HeroNorm in Odoo
What HeroNorm reads and writes in Odoo. And where.
No secrets, no surprises. Here is every Odoo app HeroNorm touches, what it does there, and which part of ISO 27001 that helps with.
| Odoo app | What HeroNorm does | Why it matters for ISO 27001 |
|---|---|---|
| Employeesreads | Reads who joined and who left, and their work email. | Checks that leavers lost their access (people controls, A.5.18 and A.6.5). |
| Settings › Usersreads | Reads the names of colleagues with an Odoo login. | So you can pick who signs agreements for your company (A.5.20). |
| Contactsreads | Reads customers, suppliers and the people who sign for them. | Fills your supplier register and finds who signs an agreement (A.5.19). |
| Salesreads | Reads which customers buy which apps or services. | Tells you which customers need a data processing agreement (A.5.34). |
| Knowledgewrites | Publishes your policies and procedures as articles under “ISMS (HeroNorm)” and keeps them up to date. | People read the rules where they work (A.5.1 and A.5.37). |
| Signwrites | Sends data processing agreements for signature and reads back when they are signed. | Signed agreements, filed with the date (A.5.20 and GDPR article 28). |
One API user. All the safety in HeroNorm.
An extra Odoo user for every task gets expensive fast. So HeroNorm uses one API key, and does the guarding itself:
- Only a short, fixed list of write actions is possible. Everything else is refused before it reaches Odoo.
- HeroNorm never deletes anything in Odoo, and only updates articles it created itself.
- Every read and every write is recorded in a log that can't be changed afterwards.
- The key is stored encrypted and is never shown again, not even to you.
- Each organization only ever talks to its own Odoo.
What you need
- Odoo 19: Odoo Online, Odoo.sh or your own server
- An API key of a user with the rights above
- Knowledge and Sign only if you want those features
Questions we often get
Is HeroNorm an Odoo module?
No. HeroNorm runs next to Odoo and talks to it through Odoo's own API. Nothing to install, nothing that breaks at your next Odoo upgrade.
Do I need Odoo to use HeroNorm?
No, HeroNorm works without it too. But with Odoo your policies, agreements and checks end up where your team already works.
Does HeroNorm change my Odoo data?
Only in Knowledge (its own articles) and Sign (the agreements you send). It reads the rest and never deletes anything.
Does it work with Microsoft 365 too?
Yes. Sign in with Microsoft, and HeroNorm checks accounts, MFA and leavers in Microsoft Entra every day.