Open source ERP

A self-hosted open source ERP can run finance, procurement, inventory and operations inside your own infrastructure. This page explains which platform fits which scope, what drives cost, and how to plan the rollout and support.

On this page

Choosing an open source ERP for self-hosted finance and operations

If you are replacing a legacy ERP or pulling finance and operations data out of spreadsheet sprawl, and you need that data to stay in your own environment, the main self-hosted options to evaluate are Odoo Community, Odoo Enterprise and ERPNext. Which one fits depends on three things: how much of the finance and operations scope you need on day one, how far you expect to customize, and what kind of support model your team can staff and pay for. Odoo is published under the GNU LGPL version 3, and Odoo Enterprise is built on the Community core, so the licensing and upgrade path should be part of the comparison from the start. ERPNext is built on the Frappe framework and licensed under GPL-3.0. Apache OFBiz, under Apache-2.0, is a further option for teams with strong Java skills.

DeployOpen is a Chainscore Labs company that plans, implements, customizes, integrates, hardens, backs up, upgrades and supports self-hosted open-source platforms inside the client's own cloud accounts, data centers or air-gapped networks. For an ERP, that means the work covers the module scope, the chart of accounts and fiscal calendar design, data migration from the legacy ledger, and the hosting and security baseline, not only the software installation.

Before you shortlist vendors, write down the modules that must go live in the first phase (for example, general ledger, accounts payable and receivable, and inventory) and the ones that can follow. Then confirm with each candidate which of those modules are in the Community edition and which depend on Enterprise, and which Enterprise features, such as Studio customization or hosted upgrades, your support plan will rely on. Ask whether any AI features you plan to use require paid in-app credits; Odoo has stated that all AI features in Odoo 20, released on September 24, 2026, require credits bought as in-app purchases. Treat the answers as inputs to a written scope, because licensing, hosting and support costs all follow from it.

Requirements to agree before choosing an ERP platform

Before comparing Odoo, ERPNext or any other self-hosted option, the buyer needs agreed answers on scope, legal structure, integration load, hosting, users and ownership. These six decisions drive the edition, the hosting design and the partner scope, so changing any of them later usually changes the budget and timeline.

Module scope across functions

Decide which business areas go live at the first cutover: finance, sales, inventory, manufacturing and projects. Each area adds configuration, data migration and user training, and some modules depend on others, such as inventory valuation feeding the general ledger. Ask each department which processes must run in the new system on day one and which can stay in spreadsheets or the legacy tool for a later phase.

Legal entities, currencies and tax regimes

Confirm how many legal entities will post transactions, which currencies they book in, and which tax regimes apply in each country. Multi-entity intercompany flows, consolidation and local statutory reports are often the hardest part of an ERP design. Ask your finance and tax leads to list every entity and tax jurisdiction in writing, and confirm with the platform vendor or partner how each candidate handles them.

Customization and integration volume

Count the reports, workflows, approval rules and interfaces the business needs beyond standard features, along with the systems they must exchange data with, such as banking, payroll, e-commerce and the data warehouse. Custom code is the main source of upgrade effort later. Ask which requirements can be met with configuration, which need custom modules, and who will maintain each one after go-live.

Hosting location and data residency

Determine where the ERP database, backups and logs must reside, based on your regulators, customer contracts and internal data classification. Self-hosting in your own cloud account, a data center or an isolated network changes who patches servers, manages encryption keys and proves access controls. Confirm the required regions and whether any sovereignty or air-gap constraints apply before selecting a hosting model.

User count and access model

Define how many named users will log in, how many are occasional approvers or external partners, and which roles can post, approve, pay or change master data. Segregation of duties in finance depends on this model. Confirm whether a licensing model charges per user or per application, and whether mobile or self-service access must be included, since these choices change the license and identity design.

Ownership after launch

Name the internal owner for configuration, user access, backups, security patches, version upgrades and month-end support once the system is live. Decide whether that owner is an in-house team, an implementation partner under a support retainer or a mix of both. Without this decision, upgrades are deferred, custom modules drift out of date and the first major version change becomes a project of its own.

Which open source ERP fits which scope

This table compares Odoo Community, Odoo Enterprise, ERPNext and Apache OFBiz by license, what each includes, and the operating effort each implies. Read each column against your own module scope, in-house engineering capacity and appetite for custom code. The main takeaway is that the license and edition choice shapes both upgrade work and who you depend on after launch.

PlatformLicense and editionBest fit and operating effort
Odoo CommunityOdoo is published under the GNU LGPL version 3. Community is the open source core that Enterprise is built on.Fits teams that want the open core and can run upgrades, hosting, mobile access and any Studio-style customization themselves or through a partner. Expect ongoing internal or partner effort for version upgrades.
Odoo EnterpriseLicensed Odoo edition built on Community. Adds mobile apps, Studio customization, version upgrades and hosting, per the Odoo editions page.Fits organizations that want vendor-supported upgrades and Studio-based changes without maintaining custom code paths. Confirm current licensing terms, per-user pricing and hosting options directly with Odoo before scoping.
ERPNextFree and open source ERP built on the Frappe framework, licensed under GPL-3.0. Latest release noted: v16.51.1, published October 15, 2026.Fits teams comfortable with the Frappe framework and its release cadence, who will own customization and upgrades in their own infrastructure or through a partner. Confirm module coverage for your region and industry against the current release.
Apache OFBizLicensed under Apache-2.0. Includes framework components and business applications for ERP, CRM, ecommerce, supply chain and manufacturing resource planning.Fits Java-based organizations with strong engineering capacity that want to extend the framework deeply. Expect the highest in-house development and maintenance effort and a smaller pool of implementation skills to hire from.
Odoo 20 AI featuresOdoo 20 was released on September 24, 2026. Odoo states that all AI features in Odoo 20 require credits bought as in-app purchases.Budget for credit purchases if you plan to use AI features. Ask Odoo to confirm which features are included in your edition and what credit usage looks like before relying on them in a process.
Module scopeCore finance, sales, purchasing, inventory and manufacturing are available across the Odoo editions and ERPNext. Confirm the exact modules in your target release.Map your general ledger, accounts payable and receivable, fixed assets and multi-entity consolidation requirements against each platform before shortlisting. Gaps in these areas usually drive customization effort.
Upgrade and support responsibilityVendor-supported upgrades come with Enterprise. With Community, upgrades and fixes depend on your team or your implementation partner.Ask who performs each version upgrade, who tests custom modules, and what the rollback plan is. This question often matters more than the initial license cost.

What Odoo Enterprise adds over Community and what it costs to run

Odoo Community is the open source core, and Odoo Enterprise is a licensed edition built on top of it. The Odoo core is published under the GNU LGPL version 3, so you can self-host Community without a subscription to the core code. Enterprise adds features such as mobile apps, Studio customization, version upgrades and hosting, as described on the Odoo editions page. Treat the license decision and the hosting decision as two separate questions. You can host Community in your own cloud account or data center and still choose to buy Enterprise licenses, or the reverse, and each choice carries its own cost and maintenance consequences.

The features that matter most for maintenance effort are upgrades and Studio. If your team would otherwise write and test its own upgrade path for each major Odoo release, Enterprise upgrade tooling reduces that work, but you still need a test environment, a rollback plan and a regression suite covering your custom modules. Studio lets business users add fields and views without code, which reduces developer demand for small changes, but every Studio change becomes part of the system you must document, back up and re-test at upgrade time. Ask any partner to show how Studio customizations are exported and versioned in your environment before you rely on them. Confirm current Enterprise pricing, per-user terms, and license conditions for self-hosted deployments directly with Odoo or a partner, since terms can change between releases.

Budget AI features separately from the license. Odoo says all AI features in Odoo 20, released on September 24, 2026, require credits bought as in-app purchases, according to the Odoo 20 release notes. Credits are a recurring operating cost that sits outside your core license and hosting budget, so ask finance to approve them as their own line item, confirm how credits are consumed and expire, and decide who is allowed to spend them. Also confirm where AI processing happens and what data leaves your environment, since that determines whether the feature fits your data handling rules.

How an ERP rollout runs from scoping to go-live

The sequence turns a platform choice into a live ledger in controlled stages, with a written scope, reconciled data, tested processes and a documented handover at each point where errors are cheapest to fix. Each phase closes with a named output that the finance and IT owners can sign.

  1. Run discovery and fit-gap scoping

    The team inventories current finance, procurement, inventory, payroll and reporting processes, then compares each one against standard modules of the chosen edition (Odoo Community, Odoo Enterprise or ERPNext). Gaps are classified as configuration, standard feature, third-party module or custom development. The output is a signed scope document with a written module list, the out-of-scope items and the decision on which legacy systems are retired. Confirm with the vendor which features exist in your chosen edition and version before you sign, because module availability differs between editions.

  2. Design the chart of accounts and entity structure

    Finance leads define the chart of accounts, legal entities, intercompany rules, currencies, tax codes and reporting dimensions such as cost centers or projects. The design is checked against statutory reporting requirements in each jurisdiction and against the management reports the business needs. Your tax and accounting advisers should approve the tax configuration in writing. The output is an approved design document and a sign-off from the controller on account structure, which becomes the basis for every later mapping step.

  3. Map, cleanse and migrate legacy finance data

    Open balances, open receivables and payables, fixed assets, master data for customers, vendors and products, and historical transactions are extracted from the legacy system and mapped to the new chart of accounts. Duplicates, inconsistent tax codes and orphaned records are cleansed before loading, and the load runs in repeated trial migrations. Each trial ends with a reconciliation report that compares control totals, account balances and record counts between source and target. The output is a data reconciliation report that finance has accepted, with every exception listed and explained.

  4. Build configuration and integrations

    Consultants configure the approved modules, workflows, approval rules, access groups and reports, then build the integrations with banks, payment providers, payroll, e-invoicing or data warehouse feeds. Any custom code is kept in version-controlled repositories with peer review and is documented so it can survive version upgrades. The output is a configuration baseline recorded in source control and an interface specification for each integration, listing data fields, schedules and error handling.

  5. Test processes, user acceptance and parallel close

    Test scripts cover end-to-end processes such as order to cash, procure to pay, period close and financial reporting, followed by user acceptance testing run by the finance staff who will own those processes. A parallel close runs one full month or period in both the legacy system and the new platform, and the results are compared line by line. Security tests cover role-based access, segregation of duties and audit logging. The output is a user acceptance sign-off and a parallel close variance report with each difference resolved or approved.

  6. Execute a phased go-live

    Go-live proceeds by legal entity or by module, so the organization can stabilize one part of the ledger before the next moves. A cutover plan sets the freeze window, final data load, reconciliation checkpoint, rollback decision point and communications to users and partners. Go/no-go criteria are agreed in advance and reviewed by the steering group. The output is a signed go-live decision record for each phase and a post-cutover reconciliation confirming opening balances in production.

  7. Hand over with hypercare and a runbook

    After each phase, the implementation team provides hypercare support for issues found in live use, tracks each ticket to closure and transfers knowledge to the internal administrators. The handover package includes the runbook covering backups, restores, patching, user provisioning, monitoring, incident escalation and the upgrade procedure, along with the configuration baseline and integration specifications. Ask in advance who will provide support after hypercare ends, whether that is your internal team, an implementation partner under a retainer or the vendor. The output is an accepted runbook and a documented support model with named owners.

Where customization stops and upgrades start to hurt

Configuration uses the settings and workflows the platform already provides: chart of accounts, tax rules, approval flows, numbering, price lists, print templates and user roles. It stays within the standard data model, so vendor upgrades normally carry it forward with a regression check rather than a rebuild. The risk is less technical than organizational: many small configuration choices made during implementation become undocumented business rules that nobody owns.

  • Upgrade risk: Low in most cases, but settings can change meaning between major versions, so each one should be listed and retested.
  • Testing load: Moderate and mostly functional, covering month-end close, invoicing and approvals.
  • Who maintains it: The finance or operations process owner, with the implementation partner for changes that affect controls.
  • Documentation: Keep a configuration register that records each setting, its business reason and its approver.
  • Cost driver: Growth in configuration is usually the cheapest way to add scope, provided the register stays current.

Before signing a scope, ask the partner to show how configuration is recorded and how it is exported for review.

Reference architecture components and how they connect

A self-hosted ERP is a small set of tiers that depend on each other: users reach the proxy, the proxy reaches the application, and the application relies on the database, file storage, identity and monitoring. Each component below lists what it does, what your team must provide, and what a partner usually configures, so responsibilities are settled before the build starts.

Application tier and workers

The application server runs the ERP web interface, business logic and scheduled jobs such as invoice posting, email queues and reports. Background workers handle long tasks so users do not wait on them. Your team must provide the hosting account, the Linux baseline and a decision on how many application instances run per environment. A partner typically sets the Odoo or ERPNext process layout, worker counts, scheduled job ownership and the deployment method, and documents how a release is rolled out and reversed. Confirm the exact version of the chosen edition before pinning it.

Database and backup path

The database holds the general ledger, sub-ledgers, inventory movements and audit history, so it is the component that matters most in a restore. Your team must provide the database engine version your ERP supports, storage sizing, and the recovery point and recovery time targets that finance and audit have agreed. A partner usually configures scheduled backups, encrypted off-host copies, point-in-time recovery where the engine supports it, and a documented restore test run into a separate environment. Ask for a restore that has actually been executed, not only a backup job that reports success.

File and attachment storage

ERP systems store scanned invoices, purchase order PDFs, contracts and shipping documents as attachments that sit outside the database. These files need the same retention and access rules as the records they support. Your team must decide the storage backend, retention periods for each document type, and who may download attachments. A partner typically configures the storage path or object store, encryption at rest, backup of the file set alongside the database so the two stay consistent, and permission rules that match role design in the ERP.

Reverse proxy and TLS termination

The reverse proxy is the single entry point for users and integrations. It terminates TLS, forwards requests to the application, applies request size and timeout limits, and blocks paths that should never be public, such as database management screens. Your team must provide the certificate authority or certificate process, the DNS names, and the network zones that may reach the ERP. A partner usually configures the TLS protocol settings, HTTP security headers, rate limits for the login path, and separate routes for webhooks or API clients so they can be monitored and restricted on their own.

Identity and MFA integration

Single sign-on and multi-factor authentication decide who can post journals and approve payments. The FTC Safeguards Rule at 16 CFR 314.4 requires covered financial institutions to implement multi-factor authentication for any individual accessing any information system, so the ERP login path must enforce it or sit behind a gateway that does. Your team must provide the identity provider, the group structure that maps to ERP roles, and the policy for leavers and contractors. A partner typically configures the SSO connection, role-to-group mapping, session timeouts and an administrator account that is kept separate from daily users.

Monitoring and audit logging

Logs show who changed a vendor bank account, when a period was closed and which integration failed overnight. The FTC Safeguards Rule at 16 CFR 314.4 requires covered institutions to log the activity of authorized users, and the logs must be kept long enough to support investigation. Your team must provide the log retention period, the central log destination and the people who review alerts. A partner usually configures application and proxy logs to ship to that destination, alerts on failed logins and privileged changes, uptime checks, and dashboards for queue backlogs and backup job status.

Migrating finance data from a legacy system without losing the audit trail

The migration sequence determines whether the audit trail survives the move. Load opening balances first, because every later figure depends on them. Then map the legacy chart of accounts to the new one account by account, recording each mapping decision in a signed-off table that auditors can trace. Open receivables and payables follow, with invoice numbers, due dates and open amounts carried over exactly so that customer and vendor subledgers agree with the general ledger on day one. Bank statements and fixed asset registers come next, with depreciation schedules and disposal history preserved, not recalculated from scratch. Historical transactions are the last layer and the most expensive to carry. Decide how much history to load by asking which periods your external auditors, tax authorities and regulators may sample, and confirm the retention rule that applies to each record type with your compliance lead before you cut the history off.

Reconcile at every cut-over, not only at the final one. For each load, compare the new system's trial balance, subledger totals and open item counts against the legacy ledger as of the same cut-off date, and keep the signed reconciliation with the load file, the mapping table and the error log. Differences should be explained in writing and cleared before the next phase starts. Keep the legacy system in read-only mode after go-live, with posting locked and user access limited to a small named group, so that any question about a historical entry can be answered from the source. Confirm with your vendor or hosting partner how the legacy environment will be archived, who can restore it and how long it must stay available.

Retention obligations decide what must stay accessible after the migration, and they often outlast the software. For example, SEC Rule 17a-4(b) requires broker-dealers to preserve certain records, including bills receivable or payable, bank statements and originals of business communications, for not less than three years, with the first two in an easily accessible place. If your firm is a broker-dealer or follows a similar rule, confirm with counsel which records must be retrievable on demand, test that you can produce them from the new ERP or the archive within the required window, and document the retrieval procedure. Ask your implementation partner to show, before cut-over, how each record class will be found, exported and verified.

Build in-house, work with a partner or buy ERP SaaS

This table compares self-building on open source, open source with an implementation partner, and commercial ERP SaaS across data location, customization, upgrades, staffing and cost timing. Read each row against your own regulatory obligations and internal capacity, because the right model often depends on who must answer to an auditor for the ERP's controls. No prices are given here, since costs depend on scope, edition and hosting decisions that should be confirmed in writing for your environment.

Decision factorIn-house on open sourceOpen source with a partnerCommercial ERP SaaS
Control over data locationFull control. Data stays in your cloud accounts, data centers or air-gapped network, as your own architecture decides.Full control at the infrastructure level. Data remains in your environment; confirm which partner staff can access production and under what controls.Depends on the vendor's hosting regions and contract terms. Confirm data residency, subprocessors and exit terms before signing.
Customization freedomHigh. Your team can change code and modules, but every change becomes a maintenance item you own.High, bounded by the agreed scope. Custom work is documented and handed over, and limits are set in the written statement of work.Limited to the configuration and extension points the vendor exposes. Confirm which changes survive upgrades.
Upgrade ownershipYour team plans, tests and applies each version, including Community or Enterprise release changes.Shared. The partner can run upgrade testing and rollout under a retainer, while you approve timing and acceptance.Vendor-driven. Upgrade timing is set by the vendor, so confirm change notice periods and how you test before release.
Staffing neededFunctional ERP analysts, developers, database and infrastructure staff, and security engineers with ongoing capacity.A smaller internal team that owns business process decisions, data quality and approvals, plus the partner's delivery and support staff.Business administrators and a system owner. Technical operations sit with the vendor, though integration work may still need internal or partner resources.
One-time costsArchitecture, module scoping, data migration, custom development, testing and initial training, all carried by your budget.Discovery, fixed-scope build, migration, integration, hardening, documentation and handover, quoted from the written scope.Implementation and configuration services, data migration and integrations, often with separate vendor or consultant fees.
Recurring costsHosting, licenses where applicable, staff time, backups, monitoring, security patching and upgrade work.Hosting, any vendor licenses such as Enterprise editions, and an optional support or upgrade retainer.Per-user or module subscriptions, plus any add-on or usage fees the vendor sets. Confirm the renewal and price-change terms.
Cost drivers to watchNumber of modules, depth of customization, and how many people must stay trained to keep the system current.Scope changes, number of integrations, data quality issues found during migration, and support hours required after go-live.Number of users and modules, add-ons, integration volume, and contract length. Ask how fees change at renewal.
Evidence for assessorsYou must produce the change records, access logs, backup tests and monitoring evidence yourself.The partner can prepare controls and evidence, but you retain ownership of the control environment and any assessor-facing statements.Vendor attestation reports may cover parts of the service. Confirm which controls remain your responsibility under your own assessments.

What buyers ask before hiring an open source ERP partner

What drives the cost of an open source ERP implementation?

Scope is the main driver: the number of modules, the depth of process mapping, the volume and quality of legacy data, and the number of integrations with banking, payroll, tax and reporting tools. Costs fall into three groups: software licensing (zero for Odoo Community and ERPNext, which are open source, or a subscription for Odoo Enterprise), implementation services paid to a partner for planning, configuration, migration, testing and training, and hosting and operations inside your own cloud or data center. Implementation is usually one-time, while hosting, support and upgrades recur. Ask for a quote built from a written scope that lists each module, each integration, each migration source and each environment, so you can compare proposals line by line.

How long does an ERP rollout take and what sets the timeline?

The timeline depends on how many business processes change, how many entities, currencies and legal books the system must support, and how clean your source data is. A phased plan usually starts with finance and procurement, then adds sales, inventory, manufacturing or projects, with each phase going live only after testing signs off. Dependencies outside the project often set the pace: approvals from process owners, chart-of-accounts decisions, tax configuration, and access to the team that runs your current systems. Ask the partner to show phases, milestones and the assumptions behind each date in the written scope, and to name the decisions that must be made before build starts.

What does our internal team need to provide during implementation?

The project needs named process owners for finance, procurement, sales and operations who can make binding decisions quickly, a data owner who can extract, reconcile and approve legacy balances and master data, and testers who can run month-end and order-to-cash scenarios against real examples. Plan for regular time from these people throughout the project, not only at kickoff and go-live. Your team should also own access approvals, security policies for user roles and segregation of duties, and sign-off on the migration reconciliation. Confirm these commitments, the number of testing cycles and the owner for each sign-off in the written scope before work begins.

Can an internal IT team run an open source ERP without a partner?

Some organizations can, particularly where they have experienced administrators, a development process for customization and a tested backup and restore routine. Running it alone means your team owns the hosting, patching, database administration, security configuration, backups, upgrades, add-on compatibility and user support, and it also owns the knowledge when staff leave. Many buyers split the work: an internal team runs daily operations while a partner handles the initial build, hardening, documentation and periodic upgrades under a retainer. Assess your skills honestly against each of these tasks before deciding, and ask a partner to document the runbook so the handover is testable.

What does support look like after an open source ERP goes live?

Support after launch usually covers three areas: incident response for outages and failed jobs, routine operations such as monitoring, backups, restore tests and security patches, and change requests for new reports, workflows or integrations. DeployOpen offers ongoing support and upgrades as a retainer, which is agreed separately from the implementation scope. Ask any partner what response process applies, who holds the on-call duties, how changes are tested before production, and how documentation is kept current. Any service level figures should appear in the written agreement, not in a sales conversation.

How does Odoo Enterprise licensing change the ERP budget?

Odoo Community is the open source core published under the GNU LGPL version 3, while Odoo Enterprise is a licensed edition built on that core that adds features such as mobile apps, Studio customization, version upgrades and hosting. Enterprise therefore introduces a recurring subscription cost on top of implementation and hosting, and the budget should reflect the modules and users you need. Check whether the features you depend on sit in Community or Enterprise, and note that AI features in Odoo 20 require credits bought as in-app purchases. Ask the vendor for current pricing in writing, because this page does not state prices.

How should we handle upgrades to an open source ERP?

Plan upgrades as a recurring project, not a one-off event. Each upgrade requires a test copy of production, a review of custom modules and integrations against the new release, a reconciliation of key financial reports, and a rollback plan. Odoo Enterprise includes version upgrades as one of its listed features, while ERPNext and Community deployments depend on your own or a partner's process. Track the release cadence of your chosen platform, keep customizations in version-controlled code, and agree in the written scope who performs upgrades, how often, and who signs off on testing. Ask the partner to show a previous upgrade plan as an example.

Compliance evidence for financial institutions using self-hosted ERP

If your organization is a covered financial institution under the FTC Safeguards Rule, your ERP is part of the information system that the rule governs. The rule, codified at 16 CFR 314.4, requires encryption of customer information in transit over external networks and at rest. For a self-hosted Odoo, ERPNext or OFBiz deployment, that means confirming TLS settings on the reverse proxy and any external integrations, and confirming that database volumes, file attachments, backups and the replica used for reporting are encrypted with keys your team controls. Ask your implementation partner to show where each of those encryption settings lives in your configuration and who holds the key material. Multi-factor authentication is also required for any individual accessing any information system, so the ERP login, administrator consoles, database access and the server shell all need MFA. Confirm whether your chosen edition supports MFA or whether it must come from your identity provider or a reverse proxy in front of the application. Change management procedures and logging of authorized user activity complete the core set. Plan for a written change process covering module configuration, customizations, upgrades and data corrections, and make sure application audit logs, administrator actions and database changes are retained and reviewed.

Section 314.4(d)(2) adds a second obligation. Unless the institution runs effective continuous monitoring, it must perform annual penetration testing and vulnerability assessments at least every six months. For an ERP that holds general ledger, payables and customer financial data, that means scheduling authenticated testing of the application, its APIs and the underlying hosting, and retaining the reports and remediation records. Ask your partner to document what monitoring is in place today, because that answer determines which testing cadence applies to you. Your own compliance team should decide how that obligation is met, and whether a given monitoring tool counts as effective continuous monitoring under your program.

DeployOpen plans, implements, hardens and tests self-hosted platforms, and can prepare the systems, configuration baselines, change records, log exports and test evidence that an assessor will ask for. DeployOpen does not issue audit reports, attestations or certifications. Those come from the independent auditors and certification bodies you engage. When you scope the work, ask for a written list of the evidence each control will produce, the location where it is stored, the retention period you have set, and who in your organization owns its review.

Questions to ask an ERP implementation partner before signing

What exactly is covered by a fixed-scope ERP implementation quote?

A fixed-scope quote should list the modules, the number of users, the companies and currencies, the integrations, the data migration sources, the training sessions and the go-live support, each with a named deliverable. Ask the partner to show what is excluded, such as new custom reports, extra integrations or post-go-live fixes, and how a change request is priced and approved. The written scope should be signed before work starts, because the scope, deliverables and timeline are what you are actually buying. If a line item says only "implementation" without deliverables, ask for a breakdown before comparing quotes.

Which modules and customizations does the plan assume, and what happens if they change?

The partner should name each module in scope, such as accounting, inventory, purchasing or manufacturing, and state which standard features will be used without code changes. Ask which customizations are planned, whether they rely on configuration or custom code, and who maintains that code after handover. Ask how the plan handles a requirement discovered during design that the standard module does not cover. A strong answer describes a written process for assessing fit gaps, estimating the effort, and deciding whether to change the process or extend the software.

How will legacy finance data be migrated and who signs off the reconciliation?

The partner should describe how it will extract balances, open invoices, chart of accounts mappings, customer and vendor master data and historical transactions from the legacy system. Ask for the reconciliation method, such as comparing trial balances, subledger totals and open item counts by period, and for the named person on your side who approves each reconciliation before cutover. Ask how many dry-run migrations are planned and what happens to data changed in the legacy system between the last test and go-live. Without a written sign-off step, a migration has no clear finish line.

Which Odoo or ERPNext edition is quoted, and how are licenses handled?

Confirm which edition the quote assumes, because Odoo Community is the open source core, while Odoo Enterprise is a licensed edition built on it that adds features such as mobile apps, Studio customization, version upgrades and hosting. ERPNext is licensed under GPL-3.0 and is free to use, but the implementation and support services are paid separately. Ask for each license or subscription in the quote, who holds it in your name, the renewal terms, and the number of users it covers. A good answer separates software licensing from services and states what changes if you later switch editions.

How are upgrades planned and tested for a self-hosted ERP?

The partner should explain how it will test each upgrade in a staging environment built from recent production data, how custom modules will be checked for compatibility, and how a rollback will be prepared. Ask whether upgrades are included in a support retainer or quoted separately, and how often they are scheduled. For Odoo, ask whether the plan depends on Enterprise upgrade tooling and how that is licensed. Ask for an example of the upgrade runbook and the change control record that will be kept for each release.

What are the support hours, response paths and escalation steps after go-live?

Ask for written support hours, the severity definitions, the channels for reporting an incident, and the escalation path from first-line support to engineering. Confirm whether support covers the platform, the customizations, the integrations and the hosting layer, or only some of them. Ask who is on call for month-end close and how urgent issues during that period are handled. Support terms should be written into the contract with clear response expectations, and any figures for response or resolution should be stated explicitly in the signed agreement.

How often are backups restored and tested, and who runs the test?

A backup is only useful after a restore has been tested. Ask the partner which data stores are backed up, including the database, file attachments and configuration, how often backups run, where they are kept, and how long they are retained. Ask for the restore test schedule, the success criteria, and whether the test includes a full application restore into a separate environment. Records that must be kept for regulated finance activity, such as those described in SEC Rule 17a-4(b) for broker-dealers, should be part of the retention design, so ask how retention is set and who confirms it with your compliance team.

Who holds the administrator credentials and access after handover?

Ask the partner to confirm in writing which administrator accounts will be created, who will hold the root, database and application admin credentials at handover, and how those credentials are stored and rotated. Ask whether multi-factor authentication is enforced for every administrator and how access is logged and reviewed. Your organization should hold the primary administrator access, with the partner's access granted through a documented, time-limited process. Confirm the offboarding steps for any partner staff who leave the project, since this is a common gap in handover.

How DeployOpen scopes, builds, hands over and supports your ERP

DeployOpen plans, implements, customizes, integrates, hardens, backs up, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For an ERP, that means a written scope that names the modules, data sources and controls before any build work starts, followed by delivery in phases your finance team can test and sign off.

How we scope

  • Confirm which modules are in scope, such as general ledger, accounts payable, inventory or manufacturing, and which are deferred
  • List legacy finance systems, data sources and reports that must be migrated or replaced, with named owners for each
  • Record customization limits, integration endpoints and the edition decision between Odoo Community, Odoo Enterprise or ERPNext in writing

How we build

  • Configure chart of accounts, tax rules, approval workflows and user roles against the signed scope, not an open-ended backlog
  • Test data migration in repeated trial loads with reconciliation of balances, open items and historical transactions before cutover
  • Harden hosting, enforce multi-factor authentication, encrypt data in transit and at rest, and enable audit logging for user activity

How we hand over

  • Deliver runbooks for installation, backup and restore, upgrades, user administration and change management procedures
  • Document configuration decisions, custom code, integration interfaces and the reconciliation evidence produced during migration
  • Run structured knowledge transfer so your administrators can operate the system and review the controls it supports

How we support

  • Offer ongoing support, upgrades and continuous testing as a retainer, with scope and response terms agreed in writing
  • Plan version upgrades and test them in a staging environment before production, including customizations and integrations
  • Schedule periodic penetration testing and vulnerability assessments so the ERP stays inside your security review cycle

Talk to our team.

Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.

  • 30-minute call: free, with no obligation.
  • NDA on request: we can sign before you share details.
  • Clear next steps: a scope and plan after the call.