Customer data, masked until someone proves they should see it
PIN-gated masking for customer phone and email on Contacts, with a real audit trail, brute-force lockout and per-company PIN policy — the compliance controls no competing masking app ships.
The problem
Every internal user who can open a Contacts record can read, copy and export its phone number and email address — regardless of whether their job needs it. In call centers, shared workspaces and multi-company groups this makes customer PII openly readable by rotating or low-trust staff, and when a data-protection officer asks who can see this data and why, there is no honest answer. Odoo's native record rules and field access are all-or-nothing and hide whole records, not one sensitive field on a record a user otherwise needs.
The solution
Phone and email are masked by default on every contact, in both the form and the list view. A user who genuinely needs the real value enters a per-company PIN in an unlock dialog; the module verifies it, grants a time-limited session, and writes an audit-log row recording who unlocked what and when. Wrong PINs are logged and rate-limited into a lockout, the PIN itself can expire and be rotated, and a dedicated bypass role is kept separate from the administrator role — so admins can still demonstrate the masked state.
Everything a compliance-minded admin needs
Every capability below is implemented in the module.
PIN-gated masking on form & list
Phone and email are masked on every contact by default, in both the Contacts form and the list view, so protection cannot be bypassed by switching views.
Inline unlock, no page reload
A verified user reads and edits the real phone and email inline, right on the contact record, without leaving the page or hunting for a separate screen.
Partial reveal option
Show only the last digits of a phone number or the first character of an email instead of a full mask, letting a user confirm a match without a full unmask.
Append-only audit log
Every unlock, failed attempt, lockout and PIN rotation is logged with user, contact, fields revealed and timestamp — a readable record an admin can hand to a data-protection officer.
Brute-force lockout
Failed PIN attempts are rate-limited; after a configurable number of failures the PIN locks out for a configurable cooldown, so the gate cannot be guessed open.
PIN expiry & rotation
Set a PIN to expire after a chosen number of days and rotate it from a dedicated wizard, so a shared or leaked PIN does not grant permanent access.
Configurable session timeout
A verified unlock stays valid for a configurable number of minutes, then automatically lapses back to masked — balancing usability against exposure.
Per-company PIN policy
Each company sets its own PIN, session timeout, lockout and expiry policy, so a multi-company database keeps every branch isolated and independently configured.
Separate administrator & bypass roles
An administrator role configures the PIN, policy and audit log without automatically seeing unmasked data; a separate, opt-in bypass role is for trusted users only.
How it works
Admin sets the PIN
An administrator opens Data Masking Settings, sets the company PIN and policy (timeout, lockout, expiry, partial reveal).
Contacts load masked
Every contact opens with phone and email masked, in both the list and the form, for any user without the bypass role.
User unlocks with PIN
A user clicks Unmask, enters the PIN in the dialog; a correct PIN grants a time-limited session and logs the unlock.
Admin reviews the log
The admin opens the Audit Log at any time to see every unlock, failed attempt, lockout and PIN rotation, with who and when.
Frequently asked
No sales fog. If your question isn't here, email us and we'll answer it the same way.
Phone and email on Contacts (res.partner) are masked in v1, in both the list and the form view. The masking logic is field-generic in the code, so additional fields can be added in a future release.
Buy it on the Odoo App Store
Purchase, download and install directly from the official Odoo Apps Store — you'll always get the latest supported build.
Customer Data Masking With PIN
Phone and email masked behind a PIN on form and list and unlocked inline without a page reload — with an append-only audit log, brute-force lockout and per-company PIN expiry and rotation.
Buy on Odoo App Store