Security and privacy

Your data stays in Odoo

Abstr.ax keeps no lasting copy of your Odoo data. It sends each call to the Odoo of your company and gives the answer to your client. Only a large answer stays for 1 hour as a resource, and only you can read it.

Rights

• An agent works with the rights of its Odoo user. Abstr.ax adds no rights.
• Your company chooses the models and the methods of each agent.
• A person sees only the agents that your company gives them. Abstr.ax checks this at each call.

Login and keys

• You log in at Microsoft or Google. Abstr.ax never receives your password.
• The Odoo API keys of the agents and the tokens of the logins are encrypted in the database.
• Your client connects to Abstr.ax over HTTPS.

Audit log

Each call writes 1 line: the time, the person, the agent, the tool, the arguments, the Odoo model, the record ids, the duration and the result class. The line does not hold the data that Odoo gives back. Abstr.ax can only add lines: it cannot change them. Abstr.ax keeps the lines of the current month and the 12 months before it, and then removes each older month as a whole.

The sandbox of odoo_compute

A script runs in Pyodide (Python in WebAssembly) in a separate process. The process has no network access, cannot write files and gets no environment variables. The limits of 1 run are 30 seconds and 256 MB of memory; there is no cap on Odoo calls or records. The script reads Odoo only through the read tools of the agent, and each read writes its own audit line.