# Document Retention & Immutable Archive > Keep issued documents as long as the law requires and prove they were never touched: hash chain, retention dates, deletion blocked. - **What it is:** Keep issued documents as long as the law requires and prove they were never touched: hash chain, retention dates, deletion blocked. - **For:** Document Management - **Odoo versions:** 16.0, 17.0, 18.0, 19.0, 20.0 - Community and Enterprise - **Runs on:** Odoo.sh or Odoo you host yourself - not Odoo Online, which accepts no third-party apps - **Price:** 169 EUR, one-time, on the Odoo Apps Store - **Technical name:** bambooforge_archive - **Not for:** The chain is per company and per Odoo database. It proves internal consistency, not that a document existed on a given date — that needs a timestamping authority, which is a different product.; Archiving works on attachments. A document that was never attached to a record is not archived, because there is nothing to archive.; Verifying re-reads every file. On a large filestore that is real I/O, which is why the scheduled check runs weekly rather than hourly. - **Manual:** https://docs.bambooforge.dev/bambooforge_archive/ - **Live demo:** https://demo20.bambooforge.dev/odoo/action-bambooforge_archive.action_bf_archive_entry - **Store page:** https://apps.odoo.com/apps/modules/20.0/bambooforge_archive - **Manual last updated:** 2026-09-25 --- # Document Retention & Immutable Archive ## What this is for Most EU jurisdictions require accounting documents to be produceable for ten years, unaltered. Odoo stores attachments; it does not prove anything about them, and anyone with delete rights can remove one. ## Policies *Archive ▸ Retention Policies* A policy says what is kept, for how long, and on what legal basis: - the document type and an optional filter — posted invoices only, one journal; - a file-name filter, for when only the issued PDF matters and the working files do not; - the retention period in years; - the legal basis you are relying on. An auditor asks for this before they ask for the documents. Retention runs from the **document's own date**, not from the day somebody got round to archiving it. ## The chain Every entry stores the SHA-256 of the file and commits to the entry before it. A stored hash proves a file has not changed; the chain proves something more useful — that no entry has been removed or reordered either. Verification reports the two failures separately, because they mean different things: - **Altered** — the file's content no longer matches. Somebody edited it in place. - **File missing** — the attachment row is there but the bytes are not. That is what a filestore restored from a bad backup looks like. - **Chain break** — the entry's own hash does not recompute. Something rewrote the archive table directly. Verification runs weekly on its own. Silent corruption is otherwise found months late. ## Deletion While the retention period runs, neither the archive entry nor the underlying attachment can be deleted. Retention a user can undo with the bin icon is not retention. After the period, deletion is allowed — deliberately. Keeping personal data longer than the rule permits is its own breach. ## Handing it to an auditor *Archive ▸ Export Packages* builds a zip holding the files, a manifest with every hash and chain value, and a README explaining how to redo the check with nothing but `sha256sum`. An archive that can only prove itself inside the system holding it proves very little. For an archive too large to move, build the package with **include files** turned off: the manifest and the hashes still change hands. ## Known limits - The chain is per company and per Odoo database. It proves internal consistency, not that a document existed on a given date — that needs a timestamping authority, which is a different product. - Archiving works on attachments. A document that was never attached to a record is not archived, because there is nothing to archive. - Verifying re-reads every file. On a large filestore that is real I/O, which is why the scheduled check runs weekly rather than hourly. ## How we make sure it works Before every release, **27 automated checks** run against this app on Odoo 16, 17, 18, 19 and 20. Among them: - The same file is not archived twice. - An archived attachment cannot be deleted. - A plain employee does not see the menu. - An employee reads the archive and touches nothing. - Zero years is not a policy. The complete list is in the source you receive. ## Install 1. Copy `bambooforge_archive` into your addons path and update the app list, or install the ZIP from the Odoo Apps Store. 2. Install **Document Retention & Immutable Archive**. 3. Open **Archive** - its menus are Archived Documents, Retention Policies, Export Packages. ## Questions people ask ****Which Odoo versions does it run on?**** Odoo 16.0, 17.0, 18.0, 19.0, 20.0, on the series you buy it for; each series is its own listing. ****Community or Enterprise?**** Both. It needs no Enterprise app. ****What does it need?**** The standard Discuss, Settings apps. No extra Python package. ****Where does it show up?**** Under the **Archive** menu (Archived Documents, Retention Policies, Export Packages). ****Does anything leave my server?**** No. It makes no call outside your Odoo server: no telemetry, no licence check, no third-party service. ****What happens if I uninstall it?**** Odoo drops the app's own tables and fields; the standard records it worked on (contacts, orders, products) stay as they are.