Employment Hero Australia
Australian payroll identifiers for the Employment Hero connector, with the Tax File Number encrypted at rest and revealed only through an audited action.
Store price is USD 175 all-in: installing this also pulls the 4 paid ERP Heritage modules it depends on.
Why this module
Employment Hero Australia
The TFN never leaks unaudited
The Tax File Number is ciphertext in the database and a mask on every read. The clear value is returned only by the Reveal action, which writes a PII access log row naming the user and the time. Tests confirm no plaintext survives at rest and no read exposes it.
Fields the connector can actually sync
The pack extends the base employee mapping with TFN, superannuation and ABN, and registers the Australian country profile so the connector engine recognises AU. The sensitive identifiers map pull only, because the platform owns them and the masked field must never be pushed back.
More than one fund per employee
A dedicated superannuation fund record captures USI, fund ABN, fund type, encrypted member number and contribution rate, so an employee who splits contributions across funds is modelled properly rather than flattened into a single name field.
Day in the life
A new Australian hire arrives from the platform
The connector pulls the employee and resolves them by external id. This pack's mapping lands the Tax File Number, superannuation fund name and ABN onto the employee, encrypting the TFN as it writes. The superannuation pull job fills the fund membership record with the USI, fund ABN and an encrypted member number. Payroll opens the employee form, sees the TFN masked, and clicks Reveal once to confirm the number, leaving an audit row behind. Nothing sensitive was ever pushed back to the platform, because those mappings are pull only.
Edge cases
The cases most modules quietly ignore.
In the shipped code today, each one a place where a cheaper module silently does the wrong thing.
Where the TFN and super detail sit in your payload depends on your organisation, so those mapping source paths ship tunable. Point them at the right place, or add a payroll-sourced job, if your employee payload does not inline them.
Saving the employee form writes back the masked placeholder, not the real number. The inverse detects an all-mask value and leaves the stored ciphertext untouched, so a routine save never wipes the TFN.
The connector engine keys every record by its external id, so re-running the superannuation pull job or replaying a webhook never duplicates a fund record. An unchanged payload is a no-op.
When one superannuation record in a batch fails to write, the engine rolls back just that record in its own savepoint and the run finishes in a partial state, rather than aborting every record after it.
Superannuation is an employee sub-resource, so the pull endpoint carries the employee id in its path. A deployment drives the job per employee; the mapping, endpoint and target ship ready so there is nothing to build.
If a linked record is removed on the platform, the engine archives it where the model supports archiving and severs the external id link, keeping an audit trail rather than silently dropping data.
Superannuation fund records and external id cross-references are scoped to the company that owns the connection, so two companies syncing separate platform organisations stay isolated.
Upgrading from an earlier version reads any plaintext TFN and super member numbers still in the old columns, encrypts each into its ciphertext column, and drops the plaintext columns.
What is inside
Built to do the job, end to end.
- Employee identifier fields. Tax File Number, superannuation fund name and member number, and ABN added to hr.employee. The TFN and super member number are encrypted at rest and restricted to HR users; the others are plain reference fields.
- Audited TFN reveal. A Reveal button decrypts the Tax File Number into a transient notification and records the access in the PII access log. This is the only path that returns the clear number to the client.
- Superannuation fund model. eh.hr.super.fund holds one or more memberships per employee with fund name, fund type, USI, fund ABN, encrypted member number, contribution rate and company scope, plus list and form views and a menu.
- Australian country profile. Registers the AU profile against the Australian country record so the connector recognises this localisation and applies the right mappings.
- Mapping, endpoint and pull job. Mapping lines extend the base employee mapping with the AU identifiers (sensitive ones pull only), and a superannuation endpoint, mapping and pull job ship ready for the engine to run.
- Upgrade migration. A post-migration script encrypts any legacy plaintext TFN and super member numbers and removes the old plaintext columns on upgrade.
Honest about the edges
What this does not do, so nothing surprises you.
- This is a localisation field and mapping pack, not a payroll engine. It does not calculate pay, tax withholding or superannuation guarantee amounts, and it does not lodge Single Touch Payroll or any ATO report.
- It does not work on its own. It requires the Employment Hero connector base, HR and sync modules that supply the actual API client, queue, webhooks and synchronisation engine.
- The Tax File Number and superannuation member number map pull only. The platform is treated as the owner of those values; this pack does not push them back, and the masked Odoo field is never sent out.
- The mapping source paths for the TFN and super detail ship tunable because their position in the payload varies by organisation. Some deployments will need to adjust the source path or add a payroll-sourced job.
- The superannuation pull job is an employee sub-resource and is driven per employee by the deployment; it is not a single bulk endpoint that fetches every fund at once.
- Webhook delivery, retry with backoff, rate-limit handling and OAuth token refresh are provided by the connector engine, not implemented inside this country pack.
Employment Hero Australia Odoo, Odoo Employment Hero integration, Tax File Number field Odoo, TFN encrypted Odoo, superannuation fund Odoo, USI super fund Odoo, ABN employee Odoo, Australian payroll connector Odoo, Odoo 17 HR integration, employee superannuation membership, Australian HR localisation Odoo, encrypted PII Odoo HR, Odoo Community Employment Hero, people platform connector Odoo
Need this fitted to the way you work?
ERP Heritage delivers end to end Odoo work: Odoo Implementation, Customization and Development, Integration, Migration, Consultation, Support and Training. We help teams put this module into production, shape it to their process, and keep it running.
We work with businesses across Australia (Melbourne, Sydney, Brisbane, Perth, Adelaide, Canberra) and the Middle East (Dubai, Abu Dhabi, Riyadh, Jeddah, Doha, Kuwait City, Muscat). Start a conversation at erpheritage.com.au or email info@erpheritage.com.au.
Languages
Available in 19 languages
The interface ships translated out of the box. Switch language in Odoo and the fields, menus, and messages follow.
Modules teams pair with this one.
Premium ERP Heritage modules that extend the same stack, each built to the same engineering bar.
Employment Hero Connector is the integration core of the ERP Heritage Employment Hero suite, providing per compan...
Sync certifications, qualifications and employee document metadata from the Employment Hero people platform into...
Sync Employment Hero leave categories, leave requests and leave balances into the standard Odoo Time Off app, wit...
Show the Hijri (Umm al-Qura) date alongside Gregorian dates across Odoo 17
Connect Odoo partner records to the Saudi SPL National Address service and the Wathq commercial registry
One click install of the full Employment Hero integration for Odoo Community, covering the connector, two way syn...
| Availability |
Odoo Online
Odoo.sh
On Premise
|
| Odoo Apps Dependencies |
•
Discuss (mail)
• Employees (hr) |
| Community Apps Dependencies | Show |
| Lines of code | 4404 |
| Technical Name |
eh_hero_country_au |
| License | OPL-1 |
| Website | https://www.erpheritage.com.au/ |
Odoo Proprietary License v1.0 This software and associated files (the "Software") may only be used (executed, modified, executed after modifications) if you have purchased a valid license from the authors, typically via Odoo Apps, or if you have received a written agreement from the authors of the Software (see the COPYRIGHT file). You may develop Odoo modules that use the Software as a library (typically by depending on it, importing it and using its resources), but without copying any source code or material from the Software. You may distribute those modules under the license of your choice, provided that this license is compatible with the terms of the Odoo Proprietary License (For example: LGPL, MIT, or proprietary licenses similar to this one). It is forbidden to publish, distribute, sublicense, or sell copies of the Software or modified copies of the Software. The above copyright notice and this permission notice must be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Please log in to comment on this module