• 1. Quality assurance on different levels, starting from the requirements definition phase, which results in speeding up the testing process and delivering faster.
• 2. Validate whether the requirement supports future business needs—at the analysis phase. This minimizes re-work and change requests (CRs).
• 3. Change requests (CRs) work-out flow
• 4. Design solutions for systems evolvement and testing simplification
• 5. DoR and Compliance support
• 6. DoD for iteration/release and feature/story/tasks

We pay special attention to data security and compliance issues.
Firstly, Odoo itself; its architecture ensures data security and meets the strict requirements of the GDPR (and CCPA).

General Data Protection Regulation (GDPR) | Odoo
Odoo Privacy Policy
Odoo Security

➜ As for compliance, we rely mainly on Odoo as a basic system, and we then follow the specified requirements when making changes to the code regarding users’ and customers’ personal data (these data are usually maintained in standard Odoo models, and we follow their rules).
For our part, we track any changes in the data security of both standard and Enterprise Odoo modules; we additionally notify customers (in 72 hours, according to the GDPR) if there are security issues and insist on the immediate installation of security patches.
➜ We need to understand where the data will be stored, or rather, whether using odoo.sh (so-called official Odoo hosting) or other servers is planned on.
In the case of using odoo.sh, there are some restrictions, but many data security solutions are already available out of the box; we can only improve them. Whatever the system you choose, it should provide a high-trusted hosting. For our part, we ensure the safety of the system’s individual components (for example, restricting direct access to the database if this had not yet been done by the provider).
➜ What we offer customers to ensure data security.
As a rule, all our projects begin with listing current business roles and their basic responsibilities, which allows us to determine basic access rights and rules, along with completely preventing unauthorized use of the administrator’s account. Thus, we partially implement the principle of least privilege, thereby minimizing unauthorized critical data access risk.
We also offer solutions to include two-factor authentication for both web and mobile apps. In case there is a third-party module that meets the client’s requirements, we then conduct a mandatory code review, including its compliance to basic security principles, before recommending its installation. As noted above, this aspect is already considered in our own modules at the very beginning of module implementation.
➜ The last and most important aspect involves how we work with the customer’s data while developing, testing, and delivering our solutions.
As noted above, we respect our customers’ confidentiality. Thus, it all starts with the signing of a non-disclosure agreement between you and VentorTech. The list of people who have access to production data in all Odoo and third-party systems integrated with Odoo (for example, FedEx) is strictly limited.
As such, we replace the email addresses and passwords (encrypted, always and everywhere) to accounts of the system users for testing purposes. If necessary, we can enhance the process of mandatory data anonymization (for instance, automatically replace the data of your customers) on staging and development environments, so our QA and software engineers will not have access to specific business-critical data.
Regardless of whether we use this approach or not, we always check the integrity of the data when developing and maintaining our modules, and we can guarantee that the data will not be lost.