Document Retention & Immutable Archive

What this is for

Most EU jurisdictions require accounting documents to be produceable for ten years, unaltered. Odoo stores attachments; it does not prove anything about them, and anyone with delete rights can remove one.

Policies

Archive ▸ Retention Policies

A policy says what is kept, for how long, and on what legal basis:

• the document type and an optional filter — posted invoices only, one journal;

• a file-name filter, for when only the issued PDF matters and the working files do not;

• the retention period in years;

• the legal basis you are relying on. An auditor asks for this before they ask for the documents.

Retention runs from the document's own date, not from the day somebody got round to archiving it.

The chain

Every entry stores the SHA-256 of the file and commits to the entry before it. A stored hash proves a file has not changed; the chain proves something more useful — that no entry has been removed or reordered either.

Verification reports the two failures separately, because they mean different things:

• Altered — the file's content no longer matches. Somebody edited it in place.

• File missing — the attachment row is there but the bytes are not. That is what a filestore restored from a bad backup looks like.

• Chain break — the entry's own hash does not recompute. Something rewrote the archive table directly.

Verification runs weekly on its own. Silent corruption is otherwise found months late.

Deletion

While the retention period runs, neither the archive entry nor the underlying attachment can be deleted. Retention a user can undo with the bin icon is not retention.

After the period, deletion is allowed — deliberately. Keeping personal data longer than the rule permits is its own breach.

Handing it to an auditor

Archive ▸ Export Packages builds a zip holding the files, a manifest with every hash and chain value, and a README explaining how to redo the check with nothing but sha256sum. An archive that can only prove itself inside the system holding it proves very little.

For an archive too large to move, build the package with include files turned off: the manifest and the hashes still change hands.

Known limits

• The chain is per company and per Odoo database. It proves internal consistency, not that a document existed on a given date — that needs a timestamping authority, which is a different product.

• Archiving works on attachments. A document that was never attached to a record is not archived, because there is nothing to archive.

• Verifying re-reads every file. On a large filestore that is real I/O, which is why the scheduled check runs weekly rather than hourly.