One app per need.
One client record.

A meeting gets prepared, gets held, then gets lost. The agenda sleeps in an email, the decisions in somebody's notes, and six months later nobody knows who settled what.

An agenda prepares the meeting to come: its objectives, its topics with their duration and their speaker, the action items to discuss. A report tells the meeting held: the topics covered, the decisions with the person who made them, attendance, and the verbatim. Both attach to the same calendar event and the same project, with no re-entry.

⚠️ Follow-up works by exception: a meeting is presumed to deserve an agenda and a report, and the list shows step by step where each one stands. That is the opposite of the usual reflex, which shows only what was done and leaves the rest invisible.

Open tasks on the project can invite themselves to the next meeting. Decisions are filed into the knowledge matrices, where people will look for them. The report comes out as a PDF in your image, ready to send.

Audio capture and transcription go through a processor you host, not through a third-party service.

Comparable to Otter.ai + Fellow.app, integrated

bf_meeting · Version 18.0.3.72.0 · Guide chapter · View the source

1 add-on module

Meeting timerKnow what time the meeting will actually end, while there is still time to do something about it.

An agenda already carries its topics and the minutes allotted to each. Nobody knows where those minutes go: the plan is built to fill the calendar slot, and the report never says the first topic ate half of it.

The panel sits above the notebook on the agenda and stays in view while notes are being typed. It shows the projected end against the planned end, the running delta, what the topic just closed cost, and what is still allotted to the ones not yet covered.

A topic picked up again later sums its visits, one born mid-meeting is timed like the others, and a topic nobody had time for says so. At the end, the real time of each topic stays on the agenda and the report prints it.

bf_meeting_timer · Version 18.0.1.5.2 · Guide chapter · View the source

An email that matters ends up pasted into a task, or nowhere at all. Between the inbox and the file there is a copy-paste nobody enjoys and everybody forgets.

The mailbox brings two sources into one list. Your IMAP account, polled every five minutes, and Symbifox itself: every email sent from a message thread or received by the organization's gateway is projected there too. The two meet on the message's unique identifier, so one exchange never appears twice.

Filing to a record attaches an email to the thread of whatever it is about: the task, the ticket, the contact, the opportunity, the invoice. Two clicks, and the exchange lives where someone will look for it in six months.

Connecting a mailbox starts with two fields: you type the address, and the assistant finds the server, the port and the way in. Nothing is created until the connection works. Microsoft 365 refuses every password: each person gives their own OAuth consent, for their own mailbox.

⚠️ Accounts are per person, never under the admin account. A mailbox polled by a shared account makes everyone's mail readable by everyone, which is neither intended nor fixable afterwards.

Works with Migadu, Microsoft 365, Gmail and any standard IMAP server.

Comparable to Outlook or HubSpot Inbox, inside Odoo

bf_email_management · Version 18.0.11.64.2 · Guide chapter · View the source

The links already exist in your database: booking, secure drop, meeting room, email, phone. The page resolves them at display time rather than copying them.

That is the whole difference. When someone's booking link changes, their page follows, and the QR already printed in their signature keeps pointing to the right place, since it encodes the page's address and not the link's. A hosted link-page service cannot do that.

Three kinds of page. One per employee, created and refreshed without intervention. One per client organization: the entry point you send when a engagement opens, with who to talk to, where to drop a document and where to find their things on the portal; its address is drawn at random rather than derived from the client's name, and it carries an expiry announced to the advisor before it falls. And a one-off page, with no owner, armed with an expiry from the moment it is created.

⚠️ A portal link only shows if someone at the organization actually has an account: a button that opens nothing but a login screen is the worst link in a welcome email.

Five looks, light or dark theme according to the device, FR/EN switch, and a branded QR whose legibility is measured rather than assumed.

Comparable to Linktree or Carrd, wired to your real records

bf_linkpage · Version 18.0.10.1.0 · Guide chapter · View the source

An email signature gets pasted as HTML, from workstation to workstation, and nobody knows which one is current any more. The day the phone number changes, it changes in fifteen places or in none.

Administration picks one template per company, and every signature follows from it: name, title, pronouns, phone numbers, logo, colours, booking links. Editing the template regenerates everyone, so nobody has an HTML block to keep.

The signature can be enforced, which is the only way to guarantee one that is up to date.

⚠️ On a multi-company database, an email sent from a record signs in that company's colours, not those of the company the person belongs to. This is the case that defeats the other tools: they sign from the sender, while the recipient reads from the file.

No relay server to install: rendering happens inside Symbifox, at the moment of sending.

Comparable to Exclaimer or CodeTwo, without the relay server

bf_multi_company_email · Version 18.0.5.0.3 · Guide chapter · View the source

Texting stays the fastest channel and the least documented. The exchange that settles an appointment lives on a mobile, and the file keeps none of it.

A line is a number attached to a person in the organization. A conversation groups everything exchanged with one number, messages on one side, calls on the other. An attachment places the trace of a message or a call in a record's thread, a task or a ticket for instance.

SMS and MMS go out and come in live through VOIP.ms, from a conversation space built into Symbifox, with an unread counter in the top bar. Your Android backups and your call history import, which brings what already exists in rather than starting over.

⚠️ Everything that enters here belongs to someone. A line has an owner, and the conversations held on it are their data. A thread marked confidential leaves the lists and the searches and stays with the person who holds it.

bf_sms_archive · Version 18.0.5.27.4 · Guide chapter · View the source

An official letter still comes out of a word processor too often, with the address retyped by hand from Odoo and the letterhead caught up from one version to the next.

Here the letter brings together the sender, a recipient drawn from your contacts, the date, the salutation, the body and the closing. It takes a reference on finalisation, and at that moment the recipient's name and address freeze as they stood that day: an address corrected next year does not rewrite the letter that went out.

Three objects prepared in advance do most of the work. A template carries a standard subject and body with merge fields replaced by the recipient's values. A text block is a reusable paragraph, filed by category and recalled by a shortcut. The letterhead decides the dressing of the page, from a dark banner to paper already printed.

⚠️ The dressing is locked. The author picks the layout, never the colours or the logo, and each company on the instance issues its letters in its own image. That is the only way correspondence stays recognisable when ten people write it.

Comparable to Word + mail merge, plugged into your Odoo

bf_letter_writer · Version 18.0.2.1.1 · Guide chapter · View the source

Offering a time by email costs three round trips and often lands on a slot already taken elsewhere.

An appointment type carries everything that repeats: the duration, the place, the calendar consulted, the emails sent, the form put to the requester. A resource is whatever has to be free for the meeting to happen, a person, a room, a vehicle; a combination groups what has to be free at the same time.

A slot offered to a visitor is therefore a computation, never a list written in advance: the availability calendar opens the range, the combination confirms it, and the diary withdraws it the moment it is taken. Availability comes from your real calendar, not from a copy someone has to keep current.

The page is published on your domain, in your colours. Every confirmed booking places the event on the calendar, sends its invitation, creates the contact record with its language, and can open a project task. The intake form asks its questions before the meeting rather than during it.

The confirmation carries a Reschedule this appointment link, offered as long as the deadline allows: the client picks another time instead of cancelling and booking again. They receive the old and the new time, and the organizer hears about a move, not a new booking. On your side, a booking moves from the calendar or from its form, and keeps its resource. Outside the hours offered to clients, only a manager can move it.

The consents collected along the way are the Law 25 ones, kept with the booking: taking an appointment gathers personal information, and the tool treats it as such.

Comparable to Calendly or Cal.com (your data, your domain)

bf_appointment · Version 18.0.2.66.2 · Guide chapter · View the source

3 add-on modules

Availability PollsPropose several slots, collect the answers, book the meeting in one click.

Setting a meeting for six people costs a dozen emails, and the slot chosen often turns out to be no longer free in the organizer's diary.

The organizer proposes slots already free in their calendar. Each invitee answers slot by slot, yes, if need be, no, from a page that reads on a phone and in their own time zone.

A slot stops being viable as soon as a required person answers no: that is what separates a useful poll from a grid of boxes to count by hand.

⚠️ Proposed slots do not block the calendar. Public bookings keep coming through while the poll runs, because holding six slots to keep one would make the calendar unusable every other week.

On closing, the meeting goes out the usual way: calendar event, .ics invitation, video room, reminders.

bf_appointment_poll · Version 18.0.1.18.1 · Guide chapter · View the source

Agenda at bookingCreate the meeting agenda when the appointment is booked and give the requester its link.0:58

Create the meeting agenda when the appointment is booked and give the requester its link.

bf_appointment_meeting · Version 18.0.1.2.0 · Guide chapter · View the source

Property showingsShow a property: the seller's time slots, a showing register, approval, occupied units.1:00

Show a property: the seller's time slots, a showing register, approval, occupied units.

bf_appointment_visit · Version 18.0.1.2.0 · Guide chapter · View the source

Deleting and archiving a meeting both send it to the same trash, where it can be restored or deleted for good. A meeting kept in Nextcloud leaves it too, and therefore Thunderbird and the phone, and goes back there on restore if nothing changed there in the meantime. One deleted in Nextcloud or Thunderbird lands in the trash as well. A series cut short comes back whole, and the trash sends no email.

Comparable to Google Calendar's trash, without the automatic purge after 30 days

bf_calendar_trash · Version 18.0.1.0.2 · Guide chapter · View the source

Symbifox becomes the calendar and contacts server of your apps, with one password per device that opens only the calendar and contacts, and is revoked in one step. Each person files their meetings in several calendars, each in its colour, in Symbifox as on the phone. A reminder dismissed in Thunderbird is dismissed on the Mac and in Symbifox too, without rewriting the meeting or writing to anyone. Only Symbifox sends invitations: nobody gets two. The company address book and a personal one follow on the phone, and a contact deleted on the phone is archived in Symbifox, never erased.

Comparable to Nextcloud Calendar and Contacts, without the separate server

bf_dav_server · Version 18.0.1.2.2 · Guide chapter · View the deck (PDF) · View the source

A round button at the bottom right of the screen opens the handset: keypad, search for the person to call by name, call history, mute and hang up. An incoming call shows the contact's name and a link to their record, and any number shown in Symbifox dials in one click. Every call goes to the call log, and a missed call creates a callback activity, an option each person can switch off. From the mobile app, the phone system rings your phone, then dials the client, who sees the business number rather than yours. The phone relies on the Asterisk phone system you already run.

bf_softphone · Version 18.0.2.11.1 · Guide chapter · View the source

The calendar's quick create opens on one button per block type: Focus, Production, Meeting slot and Catch-up. One click sets the title, the colour and the availability: busy, so online booking no longer offers that time, or available for a meeting slot, which opens time instead of closing it. The type's pictogram comes before the title in the grid, a filter keeps only the blocks and a grouping counts them by type. The type follows the block into Nextcloud, and from there into Thunderbird, Apple Calendar and the phone. On a colleague's private meeting, the type stays hidden like the title.

bf_calendar_block · Version 18.0.1.1.0 · Guide chapter · View the source

From the meeting, Hold slots opens the calendar on its week: every time drawn there is held for it, hatched, in its own colour, with the meeting's name as its title. A held slot counts as busy, so online booking offers it to no one, and it invites no one. Once the guest has answered, Choose this slot moves the meeting with its duration, attendees, agenda and video link, and releases the other slots, in Nextcloud too. Slots are also released when the meeting is cancelled, and every night once their time has passed.

bf_calendar_hold · Version 18.0.1.0.3 · Guide chapter · View the source

For all colleagues, then colleague by colleague, four levels: availability only, titles and locations, all details, or edit. It is a display setting: what must stay secret is marked private. Outside the company, a link to your calendar, with no account to create, subscribes in Outlook, Google Calendar, Apple Calendar or Thunderbird, gives busy times only, or shows a web page of the next four weeks. A link never shows attendees or video call links. It expires after 90 days, with a reminder seven days before, is extended or revoked in one step, and every opening is logged.

bf_calendar_share · Version 18.0.1.1.4 · Guide chapter · View the source

A dated period on the contact record, with the stand-in: who to write to in the meantime.

The banner shows where the work happens, on the chatter of a task, an opportunity or a record, not only when you hit send. One click schedules the message for the morning after they are back, and a reminder returns that day carrying the subject of the last exchange, so there is something to say beyond “just checking in”.

A shutdown recorded on a company warns for every one of its people, and the collective holidays of a trade, published a year ahead, are seeded in one pass.

The module also reads what already exists: the out-of-office replies arriving in your mail, and the calendar where you noted those holidays by hand before there was a module. It takes the period out of them, proposes it, and never writes anything on its own.

⚠️ Nothing is ever blocked: writing to someone on holiday is often exactly what you want, so that it is waiting for them.

Comparable to The out-of-office detection of Salesloft or Outreach, taken out of the outbound cadence

bf_contact_absence · Version 18.0.1.1.0 · Guide chapter · View the source

An outreach campaign rarely fails for lack of effort. It fails because a target slips between two follow-ups and nobody notices.

A campaign brings together a list of targets, a cadence and the tracking of each file through to its conclusion. A target is a file: an organization or a person, their contact, their details and their history. An interaction is a logged contact, call, email, letter, text or meeting, with its direction, its outcome and a summary.

⚠️ The cadence belongs to the campaign, not to each person's discipline. It sets, per channel, how many contacts to make and at what interval; the module derives each file's next contact date and shows at all times who is overdue, who has never been reached, and who has replied.

A request not to be contacted propagates to every campaign, present and future. An opt-out that only held for the current campaign is not an opt-out.

Replies received, calls actually made and appointments booked record themselves.

Comparable to Lemlist or Salesloft, inside your Odoo

bf_outreach · Version 18.0.1.5.1 · Guide chapter · View the source

Odoo's blog knows whether a post is published or not, and nothing else: not its pillar, not the cadence of the stream, not what blocks what, not whether the translation has kept up.

An editorial entry carries its angle, its promise, its target keyword, its verified sources and the list of what is left to do. A calendar is a stream with its rules: target cadence, word floor, required languages, pillars with their intended share.

⚠️ The design principle fits in one sentence: store only the decisions, compute everything else. The date of the last publication, the ratio per pillar, the word count, language completeness are never typed in, so nothing drifts.

A button proposes the next piece to ship and explains every point of its ranking, rather than handing down a verdict. A pre-flight guard refuses publication until the list is green, and it holds for a scheduled publication too: that is precisely the one nobody thinks to check.

The style and accessibility checks are plain rules, with no AI model: they always run, including when the network is down.

Comparable to A Notion or Airtable editorial calendar, wired to your blog

bf_editorial · Version 18.0.1.11.0 · Guide chapter · View the source

On the road, the order gets redone every morning, a visit leaves no trace and sales get copied out at night.

A route is set up once: its stops in order, their time windows, the person, the vehicle and the days it runs. Route days are created ahead of time, and a day the office has edited is never overwritten.

The order of the stops, the distance and the planned times come from an engine you host (OSRM and VROOM): only coordinates are sent to it.

On the phone, My route shows the day and marks each stop: done, customer absent or postponed, with the time and a note. Without signal, the mark waits and goes out as soon as the network is back.

Mileage comes from the odometer: a printable mileage log of the business trips, and customer coordinates found by a map you host yourself.

⚠️ Positions at stops are off by default. Turned on, a position is read once, when a stop is marked, after a notice to read (Quebec's Law 25), and erased when due.

bf_route · Version 18.0.1.2.0 · Guide chapter · View the deck (PDF) · View the source

Two questions nobody knows where to write down, which end up in a diagram file that is out of date the day it is finished.

The first is the reporting line: a “manager” field on the record, distinct from the company the person belongs to, because working for someone and reporting to someone are two different facts. A subsidiary head who answers to the group director is a real structure: entry flags it, it does not refuse it, and the drawing shows the link with the employer's name under theirs.

The second is ownership: who holds which company, for what share, in which share class, voting or not, since when and where the information came from.

⚠️ The percentage lives on the link, not in the box, which an ordinary tree cannot carry: a company has several holders, each for a share. One hundred percent is never required, because a half-known structure is the normal case for a prospect. What is refused is the closed circle, almost always a holder and a holding swapped round.

Both drawings come out in the same place: a screen you expand and collapse, and a vector PDF in your organization's colours. A structure too deep to fit the page says so, instead of truncating in silence.

Comparable to A diagram tool, without the file that ages the day it is finished

bf_org_chart · Version 18.0.1.2.0 · Guide chapter · View the source

A ticket carries a number, a subject, someone asking and a priority. Odoo can keep that list. What it cannot tell you is why a file has been asleep for six days.

This module adds a waiting state independent of the stage: a ticket can be “in progress” on the team's side and blocked at the client's or a third party's. Service deadlines count business hours of the team and pause while the client is the one expected to answer: otherwise the team would carry a delay that is not theirs.

Agents work from their teams' queue, sorted by deadline. Their macros fill in the client's name and warn them if someone answered in the meantime. The Client 360 tab shows the client's other tickets, hour bank and last survey, and the form tells which colleague is looking at it at the same time. Time logged on the ticket draws down the hour bank, with no double entry.

For the client: a public form per team, in your colours, a readable status in the portal, an acknowledgement, reminders when it is their answer that is awaited, a satisfaction survey and a public help center. Emails go out in your brand, in the client's language. ⚠️ Everything is switched on team by team: nothing reaches a client until you have set it up.

The AI triage button proposes a category, a stage, a person and a draft reply, which the agent accepts or dismisses; the ticket's text is sent to the AI model to do so. Two add-ons bring duplicate merging with parent incidents, and a section in the morning digest. Symbifox extends the OCA helpdesk_mgmt module here rather than building a separate product: what comes from Odoo stays Odoo.

Comparable to Zendesk or Freshdesk, small-business flavor

bf_helpdesk · Version 18.0.4.15.6 · Guide chapter · View the source

Writing to a contact means remembering things that are written down nowhere: whether to address them formally, that their assistant must be copied, and that their partner asked to be left off.

Every contact carries their register, their salutation, their closing, and what you should know before writing. As you compose, the banner reads the recipients themselves, in To and in Cc, and recalls who should be copied, who usually is, and who asked not to be. The button adds the copies to the right field.

⚠️ Copy rules are proposed, never applied: they are inferred from emails actually sent, with the observation that motivates them, and nothing moves before you confirm. A copy added automatically eventually sends bad news to the wrong person.

The relationship is measured daily on the messages themselves: your emails left unanswered, the length of what you write, the last exchange in each direction. Those are facts, not an invented score.

Paired with the client experience module, the persona also shows the contact's latest rating and their comment, right where you are writing to them.

Comparable to Salesforce Einstein Insights, small-business and open-source flavor

bf_persona · Version 18.0.3.3.0 · Guide chapter · View the source

A contact book degrades on its own. Titles change, numbers change, and nobody opens a record to correct an extension they never dial.

Scan a business card, enrich a contact from the signatures in their emails, one at a time or in bulk, create a contact from an email received, import vCards, spot duplicates.

At a trade show or on a visit, scanning lives on an installable mobile page: an address to open, no app to download, and it is the phone's camera that takes the card.

A company created in a hurry often has nothing but a name: Gen looks it up online and suggests its website, phone and address, with the sources it read. You review, then apply. For a person, a LinkedIn search suggests their profile; only workplace details are kept.

⚠️ Enrichment never replaces a value already entered, and every addition is logged. That is the one rule that makes the automation acceptable: a tool that overwrites a hand-corrected number gets switched off within a week.

A completeness score highlights the records worth finishing, rather than leaving you to hunt. Model calls go through your instance's assistant service, towards the model provider, currently Anthropic, in the United States; the signature or domain being analysed is sent to it.

Comparable to Clearbit or Dropcontact, open-source and self-hosted

bf_contact_enrichment · Version 18.0.2.5.0 · Guide chapter · View the source

The certificate an online course hands out usually carries the software's colours, the date the attempt started, and a sequential number nothing can verify.

This one takes the brand of the company of the course's website — three layouts to pick from (panel, minimal, classic) — with logo, font, the signatory's signature, the course's name rather than the questionnaire's title, and the completion date written out, in the learner's language. On a multi-company database, every brand issues its own.

Every pass receives a random, unguessable number, printed with its QR code: whoever holds it can confirm the certificate on a public verification page, with no account, and no email address ever shown. A button on the participation withdraws the number at the person's request.

The congratulations email, matching the chosen layout, PDF attached and verification link included, ships turned off: you switch it on course by course.

Comparable to Accredible or Certifier, without the external service

bf_survey_certificate · Version 18.0.1.1.0 · Guide chapter · View the deck (PDF) · View the source

Getting a document signed costs a subscription per user, or a printout, a signature and a scanner. Both routes take the document out of your system.

A signature request brings together a PDF, one or more signers and fields placed on the pages: signature, initials, date, name, email, text, number, checkbox, one box per character, dropdown. Each signer receives a link of their own and needs no account.

When the last person has signed, the document is sealed: a PAdES digital seal that PDF readers show as “signed and not altered”, a completion certificate, and an immutable audit trail with timestamp, address, SHA-256 fingerprints and optional RFC 3161 timestamping.

⚠️ The public verification page is what makes that trail hold up. The third party who receives the PDF drops their copy on it and sees whether it matches, computed in their own browser, with nothing uploaded: they do not have to trust you in order to check your document.

An optional QR code stamped on the document leads there. Send a quotation, a purchase order or a corporate resolution in one click.

Comparable to DocuSign or Odoo Enterprise Sign, inside your Odoo

bf_sign · Version 18.0.3.30.0 · Guide chapter · View the source

Measuring satisfaction is easy. Not wearing the same people out while doing it, and doing something with the result, is a great deal harder.

A feedback is a register entry: a score, a comment or both, with its date, its channel and the client concerned. A programme links a survey to a measurement intent and sets the invitation template, the reminder delay and the minimum cadence between two solicitations.

⚠️ The guardrails are global, not per programme: a cooldown per contact across all channels, a Do-not-contact list, and the exclusion of files in collections. Three programmes each respecting their own rules can, together, write to the same client four times in a month.

The NPS score is computed over an honest window and stays hidden below ten responses: a score on three responses is not a score, it is an anecdote with a decimal point.

The closed loop on detractors carries a deadline. The complaints register follows ISO 10002: a real acknowledgement, root cause, satisfaction follow-up. Testimonials stay locked until a consent has been recorded.

Comparable to Qualtrics or Delighted (the essentials, in your Odoo)

bf_cx · Version 18.0.1.13.1 · Guide chapter · View the source

The name shown on a record is the preferred name, the one emails, mentions and search read. The legal name, when it differs, lives in a field only a small group can see, empty on installation and never tracked in the thread; only the documents that require it read it, such as an electronic signature or a donation receipt. People enter their pronouns and grammatical gender on the portal or in their preferences. Nothing is guessed from a first name: left empty, text about them is written in gender-neutral language. Change preferred name renames the contact, and their employee record, without leaving the former name in the history.

bf_preferred_name · Version 18.0.1.1.1 · Guide chapter · View the source

A timesheet filled in after the fact is a guess, and work done with several assistants running in parallel gets entered end to end.

Whoever switches it on themselves, after reading a notice (Quebec's Law 25, s. 8.1), sees their rebuilt hours day by day, from the only traces that prove a human hand: keyboard or mouse in Odoo, accepted meetings and, with the linked modules, notes, emails sent, prompts to Gen, attendance marked in meetings and timer stretches. Each minute counts once, and every day shows its low and high bound next to the hours entered.

Their indicators (span of the day, longest stretch, meetings, time outside working hours) are switched on separately, and so is taking in their earlier days from before activation: the last 30 days or all the history kept, under a notice of its own.

⚠️ Nobody else sees anything, managers and administrators included, except the colleagues the person names through a share they can revoke. No score, no ranking. Switching off destroys the traces and the days.

Comparable to Activity trackers such as Hubstaff or Time Doctor, which measure the team for the employer: here the measure belongs to the person first, and nothing is seen without them.

bf_work_hours · Version 18.0.1.1.0 · Guide chapter · View the deck (PDF) · View the source

A news watch kept through RSS usually ends up in one person's reader, forwarded by email when they think of it. The rest of the team sees nothing, and the client even less.

Each list reads sources and sorts them by rules: exclusions first, then industry terms, specialised issuers, sources taken whole. The reason is written under every item kept. AI sorting can follow the rules, on what they kept only.

Watched topics search the news for your company's name, a brand or a client, each through its own search, and AI sets namesakes aside by reading who the topic is. When an item cannot wait for the digest, an alert goes out by email right away, behind guards kept in code: recent news, one email per event, a daily cap.

A list is addressed to a department, a project or named people, and its audience is computed: whoever joins the team receives it, whoever leaves stops. Everyone reads their news as cards, in a Discuss channel or in an email digest, and what they read clears from their pile, for them alone.

A secret link shows a project's watch to a client with no account, as a public page or as RSS, with an expiry date and revocation.

Comparable to Feedly or Inoreader, without the per-seat subscription or the watch asleep in one person's reader

bf_flux · Version 18.0.1.2.3 · Guide chapter · View the source

A process map gets delivered as a PDF, filed in a shared folder, and stops being true at the first change. Six months later, it gets redone.

Here the pools, lanes, nodes and flows live as records, attached to a client and a project, versioned. The model governs: the PDF, the .bpmn and the .drawio are only renderings of it, and a fresh one can always be produced.

A map is cut into levels: the overview at level 1, collapsed sub-processes at 2 and 3, each its own page. That is what lets you show the whole to a management team and the detail to the crew without keeping two documents.

Every step carries its own message thread, its workshop photos and its documents. That is where the question that kills process maps gets settled: where did so-and-so's remark about step 7 go.

An as-is map stops being a one-off deliverable and becomes a reference worked on continuously. Export to .bpmn and .drawio to carry on in a third-party editor.

Comparable to Lucidchart or Visio, wired to your records

bf_process · Version 18.0.5.2.0 · Guide chapter · View the source

A due date says which day, never which moment. Yet a great many things only make sense at a particular hour: the call happens in the morning, the follow-up over lunch, the backup outside office hours.

This module adds an indicative time slot to the task alongside its due date: morning, midday, end of day, out of hours. It shows on the kanban card and works as a filter, which lets you open your day on what is done now rather than on everything due today.

⚠️ It is an indication, not a constraint. Nothing fires at the stated hour and nothing is blocked outside it: a slot that triggered an action would become a schedule, and a schedule has to be defended, justified and maintained.

The same slot is used elsewhere in Symbifox, notably to decide which desk opens at which point in the day.

bf_time_of_day · Version 18.0.1.5.2 · Guide chapter · View the source

A task waiting on the client is not “in progress”, and it is not “blocked” either. For want of a word for it, it stays in progress, and the team carries a delay that is not theirs.

This module adds two distinct states, Waiting on client and Waiting on third party, alongside Odoo's own. They read differently on the kanban and stay fully compatible with existing filters and reports: an added state that breaks the reports only serves for a week.

⚠️ The state is distinct from the stage. A task can sit at the “In progress” stage and be waiting on a third party, and that combination is exactly what you want to see: the stage says where the work stands, the state says why it is not moving.

The same mechanism serves helpdesk tickets, for the same reason: measuring a response time without separating out who is keeping whom waiting gives a figure nobody can defend.

Comparable to The “waiting status” pattern found in most project management tools

bf_task_waiting_states · Version 18.0.1.0.0 · Guide chapter · View the source

Two people open the same task two days apart. One gets archived, and everything it carried goes with it: the conversation, the attachments, the hours logged on it.

This module moves the content before archiving. The message thread, the activities, the followers, the attachments, the hours and the dependencies are reassigned to the task you keep, and the others are archived, empty.

The hours matter most: they are billable, they feed the hour bank and the project's profitability. An hour trapped in an archived task is neither lost nor visible, which is the worst of the two.

⚠️ Source tasks are archived, never deleted. Their number stays valid and an old reference still leads somewhere, because a dead link in last year's email cannot be explained away.

Comparable to Zendesk ticket merge, for your Odoo tasks

bf_project_merge · Version 18.0.1.1.0 · Guide chapter · View the source

A file lives on Nextcloud, the file it belongs to lives in Symbifox, and the person spends the day between two tabs copying links.

Three doors lead to the same files: a tab on the record of a project or a task, bounded to that record's folder; a full application in the main menu; and a launcher in the top bar that slides the browser over whatever screen you are on.

Folder tree on the left, built-in preview, drag-and-drop upload, moving, configurable share links, office documents opened straight in Nextcloud.

For an organization that files by client: one Nextcloud folder per company, linked once to its record and found again from its contacts, projects and tasks. A button creates a new client's folder from your template, numbered after the existing ones, and the attachments of a thread can be filed into it, copied without ever overwriting an existing file.

⚠️ Each person browses with their own Nextcloud account, connected once through your organization's authentication. Nextcloud therefore applies its own permissions, and every share carries the name of whoever created it. A browser going through a service account would show everyone everyone else's folders.

Symbifox does not replace Nextcloud: your files stay with you, on your server.

Comparable to SharePoint's file explorer, on your own Nextcloud

bf_nextcloud_browser · Version 18.0.4.4.2 · Guide chapter · View the source

A wiki ages badly because nothing in it says which version was distributed, to whom, or when it is due for review.

A document is a record: a name, a reference, a type, an owner, a next review date. Its content lives in versions, each with its number, its change log, its approver and its effective date. Publishing a version freezes its content: that is the one that was distributed, and it will not move again.

A distribution links a version to someone, client or employee, and records the sending, the method and the acknowledgement. That is what answers “who had received the password policy in February” without reopening a mailbox.

Matrices track an engagement's deliverables: status, owner, dates, attachments, linked tasks. Decisions taken in meetings are filed into them, where people will look.

More than a wiki, less than an ERP: a document's body can be written here, section by section, or stay a pointer to an external file.

Comparable to Notion or Confluence, structured by project

project_knowledge_matrix · Version 18.0.13.5.1 · Guide chapter · View the source

Odoo Community reads dashboards but cannot design them: the editor is an Enterprise feature. And a BI tool plugged in beside Odoo reads the database without its access rights, which then have to be rebuilt by hand, or dropped.

Here you build the dashboard on screen. A pivot or graph view, anywhere in Odoo, goes to a dashboard through “Add to a dashboard”, as a table, a chart or a tile. The Period and Customer filters are created for you and apply to the whole page. The editor saves itself, and never overwrites the version a colleague has just saved.

Named measures (margin, billable hours, NPS) are defined once and used everywhere. ⚠️ Every figure is recomputed for the person looking, under their own access rights: a consultant sees their hours, management sees everything, in the same dashboard. A tile compares the year to date with the same dates last year, not with the whole year.

Your other figures come in as external sources: an Excel workbook uploaded or kept in Nextcloud, OneDrive or SharePoint, a Google Sheets spreadsheet, a web API (JSON, CSV or OData), a PostgreSQL database or a Grist document. Each source is closed by default and opened to the groups you choose, read live with no copy in Odoo, and its keys are seen by administrators only. A named measure can add up a workbook column: management's budget then sits against actuals, by month and by customer. Ready-made dashboards install themselves with the modules they read.

Comparable to Power BI or Tableau, without copying the database beside Odoo or rebuilding its access rights by hand

bf_bi · Version 18.0.1.9.0 · Guide chapter · View the deck (PDF) · View the source

5 add-on modules

Professional servicesHours, revenue, labour cost and margin, by customer and by month.

The Professional services dashboard and its named measures: hours entered on projects, invoiced revenue net of credit notes, labour cost from each person's hourly cost, margin and margin rate. It installs itself when timesheets and invoicing are present. The margin rate moves in points, not as a percentage of a percentage.

bf_bi_timesheet · Version 18.0.1.0.3 · Guide chapter · View the source

Hour banksYour customers' hour bank balances, and the hours added or removed.

The Hour banks dashboard: balances as the hour bank module computes them, and the hours added or removed over the period. It installs itself with hour banks, and is reserved to people who can read them: nobody gets a tile in error.

bf_bi_hour_bank · Version 18.0.1.0.4 · Guide chapter · View the source

HostingServices in production, services down, backup success, storage and expiring domains.

The Hosting dashboard and its measures: services in production and those whose last health check failed, backup runs and their success rate, average share of storage used, domains whose registration ends within 90 days. It installs itself with hosting management.

bf_bi_hosting · Version 18.0.1.0.3 · Guide chapter · View the source

Customer experienceNPS, responses, open complaints and resolution time.

The Customer experience dashboard and its measures: answers to the NPS question, promoters, detractors and NPS, complaints received and not yet resolved, average days to resolve a complaint. It installs itself with the customer experience suite. NPS moves in points.

bf_bi_cx · Version 18.0.1.0.3 · Guide chapter · View the source

Interactive reportsReports that read like Power BI: slicers at the top, a click that filters the whole page, a detail page for each customer.1:05

Period and customer slicers at the top of the page, and every visual follows them. A click on a bar, a slice or a row filters the whole page, and a right-click on a customer opens its detail page.

Tiles compared with the matching period, column, line and donut charts and tables, but also gauges with their target, waterfalls that explain a change customer by customer, and heat maps of customers month by month, in your company's colors if you like.

Designers build a report on screen: drag a measure, move, resize, with a history of the last 30 versions. Five reports come ready to use: management, time and margin, customer experience, hosting, hour banks.

The figures are the dashboards' named measures, computed under the access rights of the person looking: nobody sees a figure in a report that they could not read elsewhere.

bf_bi_report · Version 18.0.1.0.2 · Guide chapter · View the deck (PDF) · View the source

Odoo Community has no Gantt view, and its tasks have no start date at all. So the schedule gets drawn elsewhere, and it diverges from the project in the first week.

The module brings both, with no Gantt library: a single geometry is computed server-side, and the screen, the PDF, the PNG, the SVG, the workbook and the Microsoft Project file all draw it identically. Two renderings that diverge are two truths presented to the same client.

A schedule is drawn on a project, or off-project when the point is to illustrate a proposal without creating forty tasks. The swimlane groups bars by stage, milestone, person, company, or nothing.

⚠️ A missing start is not hidden: the bar carries a dotted rule and says where its date came from. A schedule that guesses a start date without saying so gives a plan nobody can check.

MSPDI and Excel import and export, both ways. Shareable on the portal without buying a seat per person.

Comparable to A per-user Gantt subscription, or Enterprise

bf_gantt · Version 18.0.1.7.0 · Guide chapter · View the deck (PDF) · View the source

Working with a client on their tasks usually means opening an account for them on your side, or asking them to open one on theirs. Both cost, and both leak.

Two instances that trust each other pair by invitation, administrator to administrator: one issues a single-use code, the other accepts it. A shared secret is born of the two halves, neither instance picks it alone, and it then signs every message.

A federated task appears on the other side in a closed project, addressed to someone you propose; the partner decides. State, due date, messages and small attachments travel both ways.

The task does not cross alone. Satellite modules also share delivered documents, meeting agendas and reports, process maps, schedules, timesheet statements and outreach tracking.

⚠️ What does not cross matters just as much. Internal notes stay with their author, unless their side chooses to send them to that partner. A message that begins with 🔒 stays home, always. Nothing is ever deleted: withdrawing a share stops the exchange, it does not erase what was said.

Only projects that name a peer offer sharing, which keeps a task from landing at a partner's through one distracted click.

Comparable to Nextcloud federated sharing, Asana guests, Jira external collaborators

bf_federation · Version 18.0.1.5.3 · Guide chapter · View the deck (PDF) · View the source

Selling a block of hours is simple. Knowing what is left of it, mid-month, without opening a spreadsheet, is less so.

An hour bank is one record per client, not an accounting account. The balance fits in a sentence: credits and adjustments, less debits. A debit is every timesheet line entered on one of the included projects. A credit is every validated invoice line, filtered by company, by invoicing partner and by product. An adjustment is a manual entry for whatever escapes the other two: a write-back, a correction, a discount.

⚠️ The application reads timesheets and invoices, it never edits them. A bank that rewrote a logged hour would make the billing diverge from what was actually done.

The balance appears on the client portal in real time, and an alert goes out at the agreed threshold. A client warned at ten hours left tops up; a client warned at zero negotiates.

Comparable to The “hour bank” model from consulting firms, automated

bf_hour_bank · Version 18.0.1.16.0 · Guide chapter · View the source

Knowing how many hours went to business development, and not just to which projects, usually takes an export and a spreadsheet.

A work category is a project label you tick as one: the label you already use will do. Set on a project or a task, it carries over by itself to the timesheets, Gen conversations, notes, filed emails and meeting records that belong to it.

The category is stored on every record: filter on it, group a pivot by it, export it like any other field. Each record also says where its category comes from: its label, its task, its project or the record it is attached to, and a category chosen by hand wins over all of them.

⚠️ One category per record, on purpose: an hours report that counted the same hour twice would give a wrong total. When a task carries two categories, their order decides.

Classifying is not editing: changing a project's category does not change the last modified date of its tasks, notes or emails.

bf_work_category · Version 18.0.1.0.3 · Guide chapter · View the deck (PDF) · View the source

Place what is actually left to do on weeks, against a declared capacity rather than a guessed one, and quantify what cannot be placed instead of hiding it.

Comparable to Float, Runn or Productive

bf_charge · Version 18.0.1.2.0 · Guide chapter · View the source

When the blocking task is done or cancelled, or a dependency is removed, the people assigned get an unblock notice, by email or in Discussion, as each one prefers. Each reads it in their own language and time zone. The notice names the task, its project, its client, its deadline and its planned hours, links to each task that was blocking it and says who removed a dependency. It names only the tasks the person can open. A task with nobody assigned notifies the project manager. As an option, Gen adds a short game plan.

bf_task_unblock_notify · Version 18.0.2.0.3 · Guide chapter · View the source

A supplier bill arrives as a PDF and leaves as manual entry: the supplier, the date, the amount, the tax breakdown, the lines. Forty a month is a day's work that produces nothing.

Drop the PDF in. Extraction returns the supplier, the dates, the amounts, the GST and QST breakdown and the detail lines, then prepares the accounting draft.

⚠️ Human validation stays mandatory, and the screen is built for it: the extracted values are re-read at a glance, beside the original image. An extraction that posted itself would turn a reading error into a decided entry.

The analytic account is set along the way, which spreads the expense by project or by client without changing the books, and feeds the profitability shown elsewhere.

The invoice is sent to the AI model only while it is being read, from your server and towards the model provider, currently Anthropic, in the United States. The result comes back into your Odoo.

Comparable to Dext (formerly Receipt Bank), open-source and self-hosted

bf_invoice_ocr · Version 18.0.1.0.1 · Guide chapter · View the source

Odoo Community ships no budget module.

This one puts your budget positions on groups of ledger accounts, not on analytic accounts: a budget therefore works on day one, even if no vendor bill carries an analytic key yet.

Four amounts, in Odoo's own vocabulary: planned, actual, committed and theoretical. The actual is never copied, it is re-read from your books every time it is displayed.

⚠️ The theoretical follows the calendar, not the clock. A yearly expense does not spread over twelve months: the monthly split is editable, and when your subscriptions provide a dated schedule, the theoretical is built on it and says so. A flat time-elapsed prorata would report an overrun every renewal month, and an alert nobody trusts protects nothing.

An open budget is not edited: it is revised, and the original stays readable. A coverage check reports the accounts no position covers and the ones two positions count twice. Alerts fire when a drift passes a percentage and a currency floor: a percentage alone screams about small positions, an amount alone stays silent about large ones.

And the rolling forecast: a twelve to eighteen month horizon that crosses fiscal years, re-made every month with one button, where each pass keeps its figures forever. It is the comparison between two passes that teaches you something: “we forecast 28,896, we now forecast 27,666, and the difference is what August actually did”.

Comparable to Odoo Enterprise's Budgets module, in open source, following the calendar rather than the clock

bf_budget · Version 18.0.1.2.1 · Guide chapter · View the source

1 add-on module

Campaign BudgetsA marketing campaign already knew what it earned. It finally knows what it spent.

Odoo knows what a campaign returned: invoiced amount, leads, quotations, all computed on utm.campaign. None of its thirty-three fields is a cost. The campaign therefore measures a return whose denominator it does not have.

This module does not build a parallel spend register, which would eventually diverge from the accounting. It attaches one analytic account per campaign, with a uniqueness constraint so an account never serves two campaigns, and splits the spend between what went through accounting and what is internal time.

⚠️ Time is valued by Odoo from the hourly cost. When that rate is missing, the module counts the unvalued hours and says so, rather than displaying “nothing spent”: a zero cost reads as a profitable campaign.

bf_budget_campaign · Version 18.0.1.2.0 · Guide chapter · View the source

Every dish is a recipe: net quantity, yield and gross quantity per ingredient, sub-recipes included (stock, sauce, dough). An ingredient's cost comes from the latest validated vendor bill, brought back to the stock unit. Each recipe gives its plate cost, food cost ratio and a suggested price from your target and your rounding, and the kitchen manager gets an activity when a bill pushes a dish over its target. Bill lines without a product are matched once to an ingredient, with their pack size. Stock is counted location by location on a phone, each location applied as soon as it is entered, and a loss is declared in a few taps, valued at kitchen cost. Every sale takes its ingredients out of the stock, whether it comes from the register, a sales order, an invoiced banquet, another register or school meals, and the variance report shows, between two counts, what the sales do not explain. In the dining room, the host seats the guests section by section in turn, keeps the waiting list and watches the kitchen's pace; the waiter orders at the table and the dishes reach the kitchen screen, station by station. An order guide per supplier suggests what to order for its next delivery, until the delivery after, between each ingredient's min and max, and prepares the request for quotation. Menu engineering places each dish of its section by popularity and margin (star, plowhorse, puzzle, dog), and shows ahead which dishes an ingredient increase would push over their target. Allergens follow the ingredients up to the dishes, the technical sheet and the allergen sheet print, and cooks read recipes without the costs.

Comparable to A recipe-costing spreadsheet, or a separate kitchen management app

bf_kitchen · Version 18.0.1.4.0 · Guide chapter · View the deck (PDF) · View the source

A chat channel scrolls; a noticeboard holds. They are not the same thing, and that is why an important announcement gets lost in the first one.

Every post is addressed to all staff, to departments or to groups. ⚠️ Anyone outside it sees it nowhere, not through an export and not through a direct link: the audience is an access rule, not a display filter.

Required reading writes a named, dated line, goes out by email with the link to confirm, and the editors see who is missing. A policy “sent to everyone” proves nothing; a policy confirmed by twenty-eight people out of thirty-two says exactly where the file stands.

A report goes to the designated person, and to them alone: they receive an activity and an email that says nothing of the content, and the file keeps a copy of what was reported.

A poll lives in the feed: the question, its choices, and a one-click vote on the card. An anonymous poll stays anonymous to everyone, editors included, and its result only shows once three people have answered.

Seven bridges fill the feed: a delivered celebration card, a badge awarded by a colleague, the results of a pulse wave, an upcoming event, the tile of what you still have to read, and, when the editors ask for it, an Odoo survey or a date poll looking for answers.

Comparable to Microsoft Viva Engage, without the open feed or the communities

bf_babillard · Version 18.0.1.8.0 · Guide chapter · View the deck (PDF) · View the source

The card the whole office signs is usually made out of a spreadsheet of birthdays and an email chain. Both create the same problem: the person being celebrated ends up finding out.

A link and a QR code are enough: everyone adds their word, their photo or their GIF, and the card goes out on the chosen date. What sets the module apart lies in two rules rather than two screens.

⚠️ The first: the date comes from the person, never from the HR file. They are asked for the day and the month, without the year, and they answer among four choices including “no thanks”, which takes them out of everything. Their refusal stays invisible to colleagues and to HR alike, or it would give them away.

The second: the surprise sits in the access rule, so a list, an export or a report cannot get around it.

The calendar also covers work anniversaries and their milestones, welcomes, departures, retirements, congratulations and condolences. The organiser gets a reminder ten days ahead, with the button that creates the card, because a calendar nobody looks at makes nothing. A card left empty is never delivered.

People also write by hand, with a finger or a stylus. On delivery, the card goes out with its keepsakes: a PDF and a page to keep outside the system, and to a personal address if the person gave one, because a card in the database disappears one day with the account.

Comparable to Kudoboard, without the subscription or the spreadsheet of birthdays

bf_celebrations · Version 18.0.2.2.0 · Guide chapter · View the source

Odoo knows who works for you. It does not know which collective agreement covers that person, how much seniority they hold in their bargaining unit, or which clock is running on the grievance filed last week.

This module adds that half. The bargaining unit, carried by a company: a group where each site is a separate company has as many agreements as it has sites, each with its own expiry. The agreement and its clauses filed by subject, found without being hunted for. Seniority, carried by unit membership rather than by the employment contract: they are not the same, one grants a benefit and the other decides a layoff.

The posted seniority list is a dated photograph, not a view that recomputes. A correction made the following month does not rewrite the posting, and that is the whole point: a rank is challenged against what was posted, not against today's state.

The grievance lives in one place for both sides, and every step carries the agreement's delay and the deadline that follows from it. A file is rarely lost on the merits; it is lost on the calendar.

Dues are described by a rule holding the percentage and the flat amount together, declared by period, and reconciled against what the union received. ⚠️ Dues follow the unit, not the card: section 47 of the Quebec Labour Code requires the deduction from every employee in the unit, member or not. So coverage and membership stay apart, one deciding the deduction and the other the vote.

A workplace with no union sees nothing change: the absence of certification is a readable state, not a hole.

bf_labour_relations · Version 18.0.1.0.0 · Guide chapter · View the source

2 add-on modules

Employer sideObligations with reminders, the posted seniority list, job postings and movements, remittance preparation.

What the agreement requires of the employer, and when. An obligation carries its deadline, its recurrence and its reminder: the person answering for it gets the task before the date, because an obligation nobody is warned about is an obligation missed. Once done, an annual duty creates the next one and the old one stays on file with its date, since that compliance history is exactly what a union brings back out.

The posted seniority list is composed at one click as of the date you choose, then freezes. An error is fixed by posting a corrected, dated list, which leaves the trail of the correction instead of erasing it.

Job postings keep three doors to the same job apart: the ordinary posting, bumping and recall. Every bid carries its rank as of the posting, copied. ⚠️ Awarding to a less senior bidder is not forbidden, but the reason has to be written down: that is the text read back in a grievance.

The remittance is prepared one line per covered employee, and the agreement's rule applies to the base you enter. The gap between declared and computed stays visible: it gets explained or corrected, never erased.

bf_labour_relations_employer · Version 18.0.1.1.0 · Guide chapter · View the source

Union sideMembership, meetings and votes, stewards and union leave, and reconciling the dues received.

The counterpart to the employer side. Membership keeps its history: a person leaves and comes back, and it is the history that answers "since when has she been a member". Signing a card never changes coverage, which comes from the certification.

Meetings count quorum on members present, not on the covered headcount: in a unit where many pay without having joined, those two numbers differ sharply. The share in favour is computed on votes cast, abstentions left out, otherwise votes the meeting carried would be counted as lost.

Stewards carry a dated bank of union leave, because what gets challenged is not the principle but the balance on the day of a refusal. A refused leave counts for zero hours and stays on file, with its written reason.

Reconciliation is the point of the rest: what the union received, what the employer declares having remitted, and the unit's covered headcount, side by side. A statement with no remittance linked is never called reconciled: the absence of a comparison must not read as a successful one.

bf_labour_relations_union · Version 18.0.1.0.0 · Guide chapter · View the source

A schedule gets built in a spreadsheet, sent by email, then changed as the week goes on. Nobody checks it against labour standards, and on the day of a grievance someone has to reconstruct who was called, in what order, and who said no. Odoo Community has no shift planning at all: the Planning app is Enterprise only.

This module holds working conditions per group. Quebec's labour standards (LNT) ship as a record, and a collective agreement raises them: overtime thresholds, double time, time bank, minimum call-back, notice period, premiums. ⚠️ The LNT is the floor: a less favourable value is replaced by the one in the Act, and the form says so. The rule most favourable to the employee always applies.

Schedules are built from templates, published, then closed. Before publishing, the module warns: five days' notice, more than 14 hours in 24, more than 50 hours in the week, 32 hours of weekly rest, a meal break after five hours, rest between shifts, declared unavailability. It warns, it never blocks: the decision stays with the manager.

Once a schedule is published, every addition, change, reassignment or cancellation goes into the change log: before, after, who, when. Nobody can edit or delete it, not even a manager, and that is the point: this log is what you bring to a grievance.

An open shift is offered one person at a time down a call list, by seniority, rotation or inverse seniority. Every offer, every skip with its reason and every refusal is timestamped. Swaps between colleagues go through approval when the agreement requires it, and the warnings they raise stay on record.

At the end of the period, hours come out coded: regular, overtime, double time, time bank, call-back and the 3-hour minimum, on-call pay, holiday indemnity, evening, night and weekend premiums. Under averaging of hours (s. 53), by collective or written individual agreement, overtime is counted on the average of the period. Benefits such as an overtime meal or a taxi home, provided or reimbursed, and subsidised meals valued at cost, are sorted taxable or not, for Quebec and federally, with the reason. The CSV export goes to your payroll service.

After six years, records are destroyed by hand, never those under dispute: a schedule or a person named in a grievance stays, with the pay attached to it.

⚠️ What it does not do: no deductions, no contributions, no RL-1 or T4 slips, which stay with your payroll service. And it does not replace a lawyer or a tax specialist: the points not yet validated are listed in its documentation, to be confirmed before you rely on them.

Comparable to Agendrix or Odoo Enterprise Planning, with labour standards as the floor

bf_shift · Version 18.0.1.2.1 · Guide chapter · View the source

Odoo follows the pipeline very well: the position, the person, the application, the stages, the refusal reasons. It stops just short of the assessment itself, which lives in a free notes field and a questionnaire per position, with no weighting, no round, no panel and no comparison between candidates.

This module picks up there. You write a scorecard per role and per round, with weighted criteria and a scale described in observable behaviours. ⚠️ Each panel member files their scoring before seeing anyone else's, which stops the first opinion expressed from pulling all the others.

A refusal issued after an interview has been held requires a written reason, and the name of whoever decided stays on file. A published scorecard is frozen: last year's session reads back exactly as it was scored.

No automatic ranking is produced. The score helps a person decide, and a knock-out criterion flags without eliminating anyone: a tool that ranks candidates decides for you and leaves you the responsibility.

Eight modules add themselves as needs arise: the four candidate emails rewritten, a portal where the person follows their file, the job offer on your letterhead and its sending for signature, Law 25 retention and destruction with an anonymised measure that survives the destroyed scorings, expenses and cost per hire, and each job board's performance measured through a tracked link.

Comparable to Workable or Recruitee, without your candidates leaving your house

bf_recruitment · Version 18.0.1.2.1 · Guide chapter · View the source

Gamification fails when it rewards what is easy to count rather than what counts. A click counter ends up producing clicks.

Fox Quest wires its experience points to real activity: tasks completed, timesheets filed, tickets settled, meetings held. The level is crossed in steps, ten fox-themed levels from Renardeau to Kitsune. The badge is earned at a milestone or granted by hand by a manager, across six categories and five rarities, and anyone can wear one they earned as a title. Only the person's own gesture counts, not a scheduled job or a colleague.

Every working day, three daily challenges are drawn from what the person can really do; the first one pays double, and five stamps fill a card that pays a bonus. The dashboard shows the next goals within reach.

The streak counts working days: weekends, public holidays and declared absences pause it instead of breaking it. The fox greets the person who is caught up: activities, inbox, tasks, meeting reports and agendas. If the company turns it on, the streak can earn a day off, requested by the employee and approved by a person.

Rewards are configurable and concrete: a gift card, a flex day, team kit, a bonus tier. A point that leads nowhere stops being looked at within a month.

⚠️ Dosage is the real subject. The application exists to put a little play where it helps, not to turn a team into a language-app cohort. Rules come out as easily as they go in, and nothing depends on them.

bf_gamification · Version 18.0.3.2.0 · Guide chapter · View the source

An NFC tag triggers nothing by itself. It holds a few dozen bytes, and the only format both phone platforms read without an app is a link. The phone opens it, and the server acts: that is what lets you add a gesture without anyone having to update their phone.

⚠️ What is written is a public code, never a secret: a tag reads at four centimetres without your consent and copies for pennies. Identity comes from elsewhere, and that is what separates the three doors: the Android app, with the paired device's token; the browser, with the session already open; and the signed NTAG 424 DNA chip, which signs every read and works for a person with no account. Every gesture runs with the bearer's rights, never more.

The gestures shipped: open the record, take out and return equipment, book a room, record attendance, start a timer, walk a round of points in order, report a problem that opens a pre-filled ticket. A tag can ask a question before acting, or offer a menu.

It can also ask for a checklist: compliant or not, a measured value with its range, a choice, a note. This month's fire extinguisher, the fire door, the padlock. The record is immutable once written, the anomaly is followed through to its correction, and the register comes out as a PDF with the regulation's section at the top.

With no network, the tap is kept with its time and goes out when the signal returns, checklist included. A QR code printed beside it does the same work for a phone without NFC. Signed chips are prepared from the app, but the company key never goes down into a phone.

Comparable to A patrol-tour reader and its software, replaced by a one-dollar tag and the phone you already have

bf_nfc · Version 18.0.2.6.4 · Guide chapter · View the source

A printed QR code usually carries its address hard-coded: the day the page moves, you peel it off and reprint. Here the code only carries a short pointer, and Symbifox decides where it leads.

You generate a batch of blank labels, numbered after a prefix, before you know where they will go. On first scan, an authorised person picks what the label opens: a desk on the floor plan, a server, a room, an event, a link page, or a plain address. When the object leaves, the label is reset and reused elsewhere, its log intact.

Sheets print to the millimetre on ten common Letter and A4 formats, and a half-used sheet picks up where it left off. The centre logo and the colours are checked before printing: a code too small for a logo, too pale or inverted is refused rather than wasted. Two hundred desks can be linked at once from a spreadsheet, checked line by line before anything is written.

⚠️ A label open to the public takes a visitor without an account to an address or a published page, never to a gesture that writes. Companies are walled off, and every scan leaves its line in the log.

A QR label is a tag without a chip: every NFC tag gesture works with it, with nothing more than a laser printer.

Comparable to A dynamic QR code service, wired to your own records and your label sheets

bf_qr_manager · Version 18.0.1.0.2 · Guide chapter · View the source

An e-learning module plays content. This one keeps the register, which is not the same work.

A requirement says who owes what, and it takes two forms that do not reduce to one another: a specific activity each covered person must have taken and kept valid, or a number of hours in certain categories, with the categories that do not count. From that rule comes one line per person, with its due date and its state: that list is what you show the inspector.

Facing it, the completion carries the proof: the real date, the hours, the provider, the number, the certificate attached, and the expiry date.

⚠️ Nothing is overwritten: three first-aid courses over nine years leave three lines, and the sequence shows. Expiry moves on its own, carried by a daily task rather than a field frozen the day it was written.

And what is missing is not worth zero: a line with no hours is marked incomplete and leaves the totals, instead of entering them at a null value that looks like a measurement.

Comparable to A corporate LMS, cut back to what can be proven

bf_training · Version 18.0.1.4.1 · Guide chapter · View the source

8 add-on modules

Online coursesA finished course becomes a register line, dated the day it was actually finished.

Odoo's content player keeps no completion date, and the line it adds to an employee file carries the date of the recomputation.

This bridge writes the record the moment completion happens, with the course hours. Anyone without a portal account is given one, without which a finished course reports nothing at all.

It also watches the content: when a course gains or loses chapters afterwards, the register flags it and decides nothing. Raising the version makes everyone who took the old one sit it again; acknowledging the change freezes the count and asks for nothing.

⚠️ Fixing a typo should not send anyone back to class, and that is why the decision stays with a person rather than with a rule.

bf_training_slides · Version 18.0.1.0.1 · Guide chapter · View the source

SCORM contentPlay a SCORM 1.2 or 2004 package inside Odoo eLearning, and carry its completion to the register.

Odoo 18 knows no standard course format: its player takes an image, an article, a document, a video or a quiz, and that is all. A provider delivering training as SCORM, which is nearly all of them, has no way to play it or to get the result back.

This module adds the missing type, with both APIs the standard mandates, the 1.2 one and the 2004 one, because any real catalogue holds some of each.

Completion reaches the register through the player's own hook: there is a single write path.

⚠️ The module says what it does not do: SCORM 2004 sequencing is not applied, and it announces that on the package record. A player that claims to sequence and gets it wrong is worse than one that says it does not sequence.

bf_training_scorm · Version 18.0.1.0.2 · Guide chapter · View the source

Classroom session and signed attendanceThe classroom session run by Events, and the signed attendance sheet that turns it into proof.

Odoo Events already runs a session: the date, the room, the seats, the registrations, the check-in. This bridge does not redo any of it.

It adds the two things a training session needs and an event does not carry: the signed attendance sheet, produced as a PDF with the signatures on it, and the write to the register.

⚠️ It also fixes two false friends in the native module. Odoo's “Attended Date” holds the moment someone clicked: a March session marked off in September would be dated September, and the register would date the training from the day somebody remembered it. The bridge takes the date of the session.

And a cancelled registration keeps its attended date, because the computation never clears it: reading that field would count people who never showed up.

An unsigned attendance is recorded and flagged incomplete, never lost: the person was there.

bf_training_session · Version 18.0.1.0.1 · Guide chapter · View the source

Signed acknowledgementReading a policy and confirming it in writing becomes a register line, dated and tied to the version read.

Some training is not a course: it is a document to read, and the expected proof is a dated, sometimes signed acknowledgement filed in the person's record. A prevention policy, a multi-module onboarding process, a procedure that changes.

Distributing a version assigns the training. The acknowledgement writes the completion record, dated the moment it arrives and tied to the version read, not to the document in general. A new version reopens the obligation for anyone who only acknowledged the old one, because a policy that changes has to be read again.

⚠️ A required signature is genuinely required: until it is there, nothing is recorded. A ticked box does not replace a dated, signed document.

When an onboarding process has several modules, each gets its own, which is the only shape that can say which one is missing.

bf_training_sign · Version 18.0.1.0.0 · Guide chapter · View the source

On-the-job trainingThe swimlane on your process map finally says who holds the role, and the step says what it takes to hold it.

A process map says what gets done and by which role. The register says who must know how. Between the two sat a fact nobody held: who holds the role.

The bridge adds it to the lane, and a training requirement can then target that lane instead of a hand-copied list of names that goes stale on the first departure. Someone joining the role inherits the requirement; someone leaving it stops being covered.

⚠️ A lane with nobody in it targets nobody, and certainly not everyone by default.

From a step on the map you see what it takes to hold it, and from there who is current. On-the-job training is recorded with what stands as its proof: the trainer, the learner, the step worked on, and both confirmations. Training that only the trainer attests to is not training received.

bf_training_process · Version 18.0.1.0.0 · Guide chapter · View the source

What it actually costsThe real cost of training taken, carried into the budget, and the hours you cannot price counted as such.

The register knows what a training course cost: the hours, the hourly rate, the employer contributions, the fees. The budget knows what was planned. This bridge puts the two side by side.

A budget line names training categories and its actuals pick up the cost of training taken in the period, with no accounting entry. What is owed and not yet taken shows up as committed, not as a year-end surprise.

⚠️ The refusal is shared by both modules: incomplete training does not enter the actuals, its hours join the unvalued hours where the budget already flags them, and an obligation that cannot be priced is counted rather than silently skipped.

An under-stated commitment is worse than a missing one, because it looks filled in.

bf_training_budget · Version 18.0.1.0.0 · Guide chapter · View the source

On your phoneMy training on my phone: what I owe, by when, and what I have already proven.

The mobile surface of the register: my obligations with their due dates, my completed training with its expiry, and what has been assigned to me.

⚠️ Three deliberate refusals.

No route takes an employee id: the person comes from the token, never from what the client sends, because a parameter you do not accept is a parameter nobody can forge. An organisation's training register holds precisely what people have no business knowing about each other.

Nothing writes to the register from the phone: proof of training is filed, not declared.

And an account with no employee record returns an empty list rather than an error: not being in the register is not a fault.

bf_training_mobile · Version 18.0.1.0.0 · Guide chapter · View the source

QuebecThe certificate you must be able to issue, the six-year retention, and the 1 % statement.

Three duties a generic register does not carry.

The certificate first: an employer must be able to issue one to anyone who attended training it delivered itself, when the outside trainer issues none. The PDF carries the subject, the hours, the dates, the trainer, and the right legal entity: the one on the record, not the one printing it.

Retention next: six years after the last year the document relates to, computed, and deleting a line still covered is refused.

The statement last: payroll, the minimum contribution, eligible spending computed as hours times hourly rate, the carried-over surplus and, where applicable, the levy.

⚠️ Incomplete records are kept out and listed separately with their hours, because a statement that swallows gaps produces a wrong figure that looks right. The document says of itself that it supports the filing rather than replacing it.

Eleven regulatory references ship with it, quoted in full.

bf_training_qc · Version 18.0.1.0.1 · Guide chapter · View the source

An annual security course gets skimmed and forgotten in two weeks. What changes behaviour is getting caught with no consequence.

A lure template brings together the fake email, the landing page, the educational page shown afterwards and the course assigned on failure. A campaign sends that template to a group, on a chosen date, spread out or not. A result is one line per person per campaign: sent, opened, link followed, form submitted, and above all lure reported.

Reporting counts as much as failing. A “Report as malicious” button lives in everyone's mailbox, and an organization where people report quickly defends itself better than one where nobody clicks.

⚠️ In a real incident, email clawback pulls a message out of Microsoft 365 or IMAP mailboxes, with a reversible quarantine: a permanent deletion on a false positive costs more than the message did.

Risk profiles are per person, and exist to target training, not to rank people.

Comparable to KnowBe4 or Terranova, open-source inside your Odoo

bf_security_awareness · Version 18.0.2.3.2 · Guide chapter · View the source

Key type, each copy and the door, kept apart as key control policies require; the doors a master opens are computed from the hierarchy. Signed hand-outs, requests approved per area, losses listing the compromised doors, and a Recover activity for each item still held when someone leaves.

Comparable to InstaKey or a spreadsheet register

bf_key_management · Version 18.0.1.0.15 · Guide chapter · View the source

The benefits catalogue: who is entitled to what, who uses it, and what it costs. Eligibility is expressed as ticked criteria, never a raw domain: someone contesting their entitlement has to be able to hear why.

bf_employee_experience · Version 18.0.1.1.2 · Guide chapter · View the source

7 add-on modules

Employee pulseAnonymous mood pulse and eNPS, with display thresholds that hold because the answers are readable by no one1:05

Anonymous mood pulse and eNPS, with display thresholds that hold because the answers are readable by no one

bf_employee_experience_pulse · Version 18.0.1.2.3 · Guide chapter · View the source

Workplace AllergiesYour people's allergies, readable by the person and by whoever organises. Plus the list you hand the caterer, without the names.

An allergy is health information, and therefore sensitive under Quebec's Law 25. A field visible to the whole company and a field reserved to whoever organises meals are not the same feature.

Here, the person concerned and the administration read the record, never the direct manager nor the rest of the staff. Everyone declares their own, because a consent its holder cannot exercise is not one.

The catalogue loads Canada's recognised priority allergens on install, plus latex, insect stings and fragranced products.

⚠️ And above all: the catering list, which gives a group's dietary constraints without the names, with the headcount and the highest severity. That is what you hand a caterer, instead of circulating a medical record to order sandwiches.

The privacy bridge adds express consent, retention tied to the employment relationship, and a purge shipped disabled.

bf_employee_experience_health · Version 18.0.1.3.0 · Guide chapter · View the source

Allergies: privacyA separate regime for health information: express consent, retention tied to the employment relationship rather than a clock, and a purge cron shipped disabled.

A separate regime for health information: express consent, retention tied to the employment relationship rather than a clock, and a purge cron shipped disabled.

bf_employee_experience_health_privacy · Version 18.0.1.0.1 · Guide chapter · View the source

ExpensesAn approved expense becomes a confirmed usage line, at the amount actually incurred rather than an estimate.

An approved expense becomes a confirmed usage line, at the amount actually incurred rather than an estimate.

bf_employee_experience_expense · Version 18.0.1.1.0 · Guide chapter · View the source

TileCatalogue take-up, annual cost, and the number of paid benefits nobody claims.

Catalogue take-up, annual cost, and the number of paid benefits nobody claims.

bf_employee_experience_dashboard · Version 18.0.1.1.0 · Guide chapter · View the source

DigestA “Benefits” section in the daily digest: pending claims, usages with no open entitlement, benefits nobody has taken in a year. Nothing to do, nothing to read.

A “Benefits” section in the daily digest: pending claims, usages with no open entitlement, benefits nobody has taken in a year. Nothing to do, nothing to read.

bf_employee_experience_digest · Version 18.0.1.0.2 · Guide chapter · View the source

PrivacyA declared purpose, a retention rule, and the anonymised aggregate written BEFORE destruction: the measurement outlives the personal data, and the order is enforced.

A declared purpose, a retention rule, and the anonymised aggregate written BEFORE destruction: the measurement outlives the personal data, and the order is enforced.

bf_employee_experience_privacy · Version 18.0.1.1.0 · Guide chapter · View the source

Each plan follows the floor's real dimensions, on the architect's image or on a blank background. You place rooms, desks and devices with the mouse: each one becomes a record, with its discussion thread and its photos. A desk carries the person who sits there, and On the plan, from a colleague's record, leads to their desk, highlighted. Cables are drawn between devices. The whole team reads and searches the plan; authorized people draw it. The plan prints as a PDF with an inventory per zone, and exports to diagrams.net to finish the walls and doors there.

Comparable to OfficeSpace or SpaceIQ for floor plans, without desk booking

bf_floorplan · Version 18.0.1.1.3 · Guide chapter · View the source

The employee record tells how old its photo is, with its date and its age in months; on installation, photos already on file get their date. A drawn avatar is not a photo and leaves the date empty. Two filters gather the photos to update and the records with no photo. Every week, a person whose photo is past the limit, 24 months by default, gets an Update your photo activity that tells them where to do it, and that closes by itself when a new photo is on file. The date and the age stay with HR.

bf_employee_photo_age · Version 18.0.1.0.1 · Guide chapter · View the source

A team's one-time codes live on somebody's phone. Nobody knows what is held for whom, and a departure is discovered on the day someone needs to get in. This module puts the vault in Odoo, every code tied to its client and its mandate, and the client record says how many you hold for them.

The property it buys is rarer than the feature: the server holds no readable seed. Encryption happens in your browser, the key is derived from a passphrase that never leaves it, and the codes are computed in the page. We cannot produce your codes, and that is not a promise: it is checkable in the published source.

Open it with a fingerprint or a hardware key, and keep a recovery code offline for the day the passphrase is lost. The archive takes what you use twice a year out of the everyday list without destroying anything: the code still lives there, and search finds it. An assistant reads the domain in your accounts and proposes a filing for a whole vault, which you correct before it writes.

⚠️ And you are locked in nowhere: the encrypted export is the default, a plain export sits behind your passphrase, with one otpauth:// address per code that any other manager can read back.

bf_otp · Version 18.0.12.3.1 · Guide chapter · View the source

A file of several gigabytes goes out as an attachment that bounces, or through a free service that hosts the client's data elsewhere and keeps no trace of it.

A transfer brings together a sender, recipients, a subject, a message, files and an expiry. The share link carries a token that cannot be guessed and stops working at expiry. The recipient code is single-use, sent by email or SMS: until it is entered, neither the message nor the files appear.

Upload goes from the browser to object storage directly: large files never pass through the server, which is the only way to send several gigabytes without bringing it to its knees.

⚠️ The access log records every event, from creation to purge, with timestamp, address and fingerprints. That is what answers the question that matters after an incident: who opened what, and when.

Automatic purge at expiry, data hosted in Canada, public page in your brand according to the domain the visitor arrives through.

Comparable to WeTransfer or SwissTransfer, with Law 25 compliance built in

bf_securetransfer · Version 18.0.1.22.0 · Guide chapter · View the source

Opening a file, renewing a lease, checking eligibility: you need an identity document, a proof of address, a proof of income. They arrive by email, one at a time, blurry or incomplete, and then stay in an inbox.

A request brings together a client, the documents to provide, drawn from a catalogue you manage, a deadline and a note shown at the top of their page. It goes out by email or text message. The client needs no account and no password: the link they receive is their only key, and it only opens an upload.

On a phone, Take a photo opens the camera directly, one card per document; from a computer, they attach an image or a PDF. Files go straight from the browser to the storage, never through the server, and reach you through the transfer's secure link.

Retention is set per document: when a request mixes several, the shortest period wins. Reminders only name what is still missing. Past the deadline, the link stops working.

⚠️ Every step, from sending to each document uploaded, is written to the same hash-chained log as the transfer's accesses: the access certificate tells the whole story. The privacy bridges then record each destruction in the Law 25 register.

bf_document_request · Version 18.0.1.2.2 · Guide chapter · View the deck (PDF) · View the source

An IT audit is easy to narrate and hard to prove. The question that comes back is not “do you have backups” but “which of your four providers holds them, and since when”.

Five notions are enough. An audit element is a theme to check: fourteen ship with the module, from policies to backups. An IT provider is a third party that touches the audited organization's data. An audited client is the engagement file. An assessment is the crossing of a client, a provider and an element: it is the cell of the grid, and it carries a status. A watchpoint is a risk raised during the engagement, with its priority and the person responsible.

The crossing is what changes everything. Assessing an element without naming the provider that carries it produces a report you cannot hand to anyone to act on.

The dashboard sums up each engagement in three numbers, the green, yellow and red elements, without opening the file. Coverage sits next to the adequacy rate: an engagement at 100% adequate on 30% assessed is not a good engagement.

Co-developed with PME Conforme for Law 25 audits of Quebec small businesses and non-profits.

Comparable to Vanta or Drata, tailored to Law 25

audit_ti · Version 18.0.1.17.3 · Guide chapter · View the source

Playing music on your premises creates royalties, and the amount is not final. Background-music tariffs are before the Copyright Board, which can certify them years later, retroactively.

An establishment is where the music plays: its floor area, its uses and its operating days form the base. A licence period is a paid slice, with its renewal date, its settlement date and its payment reference. A royalty line applies a tariff to a period and carries, beside it, what was actually paid.

⚠️ The reference table is dated: every period carries both the proposed rate and the certified rate. That is what no spreadsheet does, because a spreadsheet cannot say “not certified yet”, and an empty cell reads as a zero.

One button quantifies exposure since 2020: what you paid under a tariff that nothing makes final, and what you could still owe.

No music passes through: the module tracks your compliance, it broadcasts nothing.

Comparable to The tracking no spreadsheet does, because a spreadsheet cannot say "not certified yet"

bf_music_licensing · Version 18.0.1.3.0 · Guide chapter · View the source

A consent you cannot reconstruct is not a consent. The question asked in an audit is not “did you ask” but “what exact text did the person accept, and when”.

A purpose says why you collect. A notice is the text presented to the person: it is versioned and each version carries a fingerprint, which lets you state later what was accepted. A consent links a person, a purpose, a notice version and evidence: signed file, capture, portal log.

Contact preferences say through which channel a person agrees to be reached, with a Do not contact switch that overrides everything else.

The documentary side follows the same logic: retention schedule, destruction register, incident register, handling of access requests.

⚠️ The engine is multi-framework. Quebec's Law 25 is built in; companion modules cover GDPR, UK GDPR, PIPEDA and New Zealand's Privacy Act 2020. Emails and certificates adapt to the applicable framework, because a response deadline and a definition of incident are not the same from one regime to the next.

Comparable to OneTrust or Didomi, small-business flavor

privacy_consent · Version 18.0.5.6.0 · Guide chapter · View the source

See Symbifox exactly the way a colleague sees it, without ever knowing their password. Read-only by default, with a reason, a time limit, a notice to the person and a journal no access right can rewrite.

bf_impersonate · Version 18.0.1.0.5 · Guide chapter · View the source

Paper travels badly. The supplier receipt stays in a coat and then in a pile, the business card picked up at a trade show gets retyped three weeks later, and the signed document waits until you are back at the office to join its file.

This page opens the camera and files instead. The card becomes a contact, with duplicates flagged before anything is written. The bill becomes a draft supplier invoice, never a posted entry, with its photo in the thread. The document joins the notepad with a reminder that becomes an activity, or goes straight to the thread of a record you searched for on the phone.

⚠️ A scanned bill stays a draft. Automatic reading that posted itself would turn a misreading into a decided entry.

It installs on the home screen like an app, on Android as on iPhone, with no store and no download, and it also carries its tile in the app grid for whoever works at a desk.

Every tile is guarded by the right of the gesture it performs: it only appears to someone who can already create a contact, an invoice or a note, and attaching a file to a record requires the right to edit it, not merely to read it.

In the Symbifox Mobile app, the same three gestures run without the browser, with the same rights.

Comparable to A scanning app, without a seventh package to install and maintain

bf_scan · Version 18.0.1.4.0 · Guide chapter · View the source

In a family, everything goes through whoever handles the accounts, a child's papers sit with one parent, and the babysitter leaves with a note from the fridge.

The household manager invites members, resends a sign-in link and removes a teen or an account that was never used. They set no password, change no email address and read nobody's private data. Up to ten accounts: adults and teens aged 14 to 17; under 14, a parent follows the child.

Each child has one record and one or two named parents, who keep their health, papers and emergency card. The rest of the household sees the first name and birthday, nothing more.

Family papers (passport, health insurance card, driver's licence, birth certificate) stay private to their holder and are shared on purpose, read-only. A private reminder arrives before expiry, six months ahead for a passport. Symbifox refuses a social insurance number, even one tucked into a note.

⚠️ The emergency card prints as a PDF, or goes to the babysitter through a link that expires, from 4 hours to 7 days, withdrawn in one click, every opening logged. The page shows the card and nothing else, with no account and no way into the instance.

An adult leaves the household by themselves, with an export of their records, or on request to Blue Fox, with notice: no one is cut off from their own data.

bf_household_family · Version 18.0.1.1.0 · Guide chapter · View the deck (PDF) · View the source

Prescriptions get renewed late, lab results sit in an email, and mood only gets noted on the bad days.

Prescriptions, check-ups and lab tests flag their due date in your name, early enough to act. One quick entry window takes doses, readings, a workout and meals in a minute.

A workout is logged by hand or from a GPX track, of which only distance, elevation gain and duration are kept: the file is discarded. The food log looks a food up by its barcode in Open Food Facts, and nothing else leaves. The mood journal takes ten seconds on your phone, with a report for your doctor and correlations only if you turn them on.

Your children under 14 have their own records: a first name, a month and a year, dated express consent, and a named second parent who keeps them with you. At 14, the records move to the teen's own account, and the teen alone decides what to share.

Records stay closed to the rest of the household: a message on a record stays an internal note, and wherever Odoo would show its name to someone else, it reads “Private health record”.

bf_health · Version 18.0.2.7.0 · Guide chapter · View the deck (PDF) · View the source

In a household, subscriptions pile up without anyone adding them up, the plan lives in a spreadsheet, and nobody knows who owes whom.

The dashboard compares actuals with the plan, by category and by month, with the gap and last year at the same date. Subscriptions are counted ahead: their monthly equivalent, what is left to pay this year and what falls due in the next 30 days.

Your budget stays private. The couple's or household budget is shared on purpose with the people you name; everyone else, administrators included, sees only a neutral name, Private budget. A shared expense works out each person's share and keeps a ledger of who owes what.

Statements come in as an OFX, QFX or CSV file exported from your bank, imported without duplicates: no bank link, no payments, no financial advice. Loans, cheques and invoices sit in the same budget, without the Invoicing app.

personal_budget · Version 18.0.2.1.2 · Guide chapter · View the deck (PDF) · View the source

A credit file goes unchecked for years, a freeze lifted for a loan stays lifted, and a security alert runs out without anyone noticing.

The guide to your rights covers your credit file and score, freezes, alerts, explanatory notes and recourse, for Quebec with notes for the rest of Canada, in English and French. Every fact names its official source.

A starter calendar is set up in one go: Equifax, then TransUnion six months later, your statements every month and a yearly review. Seven days before it is due, each reminder becomes an activity in your name, and it restarts from the day you did it. You can also add your own, for instance to put a freeze back after a credit application.

⚠️ The module does not connect to Equifax or TransUnion, does not read your file or score, and stores no credit data: dates, a name and a free note. Your reminders are private, administrators included, and this module sends no email.

bf_credit_identity · Version 18.0.1.1.0 · Guide chapter · View the deck (PDF) · View the source

An assistant that cannot see your data answers into thin air, and an assistant that sees it from a third-party service takes your files out of your house. Gen answers both problems at once.

It opens from two places: a side panel that follows the record you are reading, and a full-width page with all your conversations. A conversation opened from the panel remembers the record it started on, and the panel then shows only what concerns it. In the list, a pill names that record and opens it in one click, and a switch shows it in place of the title.

An instruction is a short directive the assistant respects everywhere, or only on one record type: that is where the house tone is written down rather than restated every time. Every turn is counted, in tokens, in duration and in equivalent cost, and the steps it took stay readable: read a task, search the mail.

⚠️ The assistant writes under your identity. A task it opens carries your name in the history, not an anonymous robot's, and it does nothing your account would not be allowed to do.

The connection to the model leaves from your server, towards the model provider, currently Claude, by Anthropic, in the United States. The text each answer needs is sent to it; your conversations stay in your database.

Comparable to Microsoft Copilot, self-hosted flavor

bf_claude_chat · Version 18.0.1.39.0 · Guide chapter · View the source

An Enterprise to Community migration drops part of your data by design: a Community database has no table for helpdesk tickets, knowledge articles, signature templates or subscription plans. The import tool counts them in its summary, then they leave with the source copy.

This module is the other end. It keeps first: everything set aside becomes browsable and searchable inside your instance, whether a destination exists or not. It re-homes next, onto the open-source counterpart, and every mapping states what it cannot carry before anything is written. A preview shows the first ten records as they would be created, with the list of what was dropped and why.

Nothing is taken on trust: a contact that no longer exists is dropped with its reason rather than written at random, and each record is created on its own, so one bad row does not cost the others.

⚠️ And ten checks go over your instance afterwards, where the import tool only prints a list that lives as long as a terminal window: language or timezone codes that do not exist, a site address left on a test value, scheduled work still stopped, counters running behind, attachments whose file did not come along. A check that could not look says so, instead of blending in with a green light.

bf_oe2oc · Version 18.0.1.0.2 · Guide chapter · View the source

A hosted estate lives in somebody's head until the day that person is on holiday and a certificate expires.

The application opens on a dashboard of counters rather than a list: availability over the last 24 hours, open alerts, services expiring at 30, 60 and 90 days, maintenance, backups, domains and security. Three buttons re-run the checks on demand.

A service is something you host for a client. Around it come the containers, the certificates, the restic backups, the available updates and the maintenance due dates.

⚠️ A probe that answers is not a service that works. The health check distinguishes the kind of what it measures: a service can be up, answer 200, and no longer do anything.

The application also covers the client estate (endpoints, encryption keys, groups), software licences with their seats and expiry alerts, VoIP.ms telephony and DMARC email authentication reports.

Comparable to Plesk or cPanel, open-source

hosting_management · Version 18.0.2.67.1 · Guide chapter · View the source

A workstation is set up once, by hand, and then it drifts. The next one is built from memory, a little differently, and nobody knows any more which one is right.

Here, the configuration of every Blue Fox OS workstation comes from your Symbifox. One record per organisation sets the defaults, and each person can have their own on top: language, keyboard, time zone, login, wallpaper, mounted Nextcloud folders, pinned applications, browser extensions. An edited record also reaches machines already installed, not only the next ones.

Installation is zero-touch, from the same record: boot the machine on the installer, type the organisation's address, sign in on a second device, and the workstation installs as planned. Symbifox decides who may enrol a machine and keeps the list of enrolled workstations.

The disk is encrypted from installation, and the passphrase that unlocks it is held in escrow in Symbifox rather than written on a scrap of paper. Reading it back takes a separate right, and every reveal stays on record on the machine's page.

At login, the welcome screen shows the person's photo, taken from their employee record.

Comparable to Intune and Autopilot, for Blue Fox OS workstations

bf_policy · Version 18.0.2.13.0 · Guide chapter · View the source

There is always a field missing. A file number used at the client's, a renewal date, a checkbox only your team understands. The usual answer is a development project, for three fields.

Forge stays deliberately narrow: it adds fields to existing forms, and nothing else. It creates no new record type, draws no report, and replaces no bespoke development.

Five objects are enough. The custom field, from text to currency, from date to a link to another record. The view injection, which decides where it shows: form, list, card, search filters. The stat button, which shows a count at the top of a form and leads to the records counted. The default value, per person or per company. The shared filter, offered to the team rather than to its author alone.

⚠️ Forge keeps the description of every addition, then rebuilds what it needs to if an update wipes the underlying wiring. Data entered in a custom field is never touched: that is the difference between a customisation and a change you redo at every version.

The module is named bf_studio_light in the code and on GitHub.

Comparable to An open-source alternative to proprietary customization tools

bf_studio_light · Version 18.0.7.1.0 · Guide chapter · View the source

Record a meeting or a memo from a phone: the server names the file from the calendar event and drops it where the transcription pipeline is already watching. A network outage loses nothing, the upload resumes on its own.

bf_capture · Version 18.0.1.4.2 · Guide chapter · View the source

Each person sees the bookmarks of the company, of their departments and of their projects, plus their own; only a section's managers change it. The Symbifox Signets extension copies them into the browser. In Symbifox, the icon in the top bar searches, keeps your favourites and recent links, which nobody else sees, and bookmarks the open page in one click. A personal bookmark can be proposed to the team, whose manager accepts or declines it. Every week, company and team links are visited: a link found dead twice in a row gives its manager an activity. Bookmarks from Chrome, Edge, Brave or Firefox import from a file.

bf_bookmarks · Version 18.0.1.5.4 · View the source

Writing the same note on thirty records happens one record at a time, or not at all. It is usually “not at all” that wins, and the trace of the decision is missing where people will look for it.

Select several records in any list view, then post the same note on each one's message thread, in a single operation. The action appears on its own on every model with a thread, with no configuration: a module installed tomorrow will have it too.

⚠️ It is an internal note by default. Sending it as a message to followers exists, but behind a confirmation: thirty notes disturb nobody, thirty emails sent in one gesture are hard to take back.

Comparable to Bulk actions in Notion or Asana, inside the Odoo chatter

bf_mass_notes · Version 18.0.1.1.0 · Guide chapter · View the source

A working day rarely happens in a single screen. You jump from activities to tasks, from tasks to email, from email to the calendar, and every jump costs the time it takes to find your place again.

A desk is a named layout that puts those screens side by side. Each pane points at an existing screen and keeps its own search bar, view switcher and favourites: this is not a summarised tile, it is the full screen, usable where it sits.

You create as many as you have contexts. Six layouts, one keyboard shortcut per desk, and optionally a time-of-day slot: the morning desk opens in the morning, the portfolio review one in the afternoon.

⚠️ Desks are personal. A colleague's does not appear in your list, and that is deliberate: a layout imposed on everyone goes back to being a dashboard nobody looks at.

Comparable to Salesforce Lightning App Builder, open-source flavor

bf_bureau · Version 18.0.3.3.2 · Guide chapter · View the source

Something worth remembering rarely arrives while the right screen is open. It arrives during a call, in the middle of a quotation, and it ends up on a scrap of paper or in an email you send yourself.

A note is taken from any screen, through the icon in the top bar or a keyboard shortcut, without changing tab. It is private by default, formatted, and attaches to one or several records: a contact, a quotation, a project, a ticket. Any record with a message thread can carry one.

You find it again by search, by its tags, by the pin, or from the linked record itself through a quick-access button. The day the note becomes something to do, it converts into a dated activity or a project task without re-entering the context.

Each note takes any colour you like: your swatches, the company's, or a free code. The notepad shows as Keep-style cards, minimal rows or a list, and that choice follows you from desk to phone.

On the phone, the Notes page installs on the home screen and opens on the text field. A note typed without a network stays on the device and goes out once the network is back, exactly once; Android's Share menu turns anything into a note in one gesture, photos and PDFs included in the Symbifox Mobile app, which reads the same notes.

That last point is what separates it from a notebook: a note that does not know what it refers to makes you tell the same story twice.

Comparable to Apple Notes, but wired into your records

bf_bloc_notes · Version 18.0.4.3.0 · Guide chapter · View the source

A quote gets worked out on the phone's calculator, then copied by hand into an email, without the steps. Three weeks later, nobody knows where the figure came from.

The top-bar icon, or Alt+Shift+C, opens a calculator screen. You type the words with the numbers: « 6 (weeks) * 750 $ » gives $4,500.00 and keeps the weeks. As on a real calculator, the result stays in the field: an operator continues from it, a digit starts over.

Tabs do the rest: reverse tax (total back to before taxes, with the rates read from your accounting), hours, margins, a column pasted from a spreadsheet, and business days with Québec's statutory holidays. « 100 USD en CAD » converts at the Bank of Canada's daily rate, and the rate travels with the calculation.

A calculation posts as an internal note to the open record's thread, in your name and with your rights. History and variables stay personal, administrators included. No email is sent.

Comparable to the phone's calculator, but it remembers and explains its figures

bf_calculator · Version 18.0.1.2.0 · Guide chapter · View the source

Hardly anyone uploads a photo. In our databases, 2 people out of 35 had one: everyone else shows a letter on a colour picked at random, and every contact without a picture becomes the same grey silhouette.

This module draws an avatar in your organization's style for anyone without a photo: initials in your own shades, or a hand-drawn character (Open Peeps or Notionists, both in the public domain). It comes from the name, so the same person always gets the same one. Contacts too; companies keep their icon.

“My avatar”, in the user menu, lets everyone build their own: hair, expression, glasses, colours. Each thumbnail shows your avatar wearing the part, not the part on its own.

⚠️ An uploaded photo is never replaced by a style change, not even an SVG. The image is put together on your own server from the style's own parts: no face is sent to an AI service.

Comparable to Gravatar and Bitmoji, but drawn on your own server

bf_avatar · Version 18.0.1.0.1 · Guide chapter · View the source

Searching an ERP assumes you already know where the thing lives. You open the application, then the list, then you type. Three gestures before the first useful character.

Cmd+K opens one bar that crosses nearly twenty-five data types: contacts, opportunities, projects, tasks, meetings, emails, SMS, calls, invoices, signature requests, secure transfers, matrices, resolutions, articles, products, documents.

Type a number to jump straight to a task or a ticket. Active records come first and closed files are greyed: a search that puts a closed file at the top wastes more time than it saves.

Arrow-key navigation, opening in one click or in a new tab with Ctrl+Enter. Nothing to configure: the palette follows what is installed.

Comparable to Linear or Notion's Cmd+K, inside Odoo

bf_universal_search · Version 18.0.2.4.0 · Guide chapter · View the source

In a guided engagement, the question that comes back is not “is this moving” but “what are you waiting on from me”. It comes back because the answer is written nowhere the client can read it.

Every step of the engagement carries its instruction to the client and the list of expected documents. The team works from an internal dashboard; the client opens a page of their own, no account needed, and sees where things stand, what is coming, and what you need from them.

⚠️ The part that changes things is the last one: telling the client what they owe, and letting them upload it on the same page. Each document lands attached to the step's task, with no email and no chasing. A tracker that only shows the team's progress moves the chasing from the client to you without reducing how much chasing happens.

The page shows no task name, no assignee, no hours and no internal step, and its address closes in one click.

It is built for linear engagements, the ones that go through the same steps every time. An engagement that forks at every client is better followed as an ordinary project.

Comparable to Asana Goals + a homegrown client portal

bf_stepbystep_clients · Version 18.0.2.4.5 · Guide chapter · View the source

Time gets written down afterwards, from memory, at the end of the week. It is the best-documented source of error in hourly billing.

A timer starts from any task, from a kanban or from the list of recent tasks. Several can run at once and be paused, because a real day is not a queue.

On stopping, the duration is proposed according to your rounding and the timesheet is written in one gesture. Rounding is set once: billing to the minute produces invoices nobody reads.

The Android app does the same outside the browser, with a persistent notification, a home-screen widget, and sharing a task link to start its timer from an email.

The timer lives in the top bar: it stays visible whatever screen is open, which is the only way not to forget it is running.

Comparable to Toggl or Harvest, natively integrated into Odoo

bf_timesheet_timer · Version 18.0.1.14.0 · Guide chapter · View the source

A management instance you look at every day ends up looking like everyone else's, and so do the PDFs that come out of it. The document sent to the client suffers most.

This module applies the Lexend typeface, drawn for legibility, everywhere: interface and PDF reports. It sets the brand colours, company logos and favicon from the settings, without touching code.

⚠️ The setting is per company. On an instance carrying several, each issues its documents in its own image, and an invoice never goes out in the neighbouring company's colours.

The consistency runs from the web client through to the PDF: a brand that stops at the edge of the screen is not a brand, it is a theme.

Comparable to No direct equivalent on the open-source side

bf_lexend · Version 18.0.3.1.1 · Guide chapter · View the source

A management interface is looked at eight hours a day, and often in the evening. Odoo's pure white was never designed for that.

This module switches the interface to dark tones, on a restrained grey palette drawn from the brand colours. It is not a mechanical colour inversion: backgrounds, borders, hover states and warning colours are reworked one by one, so that the red of a passed deadline stays readable instead of turning brown.

⚠️ The brand blue is never used as text on a dark background. It stays a fill, a rule, an accent. A light blue set in letters on dark grey passes contrast checks on paper and tires the eyes in practice.

The choice is personal and is made from the account preferences. It is not imposed on the team and changes nothing in the documents produced: a PDF exported in dark mode is still a PDF on white.

Comparable to The Slack or Notion dark mode, inside Odoo

bf_dark_mode · Version 18.0.1.6.0 · Guide chapter · View the source

The home screen does not ask which app to open: it shows what needs you. Signals are sorted into bands: What's waiting for me (today's meetings, overdue activities, tasks due, email to handle), Waiting on them (tasks parked with a client, signature requests sent, deposits about to expire), money and risk. Each row carries the action that resolves it and opens the filtered list. An empty band disappears and no row ever shows a zero: a short screen means a quiet morning. Each person sees only what their access rights open, and a band whose app is not installed does not appear.

bf_home · Version 18.0.2.1.2 · Guide chapter · View the source

When a document attached to a record is rewritten, by the online office editor, by a new upload or by a robot, Symbifox keeps the previous version, with the person, the date and the origin of the replacement. On the file's card, a button counts the kept versions. Each one can be downloaded, or restored by anyone who may edit the file, and restoring keeps the version it replaces in turn. A file rewritten with the same content creates nothing. Office documents, text files and PDFs are tracked, up to 20 versions per file by default. A version is visible only to those who can read the file.

bf_attachment_version · Version 18.0.1.2.0 · Guide chapter · View the source