When a business moves to Odoo.sh, the platform-as-a-service run by Odoo S.A., a lot of infrastructure work disappears: server provisioning, OS patching, SSL certificates and daily backups are all automated. That relief often turns into a risky assumption — that “cloud-managed” means “secure by default”.
Odoo.sh gives you a strong infrastructure foundation. Application security, repository hygiene and who can deploy what are still your team’s responsibility. This article is part of our Odoo security series.
Key takeaways
- Odoo.sh handles the infrastructure layer: hosting, isolation, OS patching, SSL and backups.
- You handle the application layer: custom code, GitHub access, secrets, user access rights and staging data.
- Because Odoo.sh deploys straight from GitHub, a compromised GitHub account is a route into production.
- Staging branches run on a copy of production data, so treat them as production for privacy purposes.
The shared responsibility model on Odoo.sh
- What Odoo.sh handles (infrastructure): hosting and network protection, container isolation, operating-system updates, SSL/TLS certificates, and automated backups of your production database.
- What you handle (application and operations): the quality of your custom modules, who can push to your GitHub repository, where API keys and passwords are stored, which collaborators have access to the Odoo.sh project, and the access rights of every Odoo user.
If you are still choosing a hosting model, our comparison of Odoo Online vs Odoo.sh vs on-premise explains what each option leaves to you.
Common risks in Odoo.sh projects
- Careless staging branches. Staging builds start from a copy of production data. Connecting them to live third-party services, sharing their URLs widely or leaving verbose debug logging on can expose real customer records.
- Weak GitHub accounts. A developer account without multi-factor authentication (MFA) is enough for an attacker to push code that Odoo.sh then builds and deploys.
- Secrets in the repository. Payment gateway keys, API tokens or database passwords hardcoded in module files stay in Git history even after you delete them.
- Forgotten collaborators. Former employees, agencies and CI tools that still hold deploy keys or project access.
Odoo.sh security checklist
- Protect the production branch. Limit who can push to it, and require reviewed pull requests before merging.
- Require MFA on GitHub for every member of the organisation that owns the repository.
- Keep secrets out of Git. Store keys in Odoo’s system parameters or the relevant app configuration on each database, and rotate any key that has ever been committed.
- Review access every quarter. Remove collaborators, SSH keys and integrations that are no longer needed.
- Treat staging data as live data. Restrict who can open staging builds and disconnect live payment, shipping and email integrations there.
- Enable two-factor authentication in Odoo for administrators and other high-privilege users.
How Mediod can help
Mediod’s Odoo support and maintenance team runs Odoo.sh security reviews: branch and collaborator permissions, deployment pipeline, secrets handling and user access rights. You get a short report with the fixes ranked by risk. If your project is built on custom code, our development team can review it too.
More from our Odoo security series
- Custom Modules and Security Debt: Writing Safe Odoo Apps from Scratch
- Hardening a Dedicated Odoo Server (VPS or On-Premise): An Infrastructure Blueprint
See all Odoo Security articles →
Want a second pair of eyes on your Odoo security?
Mediod Consulting is an Official Odoo Partner. We review custom modules, access rights, integrations and hosting set-ups, and give you a prioritised list of fixes. Book a free discovery call or request a quotation for a security review.
Frequently Asked Questions
Is Odoo.sh secure?
Odoo.sh provides a secure, managed infrastructure. Application security still depends on your custom code, GitHub access, how you store secrets and how you configure user access rights.
Who is responsible for security on Odoo.sh?
It is shared. Odoo S.A. runs the infrastructure: hosting, patching, SSL and backups. The customer and their developers are responsible for code, repository access, secrets and Odoo user permissions.
Does an Odoo.sh staging branch contain real data?
Yes. Staging builds are created from a copy of the production database, so they should be protected like production.
