Black Snow IntelligenceBlack Snow Intelligence
Black Snow Report

Odoo

Method v1.6As At 2026-08-1514 Surfaces Read1 Offering Assessed

Your own published record, as at 2026-08-15.

Your Details

The Macro Picture17

Red · Adverse
7
of 17 banded observations across 1 offering band Adverse. 2 were never measured.

What Is Published8

Your Own Words3

The Customer acknowledges and agrees that in order to provide the Services, Odoo SA may use third-party service providers (Subprocessors) to process Personal Data. Odoo SA commits to only use Subprocessors in compliance with Data Protection Legislation. This use will be covered by a contract between Odoo SA and the Subprocessor that provides guarantees to that effect.
Enterprise Subscription Agreement §6.5, Subprocessors clause, read in full. No SCC clause text, no Annex I/II/III, no Module selection, and no offer to provide a copy of any transfer instrument was found anywhere in this Agreement or the Privacy Policy. The 'EU Standard Contractual Clauses' referenced for staff access is named only in prose; the clauses themselves are not published, attached, or offered on request in any document read. Contrast Cerebras, whose full nine-page SCC package (with UK Addendum and Swiss sections) is a public PDF at a stable URL. · Source
Hosting Region | Production Location | Backup Locations — Americas: USA, Canada | Europe (FR, NL) + Canada — Europe: Europe (FR, BE) | Europe (FR, NL, SE) — Asia & Pacific: Singapore, Taiwan | Europe (FR, NL) + Canada — Middle East & Southern Asia: India, Saudi Arabia | Europe (FR, NL) + Canada — Oceania: Australia | Europe (FR, NL) + Canada
Physical Data Location / Data Transfers section. Countries ARE named, at the hosting-region level, for both production and backup locations — a materially more located disclosure than a name-only sub-processor table. But the table does not cross-map which of the six named sub-processor entities (OVH, Google Cloud EMEA, Outscale, Scaleway, AWS, FullStory) actually operates in a given country; the entity names and the country names are published in two separate tables that a reader cannot join with certainty. Independently corroborated for the Odoo.sh product specifically by the Odoo.sh FAQ, which names seven GCP data-center cities (Iowa US, Toronto Canada, Saint-Ghislain Belgium, Dammam Saudi Arabia, Mumbai India, Singapore, Sydney Australia) — overlapping but not identical to the main Privacy Policy table (no Taiwan named for Odoo.sh). Scored Partial: locations are named at country level, but not resolved to a specific sub-processor identity per country. · Source
if you cancel the service your database is kept deactivated for 3 weeks...and then destroyed; personal data could remain stored for up to 12 months in those backups; we may retain this data for a maximum of 12 months [Browser Data]; we may keep the information you provide for up to 3 years [Job Application Data]
Multiple named data categories each carry a specific published period (database: 3 weeks then destroyed; safety backups: up to 12 months; browser data: 12 months; job applications: 3 years / 18 months; free trial recordings: 2 months). Account & Contact Data carries a criteria-only formula ('as long as necessary... including any legal retention period') alongside the fixed periods for other categories. Scored Period Published because concrete, numbered periods exist for the majority of named categories, not merely a criterion. · Source

Parties You Name14

See which of these are assessed in this register

Register Check3

AI Role By Offering1

Assessment Basis

Produced under Method v1.6 from the entity's fact record. 8 of 8 observations were measured under that generation; the rest read Not Measured, which is a fact about this register's coverage and not a finding about the entity.

Read from 14 first-party surface(s) across 1 assessed offering(s), found by the entity's own link graph and sitemap rather than by guessed paths.

Fact Record
Version 1.0, dated 2026-08-15
Standards Commit
3487bce7d591
Register Control Quality
Both Views

Verification And Challenge

Every finding on this record is a statement about what could be read on your own published surfaces as at 2026-08-15. Correspondence route as recorded on this card input: ror@blacksnowintel.com.

What A Machine Could Not Establish3

3 questions are open and 5 are established, read as at 2026-08-15 under method v1.6.

The One Thing To Publish First

Publish it: say whether decisions about people are made automatically.

Red · AdverseAutomated Decision-Making

A finding on the public record.

Where To Put It

This was read on your own page at https://www.odoo.com/privacy. That is the page a reader already reaches for and does not find it on, so it is the page to correct first.

Where Others Stand

4 organisations in the register say whether decisions about people are made automatically. You do not.

What A Published Answer Looks Like

Under certain laws, residents may also be permitted to opt out of certain profiling relating to automated processing analyzing certain categories of an individual's information that would produce a legal or similarly significant effect. [the vendor] does not engage in this type of profiling of individuals.

A question answered plainly in public, by an organisation read as Strong on it. It is not an endorsement of the position the sentence states — Black Snow reads what is published and never recommends what to practise. Read on a published trust or security page. Claim tier Quoted. The organisation that published it is not named. A name in the original is replaced; nothing else in the sentence is changed.

One is named here, and one is deliberate. The rest of the open questions are listed below without a prescription; what to publish for each, in what order, and drafted machine-readable evidence for all of them, is the Deep Dive.

Still Open

Deep Dive

The full assessment, plus consulting on what to fix.

Reviewing your record is free.