Skip to Content

Mining Mineral Chain of Custody (OECD / RMAP / ITSCI Audit-Ready)

by
Odoo

$ 1520.21

v 19.0 Third Party
You bought this module and need support? Click here!
Availability
Odoo Online
Odoo.sh
On Premise
Odoo Apps Dependencies • Discuss (mail)
• Inventory (stock)
• Employees (hr)
• Invoicing (account)
Community Apps Dependencies
Lines of code 5072
Technical Name grev_od_mining_traceability
LicenseOPL-1
Websitehttps://grevlin.com

Mineral Chain of Custody

OECD 5-step due diligence, RMAP / ITSCI audit readiness, token-secured buyer portal, and one-click audit pack ZIP — the DRC cobalt compliance anchor for responsible sourcing.

✓ OECD 5-Step ✓ Buyer Portal ✓ Audit Pack ZIP

ⓘ AUDIT-READY, NOT CERTIFIED. This module gives your operation everything required to be audit-ready for OECD due-diligence, RMAP, ITSCI, and downstream-buyer requests. It does NOT grant RMAP or ITSCI certification — certification is an independent third-party audit relationship. The module makes that audit dramatically faster and cheaper.

Mineral Chain of Custody tracks every tonne of ore from extraction pit to final destination — providing the complete evidence pack that OECD-aligned smelters, EV battery manufacturers and downstream buyers require.

Core Features

🔓

Chain of Custody Records

One CoC per stock.lot. Auto-created for mining products. Immutable after verified (lot, origin pit, quantity, grades locked). Red-flag screening: DRC CAHRA origin, transporter blacklist, buyer due diligence status.

📋

OECD 5-Step Coverage

Management systems → risk identification → risk mitigation → audit readiness → public reporting. Configurable task checklist per step with coverage % computed automatically per site.

🔗

Token-Secured Buyer Portal

Per-buyer access tokens scoped to specific shipments. Rate-limited (10 req / min), expiry and revoke controls. Buyers see only their shipments — cross-buyer data leak actively prevented.

📦

One-Click Audit Pack ZIP

Seven-folder ZIP: extraction shift PDFs, assay certificates, transport manifest, export permit, CoC declaration, OECD coverage per step. Async generation for packs > 50 MB.

Changelog

Version 2.0.0 — 2026-06-15

  • Full Odoo 19.0 API compatibility
  • Overhauled OWL CoC dashboard with filter bar, OECD coverage chart, and red-flag KPIs
  • New product.template extension: is_mining_product and mining_commodity_id fields
  • Chain of Custody immutability enforced after verified state
  • Red flag logic fixed: DRC CAHRA auto-escalation respects missing site gracefully

Version 1.0.0 — 2026-06-06

  • Initial release — CoC auto-creation on stock.lot for mining products
  • Red-flag screening: CAHRA origin, transporter blacklist, buyer DD status
  • Immutability after verified (lot, pit, quantity, grades)
  • Shipment workflow: draft → loaded → in_transit → exported → delivered
  • 9-document checklist per shipment (extraction, transport, assay, export, CoC, BoL…)
  • OECD 5-step coverage with per-site task tracking
  • Token-secured buyer portal with rate limiting and IDOR prevention
  • Audit pack ZIP (7-folder structure) with async generation
  • Buyer due diligence registry on res.partner

Need Help?

Contact us at odoo@grevlin.com or find us on X at @GrevlinGlobal

✓ 30 days free support included
Availability
Odoo Online
Odoo.sh
On Premise
Odoo Apps Dependencies • Discuss (mail)
• Inventory (stock)
• Employees (hr)
• Invoicing (account)
Community Apps Dependencies
Lines of code 5072
Technical Name grev_od_mining_traceability
LicenseOPL-1
Websitehttps://grevlin.com

Mineral Chain of Custody

The Mineral Chain of Custody module tracks every tonne of mineral from extraction pit to final destination. It provides the complete OECD 5-step due diligence evidence pack that OECD-aligned smelters, EV battery manufacturers, and downstream buyers require.

!DANGER!

AUDIT-READY, NOT CERTIFIED.

This module gives your operation everything required to be audit-ready for OECD due-diligence, RMAP, ITSCI, and downstream-buyer requests. It does NOT grant RMAP or ITSCI certification — certification is an independent third-party audit relationship that you must engage separately. The module makes that audit dramatically faster and cheaper.

Note

Requires :doc:`../grev_od_mining_base/doc/index` and :doc:`../grev_od_mining_production/doc/index`.

Overview

Key Features

  1. Chain of Custody (CoC) records — one per stock.lot, auto-created for mining products
  2. Red-flag screening — CAHRA origin, transporter blacklist, buyer due diligence status
  3. Immutability after verification — lot, origin pit, quantity, grades locked once verified
  4. Shipment workflow — draft → loaded → in_transit → exported → delivered → settled
  5. 9-document checklist — per shipment with mandatory-for-export enforcement
  6. OECD 5-step coverage — configurable task checklist per step, coverage % per site
  7. Token-secured buyer portal — scoped read-only access with rate limiting
  8. Audit pack ZIP — 7-folder structure generated on demand

Configuration

Document Types

Nine document types are seeded (configurable):

  1. Extraction report (shift log PDF)
  2. Transport manifest
  3. Weighbridge ticket
  4. Assay certificate
  5. Export permit
  6. CoC declaration
  7. Bill of Lading
  8. Insurance certificate
  9. OECD risk assessment

Mark each type with Required for Export and/or Required for OECD flags.

Operator Name Redaction

At :menuselection:`Mining Traceability --> Configuration --> Settings`, enable Redact Operator Names to hide shift supervisor and crew names from public-facing PDFs (CoC declaration, portal shipment cards). This setting is on by default.

Usage

CoC Record Lifecycle

CoC records are automatically created when a stock.lot is created for a product with is_mining_product = True. The record starts in draft state.

Red-Flag Screening

Three automatic checks run on CoC creation and on-demand:

  1. Origin — DRC pits are flagged under_review by default (CAHRA classification). A compliance officer must add mitigation evidence and clear the flag manually.
  2. Transporter — if the linked transporter is on the blacklist, the CoC is red-flagged.
  3. Buyer — if the buyer's mining_due_diligence_status is not approved, the CoC cannot be verified.

Verifying a CoC Record

Important

Once a CoC is verified, the following fields become permanently immutable: lot_id, origin_pit_id, quantity_t, and all grade entries. This is enforced at the ORM level — no superuser bypass.

To verify:

  1. Resolve all red flags (origin cleared, transporter not blacklisted, buyer approved).
  2. Click :guilabel:`Verify` — state moves to verified.

Shipment Workflow

  1. Create a shipment and link verified CoC records.
  2. Upload and approve all 9 required documents in the :guilabel:`Document Checklist` tab.
  3. Click :guilabel:`Load` — validates all CoC records are in verified state.
  4. Click :guilabel:`In Transit` → :guilabel:`Export` (blocked until all mandatory docs approved).
  5. Click :guilabel:`Deliver` → :guilabel:`Settle` after payment confirmation.

Generating an Audit Pack

From the shipment form, click :guilabel:`Generate Audit Pack`. A ZIP file is created with:

shipment-SHP-YYYY-NNNNN/
├── 00_summary.pdf
├── 01_extraction/      (shift log PDFs)
├── 02_assay/           (assay certificates per lot)
├── 03_transport/       (manifest, weighbridge, transporter licence)
├── 04_export/          (permit, customs, Bill of Lading)
├── 05_coc/             (CoC declaration, OECD diagram)
└── 06_oecd/            (5-step coverage per step)

Note

For shipments with audit packs larger than 50 MB, generation runs asynchronously as a background job. A notification is sent when the ZIP is ready to download.

Buyer Portal

To grant a buyer read-only access to their shipments:

  1. Go to :menuselection:`Mining Traceability --> Portal --> Access Tokens`.
  2. Click :guilabel:`Create`.
  3. Select the buyer partner and the specific shipments they may view.
  4. Set validity dates.
  5. Share the portal URL: https://{your-domain}/coc/{token}

Portal Security

  • Tokens are cryptographically random (43-char secrets.token_urlsafe(32)).
  • Rate limited to 10 requests per minute per IP.
  • Cross-buyer data leak is actively prevented: a buyer's token requesting another buyer's shipment ID returns HTTP 404.
  • Expired tokens return HTTP 410 Gone; revoked tokens return HTTP 403 Forbidden.

Technical Details

OECD 5-Step Coverage

Five steps are seeded (Management Systems, Risk Identification, Risk Mitigation, Audit Readiness, Public Reporting). Each step has configurable tasks. Coverage % per site is computed as:

coverage_pct = (completed_required_tasks / total_required_tasks) × 100

Token Expiry Cron

A daily scheduled action flips portal tokens to expired state once their valid_to date has passed.

Odoo Proprietary License v1.0

This software and associated files (the "Software") may only be used (executed,
modified, executed after modifications) if you have purchased a valid license
from the authors, typically via Odoo Apps, or if you have received a written
agreement from the authors of the Software (see the COPYRIGHT file).

You may develop Odoo modules that use the Software as a library (typically
by depending on it, importing it and using its resources), but without copying
any source code or material from the Software. You may distribute those
modules under the license of your choice, provided that this license is
compatible with the terms of the Odoo Proprietary License (For example:
LGPL, MIT, or proprietary licenses similar to this one).

It is forbidden to publish, distribute, sublicense, or sell copies of the Software
or modified copies of the Software.

The above copyright notice and this permission notice must be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.

Please log in to comment on this module

  • The author can leave a single reply to each comment.
  • This section is meant to ask simple questions or leave a rating. Every report of a problem experienced while using the module should be addressed to the author directly (refer to the following point).
  • If you want to start a discussion with the author or have a question related to your purchase, please use the support page.