases cannot answer with confidence. Odoo core stamps create_uid/write_uid and write_date on every record, and the chatter (mail.thread + mail.tracking.value) logs tracked-field changes on models where a developer has explicitly set tracking=True. But that native surface is shallow: it does not span every model, it does not capture old-versus-new values for untracked fields, it never records the source IP or session, deletions vanish without a trace, and there is no unified, exportable log you can hand to a SOX, ISO 27001, GDPR, or industry-specific audit. Teams that run Odoo hit this wall the moment internal controls, compliance, or a dispute demand a defensible record of activity.

This is a made-to-order module that ECOSIRE builds against your exact database and control requirements — it is not an existing apps.odoo.com download you install blindly. We build a configurable audit engine that hooks the ORM create, write, and unlink methods (through targeted models.Model method overrides and/or ir.actions.server automated actions) on the models and fields you choose, and writes an immutable ecosire.audit.log entry for each event. Every record captures the model and record id, the changed field, the old and new values (JSON-serialized, human-readable in the log view), the acting user, a UTC timestamp, and the source IP and session derived from the request context. A rule engine (ecosire.audit.rule) lets an administrator turn logging on per model, per field, or per operation without touching code, so you audit account.move line changes and res.partner bank details tightly while leaving noisy operational models alone.

Technically, the log is designed to be tamper-evident and read-only to end users: write/unlink on ecosire.audit.log is blocked for everyone below a dedicated "Audit Manager" group via ir.model.access.csv plus record rules, so even administrators leave a trace. We ship a filtered, grouped log view (list, form, and search facets by user, model, date, and operation) built in XML/OWL, an optional QWeb PDF "audit statement" for a given record or date range, and a retention/archival job (ir.cron) that rolls old entries to a compressed archive so the table never bloats your production database. Because the entire feature is exposed through standard models, your compliance team can also pull the log programmatically over the XML-RPC/JSON-RPC API into a SIEM or GRC platform. We build for Community or Enterprise on Odoo 17.0, 18.0, or 19.0, and account for Enterprise-only surfaces (studio-created fields, documents, sign) during scoping so nothing you rely on is left un-audited.

Delivery is build-to-order: we start with a scoping call to confirm which models, fields, and operations must be tracked, your retention and compliance targets, and any SIEM/export destination; we then build on a staging copy of your database, run UAT with your team, and deploy behind a rollback plan. Typical delivery is one working week from confirmed scope. Pricing starts from $999 (indicative, single-company base scope covering a defined set of models and the standard log view); broader model/field coverage, multi-company consolidation, SIEM/GRC integration, and localization or regulatory-report depth increase the quoted scope. You receive a fixed quote after the scoping call — never a surprise.