The 12 best Odoo security and access-control apps
Ranked on how much of the access-control surface each app actually covers, how cleanly it survives an Odoo upgrade, and how quickly an administrator can configure it without writing XML.
Built by Terabits
1
All In One Access Management
by Terabits Technolab
Our complete access package rather than a separate engine. It installs Simplify Access Management, Advance Access Management and Simplify Group Access together, so you get every restriction below, conditional rules and group-based rules in one purchase, plus a free module to export your rules from staging and import them into production. The price also includes free installation and our team setting up the access rights to fit your requirements, with lifelong free support for configuring rules.
- Includes Simplify Access Management, the base restriction engine
- Includes Advance Access Management, conditional and soft-restrict rules
- Includes Simplify Group Access, rules assigned to groups
- Free rule import and export between staging and production
- Hide or make read-only fields, menus, buttons, tabs, reports and views
- Rules per user, per group and per company
- Free installation and done-for-you access rule setup
- Lifelong free support for configuring rules
Built by Terabits
2
Advance Access Management
by Terabits Technolab
The step up from basic restriction, installed on top of Simplify Access Management. It makes access depend on conditions: filter what a user can pick in any dropdown field, hide buttons, tabs and kanban links only when a condition is met, and use Soft Restrict to limit data in one module without breaking related models. It also removes the create, create-and-edit and external-link options from relational fields, and can hide the whole search panel.
- Field conditional access, filter dropdown options by attribute or domain
- Remove create, create-and-edit and external links from any relational field
- Soft Restrict: domain rules for one module without affecting related models
- Rules applied on specific relational fields and hierarchy access
- Button, tab and kanban link conditional access
- Hide the search panel, custom filters and custom group-by
- Hide view-wise buttons from the model access tab
- Global access rights and default portal user
- Default internal link setting
- Multi-user and multi-company, six languages included
- Requires Simplify Access Management
Built by Terabits
3
Simplify Access Management
by Terabits Technolab
The most widely installed app in our security range and the base the others build on. From one place it sets hide, unhide and read-only rights on fields, models, menus, records, filters, groups, buttons, tabs, views, actions, reports and chatter, for any module, user or company, with no technical setup. It also closes gaps core Odoo leaves open: it can disable developer mode, block import and export, stop a user logging in, and block XML-RPC scripts.
- Hide menus and sub-menus per user
- Model rights: create, edit, delete, archive, duplicate, export and import per model
- Hide reports, actions, views and the spreadsheet button
- Make any field invisible, read-only or required
- Hide buttons, tabs, filters and group-by
- Chatter rights: hide send message, log notes and activities
- Read-only user mode
- Disable developer mode and block module install or update
- Hide import and export, and restrict exported fields
- Disable login and block XML-RPC and scripts
- Company-wise restrictions
- Domain access rights
- Multi-user and multi-company, six languages included
4
A
Access Manager Ninja
by Ksolves India Ltd.
A well-established alternative from Ksolves, the publisher of Dashboard Ninja. Rules are grouped into profiles that you assign to users, and profiles can be switched on or blocked for a set period, which suits temporary staff. Beyond the usual menu, field, button and model restrictions it adds password expiration, control over admin login access and a recent activities view, with free installation and 90 days of support.
- Profile management, several profiles per user
- Temporary activation and blocking of profiles
- Hide menus and sub-menus
- Model rights: create, edit, delete, archive, duplicate, export and spreadsheet
- Hide reports and actions
- Field invisible, read-only, required and external link removal
- Domain access permissions
- Hide buttons, tabs, kanban links, filters and group-by
- Read-only rights, hide chatter and disable developer mode
- Company-wise restrictions
- Password expiration and admin login access
- Recent activities view
- Community, Enterprise and Odoo.sh
- Free installation and 90 days of support
Built by Terabits
5
Simplify Group Access
by Terabits Technolab
The Simplify restriction engine applied to groups instead of individuals. You create an access group in Access Studio, add the users, and then pick that group on any access rule so it applies to everyone in it. Configuring a rule once per team, such as sales, purchasing, manufacturing or HR, is far less work than repeating a per-user setup every time someone joins.
- Access groups built in Access Studio
- Assign a group instead of individual users on any access rule
- Several rules per group
- Suits teams such as sales, purchasing, manufacturing and HR
- Six languages included
- Requires Simplify Access Management
6
C
Complete Access Rights Management
by Softhealer Technologies
The budget pick among the full restriction suites, and it covers a lot for the price. Alongside hiding actions, reports, views, menus, fields, buttons, tabs and chatter, it adds conditional domain rules, multi-company rules, time and timezone based access, automatic access revocation, sensitive data masking and an interactive access map, and rules can be exported as JSON. It depends on the Sales and Invoicing apps.
- Access management dashboard
- Hide actions, reports, views, and create, edit, delete, duplicate, export, import and print
- Hide filters, group-by, search panel and favourites
- Hide menus, sub-menus and main app menus
- Field access: hide, read-only, required, no quick create or quick edit
- Chatter access: hide send message, log notes and activities
- Conditional domain restrictions for records and UI elements
- Multi-company rules
- Access by time schedule and timezone, with automatic revocation
- XML-RPC and script access restriction
- Sensitive data masking
- Interactive access map with Excel export
- Rules import and export in JSON
- Lifetime free support
- Requires Sales and Invoicing
Built by Terabits
7
Advanced User Audit
by Terabits Technolab
Restriction tells you what people cannot do. This tells you what they did. It records every read, create, update and delete on any model, including third-party ones, links each one to the session it happened in, and shows that session with its IP, location, device, operating system and browser. If a session looks wrong you can kill it to force a logout, and users get an email whenever a new session starts on their account.
- Audit of read, create, update and delete on any model and field
- Tracks third-party models too
- Every activity linked to the session it came from
- Session details: IP, location, date, device, OS and browser
- Kill any session in one click to force a logout
- Automatic session expiry after a set duration
- Email notification on every new login
- Unnecessary module logs discarded automatically
- Admins see all sessions, users see only their own
- Requires the user-agents Python package
8
S
Security User Roles
by faOtools
A different and genuinely useful idea: bundle Odoo groups into named roles so you assign Warehouse Supervisor rather than ticking nine checkboxes. A user can hold several roles, changing a role recalculates rights for everyone who has it, and roles can be granted or blocked for a set period for holiday cover. It does not hide fields or buttons, so it complements a restriction app rather than replacing one.
- Roles that bundle several Odoo security groups
- Several roles per user
- Update one role to recalculate rights for all its users
- Build a role from an existing user, or a user from a role
- Temporary role activation and blocking for set periods
- Works with groups from standard, third-party and custom modules
- Mass user updates
- Interface in over 30 languages
- Community, Enterprise and Odoo.sh
- No field, button or view level restrictions
Built by Terabits
9
Dynamic Captcha Manager
by Terabits Technolab
The security app people forget until their CRM fills with junk leads. It adds a captcha to the three website forms that get abused most, signup, login and contact, and you choose per form between Google reCAPTCHA, a text captcha and a puzzle captcha, so you are not tied to Google. Every captcha is checked in the browser and again on the server, so it cannot be skipped with browser tools.
- Captcha on signup, login and contact forms
- Three options: Google reCAPTCHA, text captcha and puzzle captcha
- A different captcha for each form
- Checked in the browser and again on the server
- Blocks spam and bot submissions
- Configured from Website settings
Built by Terabits
10
Logs Of Exports
by Terabits Technolab
Standard Odoo lets any user with read access export a model to a spreadsheet and leaves no trace. This logs every XLSX or CSV export and every print from any model, and shows the entry in the record chatter, which turns an invisible data-leak path into an auditable one. Old logs can be deleted automatically after the number of days you choose.
- Logs every XLSX and CSV export from any model
- Logs every print from any model
- Log entry shown in the record chatter
- Automatic deletion of logs older than a set number of days
- Access enabled per user
- Pairs naturally with an export restriction app
11
U
User Access Studio
by ERP Heritage
The strongest free restriction app here. From one access profile it hides menus, fields, buttons, tabs, filters and the chatter, toggles debug mode and login, and adds per-model record rules whose domains use smart placeholders such as the current user company or team. It is built with care for mistakes: a profile cannot lock an administrator out, profiles can expire on a set date, and a broken rule blocks access rather than opening it.
- Access profiles that hide menus, fields, buttons, tabs, filters and chatter
- Toggle debug mode and login per profile
- Per-model record rules with smart placeholders resolved at runtime
- Profiles with an active date window
- Guard against locking an administrator out
- Malformed rules fail closed instead of granting access
- Cached resolution that refreshes on every change
- Configured in the interface, no XML
- Free, LGPL-3
Built by Terabits
12
Login With Any User
by Terabits Technolab
A support tool rather than a lock, and the fastest way to check that your restrictions actually work. An administrator can log in as any user without their password, see exactly what that person sees, and switch between users with one button. It can also generate a temporary login link for a user, which is useful for quick support but should only be given to people you trust. Only members of the Login as another user group can use it.
- Log in as any user without their password
- Quick switch button between users
- Temporary login links, a new one generated each time
- Limited to the Login as another user group
- Verify access rules as the user sees them