For a backup product, security isn't a marketing page — it's the product. This is a plain-language account of how OBM handles your credentials and your data. Where something is a limitation, we say so.
Encryption in transit
TLS everywhere: between your browser and OBM, between OBM and your Odoo instances, and
between OBM and backup storage. OBM talks to your Odoo only at the URL you registered —
register https:// URLs. The one non-TLS channel is the optional Agency SSH
fallback below, which is encrypted by SSH itself.
Master passwords
An Odoo master password is the most sensitive thing you give OBM. It is encrypted at rest, used only to call that instance's own database-manager endpoints (backup, restore, listing) on your behalf, never logged, and never displayed back in plain text — not even to you.
SSH keys, on the Agency fallback
Agency instances whose Odoo refuses HTTP backups can be backed up over SSH instead (how it works). The private key you register gets the same treatment as a master password: encrypted at rest, write-only — the API will never hand it back — and never logged. Give OBM a dedicated key pair, not a key you use yourself. The server's host key is pinned on the first successful test-connection and re-checked on every backup, so a swapped or spoofed host fails the job instead of silently handing your dump to a stranger.
Where backup archives live
Pro stores backup archives in Backblaze B2, EU region, encrypted at rest. Each organization's archives live under its own key prefix, so tenant data is separated at the storage layer as well as in the application. CE stores archives on your own disk, under your control — where they live is your call.
Downloads and share links
On Pro's hosted object storage, archive downloads are handed out as presigned, time-limited URLs — the link stops working after its short window instead of living forever in a browser history, and the application never proxies the bytes. (A self-hosted CE install has no object store to presign against: it streams the file from your own disk to your own authenticated session.)
Share links are a separate mechanism, deliberately scoped to a single archive. Each one is a random token that we store only as a SHA-256 hash — we cannot recover the link after you create it — with its own expiry, an optional maximum download count, and a revoke button that kills it immediately. Every fetch is counted and written to your activity log; an expired, exhausted or revoked link is indistinguishable from one that never existed.
Verified archives
Every archive is verified before it is accepted — structural checks (zip CRC and manifest,
or pg_dump header) — and its SHA-256 checksum is recorded.
Verification results and checksums stay attached to each backup, so corruption or tampering
shows up as a mismatch, not as a surprise during a restore.
Organization isolation
Pro is multi-tenant: every request is scoped to your organization, storage uses per-tenant prefixes, and actions are recorded in your organization's activity log. Access to production systems is limited to the small team that operates the service, on a need-to-use basis.
The honest bits
- Backup archives are stored in the EU, but the control plane (application servers and the metadata database) runs on infrastructure outside the EU, behind Cloudflare. OBM is not an end-to-end "EU-hosted service", and we won't call it one — the full picture is in the privacy policy.
- We do not currently hold SOC 2 or ISO 27001 certifications. What we offer instead: a Data Processing Addendum, a short and public sub-processor list, and honest answers to security questionnaires.
- The Community Edition is AGPL-3.0 open source — the verification, encryption and retention code Pro builds on is public to read. Hardening a self-hosted install is covered in CE operations.
Reporting a vulnerability
Found something? E-mail [email protected] — please don't open a public GitHub issue for security reports. We read every report, respond within one business day, and are grateful to people who disclose responsibly.
More detail
- Privacy Policy — what personal data we collect, why, and for how long.
- Data Processing Addendum — processor terms for the contents of your backups.