Open core
Odoo's core is open source; depending on the project, community, enterprise and Corelane modules combine. Open APIs, exportable data – and the freedom to leave.
Architecture & technology
CRM, ERP, store and communication are not synchronised systems – they are one system. Odoo on PostgreSQL is the data truth. Everything else docks on.
Why Odoo
Odoo's core is open source; depending on the project, community, enterprise and Corelane modules combine. Open APIs, exportable data – and the freedom to leave.
The entire company state lives in one proven relational database. Consistent, transactional, restorable – one backup contains the whole company.
The world's most popular programming language – number 1 in the PYPL index for years – and the language of the AI ecosystem. Extensions, integrations and AI workflows speak the same language, and developers are easy to find.
From accounting to the warehouse: modules share one data model instead of exchanging data over interfaces.
The extended stack
AI, search and storage run beside the core – never inside it. They read context from the platform and write back through controlled interfaces with human approval.
The data truth: master data, transactions, documents and communication in one transactional context.
AI agents work outside the core and hand results back for human approval – steered from the Corelane AI Cockpit.
Semantic search and retrieval-augmented generation over your own documents and knowledge.
Faceted, fast product search across catalogues with 100,000+ products.
Images, documents and generated assets – versioned and EU-hosted.
Operations on our own European infrastructure – full control over data, backups and recovery.
Fast sessions and caching for a responsive platform under load.
The AI construction kit
Every Corelane agent is assembled from six proven building blocks. What varies is the task – the kit stays the same.
The language model is configuration, not architecture: leading providers, European alternatives or local models – interchangeable per workflow.
Reusable abilities instead of one-off builds: extraction, matching, drafting – tested once, used by many agents.
Controlled tool access: agents reach platform, search and data only through defined MCP interfaces – never directly.
LangGraph teams with review loops instead of a single prompt: scouts, writers and reviewers check each other.
Retrieval from your own sources, context preserved across runs – the agent knows the case, not just the question.
Every effect passes through the cockpit: people approve, budgets meter, the audit trail records.
Not a chatbot experiment: this kit produces at STASTO in daily operations.
Security architecture
Public traffic never reaches the core directly: it is filtered at the edge, passes a hardened security layer and only then reaches the platform.
Public traffic
Filtering & WAF
Firewall, reverse proxy and VPN for locations
Not directly reachable from the internet
Every external access passes filtering and security layers before it reaches a core system.
Business-critical systems run in our own cluster on European infrastructure – data, availability and evolution stay in one hand.
Automated backups up to offsite copies are part of the architecture, not an add-on.
Sovereignty & governance
The platform and its data run on European infrastructure under GDPR; external AI models are swappable add-on services – never the data store.
Every AI action is logged and traceable. Decisions with business impact are made by people, not models.
Open formats, an open-source core and your data in one database – exportable at any time.
Data sovereignty gets discussed for the ERP. Mail, calendar and contacts have usually been with a cloud provider for years – although that is where the company's entire correspondence sits. At Corelane the same principle applies to them as to the rest of the platform.
Postfix, Dovecot and SOGo on standard protocols – IMAP, SMTP, CalDAV, CardDAV. Outlook, Thunderbird, iOS and Android connect as usual.
Mailboxes, aliases and delegations are maintained on the employee record in Odoo instead of a second admin console. Joining and leaving stay one process.
Spam and malware filtering runs on a specialised commercial service ahead of the mail servers. Operating the transport yourself does not mean operating the threat defence yourself.
Mail and calendar are part of the platform rather than a per-seat subscription, and the mailboxes stay exportable in open formats.
At STASTO this carries 205 active mailboxes across eight domains; 106 of them are tied directly to their Odoo user.
The next step