Odoo hosting: Odoo Online, Odoo.sh or dedicated server? Backup and security

Where should you host Odoo? The short answer: Odoo Online if you only use standard apps and want the vendor to handle all operations; Odoo.sh if you have custom modules and a development team; a dedicated server if you want control over data location, infrastructure and integrations, provided someone handles backup, monitoring and updates. Hosting is not a technical detail: it decides whether your invoicing restarts after an incident.

This guide compares the three official modes, then details what serious Odoo hosting must guarantee in Morocco. For choosing the software itself, see our Odoo vs Dolibarr comparison.

Odoo’s three official hosting modes

Odoo Online: the vendor’s cloud

Odoo Online is Odoo SA’s SaaS offering. The vendor manages infrastructure, backups and version upgrades. It is the simplest mode, and the only one available with the One App Free and Standard plans. Its main limitation: according to the official documentation, it does not accept non-standard apps. No custom-developed modules, no third-party modules. Studio remains available for no-code adjustments, depending on your plan.

Odoo.sh: the platform for customised projects

Odoo.sh is the vendor’s hosting platform for projects involving development. It is tightly integrated with GitHub and offers development branches, staging servers loaded with a copy of your data, automated tests and SSH access to containers. The vendor states daily incremental backups on three different servers and 24/7 monitoring of its servers. Odoo.sh is available with the Custom plan.

On premises or dedicated server

Odoo Community can be installed freely on your server; the Enterprise edition can also be hosted on premises with the Custom plan. You choose the server, its location, the network, integrations with your other tools (telephony, warehouse, websites) and the update schedule. In return, everything the vendor does on its platforms becomes your job: backups, monitoring, security patches, version upgrades, recovery plan.

Comparing the three hosting modes

Criterion	Odoo Online	Odoo.sh	Dedicated server / on premises
Who runs the infrastructure	Odoo SA	Odoo SA	You or your managed service provider
Custom or third-party modules	No	Yes	Yes
Test environment	No branches or staging	Built-in branches and staging	To be built
Backups	Automatic, by the vendor	Automatic, by the vendor	To be organised (3-2-1)
Data location	Vendor’s data centres	Vendor’s data centres	Your choice
System access	No	SSH to containers	Full
Applicable Odoo plans	All	Custom	Custom (Enterprise) or Community

Conditions change: check them on the odoo.com pricing page when you decide.

How to choose for your situation

• You are starting with standard apps, no development, and want as little operations work as possible: Odoo Online. Still keep a copy of your data outside the platform.
• You have custom modules and an integrator or team developing them: Odoo.sh, for its test environments and deployment tooling.
• You need control over data location, integration with your network or other servers, or want to use Odoo Community: a dedicated server, with a clear operations contract.

Switching modes later is possible but follows a procedure: Odoo’s documentation states, for example, that a database must be cleared of non-standard apps before moving to Odoo Online. Better to decide knowing your upcoming customisations.

Backup: the 3-2-1 rule applied to Odoo

An Odoo database consists of two inseparable parts: the PostgreSQL database and the filestore, the directory that holds attachments (PDF invoices, scanned documents, product images). Backing up one without the other gives an incomplete restore.

We apply the 3-2-1 rule with an immutable copy:

• three copies: production, a local backup for fast restores, an off-site copy;
• two different media;
• one off-site copy, isolated and unmodifiable, out of reach of a compromised admin account.

On Odoo Online or Odoo.sh, the vendor’s backups protect against a failure of its platform; a regular export to storage you control protects against everything else: user error, disputes, a change of provider. And a backup is only worth something if it restores: we test it with a documented method on a test server, checking that Odoo starts and attachments open.

Monitoring and security

A dedicated Odoo server is monitored like any critical server:

• availability of the service and the HTTPS certificate;
• disk space, especially for the filestore and backups;
• load on the server and PostgreSQL at peak times;
• backup success and off-site replication;
• abnormal login attempts.

On the security side: HTTPS-only access, database manager disabled or protected, named accounts with multi-factor authentication, an up-to-date operating system, ports closed except where strictly needed, and a firewall in front of the server.

Updates and version upgrades

Distinguish patches, applied regularly, from major version upgrades, which need preparation. On Odoo Online, the vendor handles them. On Odoo.sh and dedicated servers, custom modules must be adapted, then tested on a copy of the database before production. Our rule: never update directly in production, always go through the test environment, with a verified backup taken just before.

Personal data and law 09-08

Odoo holds personal data: customers, contacts, sometimes employees. Law 09-08 and the CNDP require appropriate security measures, and hosting that data outside Morocco is a transfer regulated by the law. The location of hosting and off-site backups is therefore part of the decision, to be planned with your legal adviser rather than after go-live.

Common mistakes

• Backing up the database without the filestore, and finding on restore that attachments are gone.
• Keeping backups on the same server as Odoo.
• Leaving the database manager reachable from the internet.
• Updating in production without testing or a prior backup.
• Choosing Odoo Online, then discovering that an essential module is not accepted.
• Monitoring neither disk nor backups: the server stops on a closing day.

Checklist: your Odoo hosting

• Hosting mode chosen according to planned custom modules.
• Location of data and backups decided with law 09-08 in mind.
• Daily backup of the database and filestore, immutable off-site copy.
• Restore tested regularly on a test server.
• HTTPS, MFA, named accounts, database manager protected.
• Monitoring of availability, disk, backups and logins.
• Separate test environment for every update.

How we do it

We host Odoo for our clients on infrastructure we operate ourselves, without being an official Odoo partner: a dedicated instance, daily backups of the database and filestore following the 3-2-1 rule with an immutable off-site copy, tested restores, 24/7 monitoring and critical incidents handled in under 15 minutes. Every update goes through a test environment. If Odoo Online or Odoo.sh fits your needs better, we tell you and set up a regular export of your data.

Discover our ERP and CRM offering, our backup and business continuity offering, our guide to off-site backup in Morocco and our case studies. To review your Odoo hosting, request your free initial audit: we reply within 24 business hours.