Purpose
Maintain accountable Odoo backup responsibilities, scope, frequency, retention and recovery objectives aligned with business impact and risk appetite.
Scope
This procedure governs the backup strategy for:
- Odoo SaaS database and filestore
- Client (KYC/KYB) data
- Transaction and financial records
- Operational and administrative data
Responsibility Model
Odoo SaaS Responsibility
Odoo SaaS provides automatic daily backups, internal redundancy and infrastructure protection, and short-term recovery capability. These backups are managed by Odoo, are not directly controlled by Bitkaya, and are not intended as a standalone compliance backup solution.
Bitkaya Responsibility
Bitkaya remains responsible for independent backup control, long-term retention, regulatory compliance, and data recovery capability.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Confirm backup scope | Confirm the Odoo database, filestore, business records and critical dependencies in scope — covering Odoo SaaS database and filestore, client (KYC/KYB) data, transaction and financial records, and operational and administrative data | Approved scope statement |
| 2 | Document responsibility split | Odoo manages daily automated backups, internal redundancy and short-term recovery; Bitkaya owns independent backup control, long-term retention, regulatory compliance and data recovery capability | Responsibility matrix |
| 3 | Apply proportionality principle | Volume and frequency of backups must reflect business size, transaction volume and risk exposure. Odoo’s daily backups mitigate short-term operational risk; Bitkaya’s external backups mitigate vendor dependency risk, data loss scenarios and audit/regulatory requirements. Balances operational efficiency, cost and compliance obligations | Proportionality rationale |
| 4 | Align with BIA | Align backup frequency, recovery-point exposure and restore expectations with the Business Impact Analysis | BIA alignment record |
| 5 | Assess risk factors | Assess vendor dependency, data sensitivity, regulatory retention and disruption scenarios | Risk assessment |
| 6 | Obtain risk acceptance approval | Obtain accountable approval for risk acceptance, including the potential one-month data gap accepted under the proportionality principle. Additional backups may be triggered if the risk profile increases | Risk acceptance and approval record |
| 7 | Assign responsibilities | Assign execution, oversight, access, verification, restore-test and escalation responsibilities — the assigned staff member executes the procedure and the compliance officer oversees adherence | RACI or responsibility assignment |
| 8 | Review strategy | Review the strategy annually, upon system changes and upon regulatory updates | Review record |
Records
- Backup scope and responsibility matrix documenting the Odoo-managed vs Bitkaya-managed split
- BIA, recovery objectives and risk assessment
- Frequency and retention rationale reflecting proportionality (business size, transaction volume, risk exposure)
- Risk acceptance, approval and annual review
Relationships
- Policy: POL-ODOO-001 Odoo SaaS Backup Policy
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Control: CTRL-ODOO-001 Ensure Odoo Backup Strategy Responsibilities and Objectives Are Approved
History
- 2026-07-26: Created from sections 1-5 and 12-13 of the final Odoo backup policy.