This page documents all customer-facing changes to the DataGrail application made in October 2026. Additional entries will be added every week on Friday.

Week of October 12​

🚀 Features Added​

• Superwall is now available as a Request Manager integration, so you can automate Access and Deletion requests against Superwall instead of handling them by hand.
• Assessments can now require answers before submission. Admins and Risk Monitor Admins can turn on Required Questions under Settings → Risk Management → Assessments, so you no longer have to chase missing answers after an assessment is submitted. When several people contribute, only those assigned to an unanswered required question are blocked; everyone else gets a warning and can still submit.

🛠 Changes Made​

• Assessment Creators, Assessment Requesters, and Inventory Managers can now select systems and processing activities on assessments. Assessment Contributors can no longer edit assessment details.
• Consent banner cookies: DataGrail's own banner and TCF cookies now appear as locked, built-in rows in Cookie Rules and in your banner's tracking details, instead of showing up as Unmanaged.
• IAB TCF and GPP signals now report DataGrail's registered IAB CMP ID (470). Republish your consent configuration to apply it.
• Discovered Integrations loads up to 90% faster. The Assessments list and large-volume opt-out submissions are also faster.

🐛 Bugs Squashed​

• Resolved an issue where visitors couldn't click anything on your site until they made a consent choice on a bottom-bar or side-panel consent banner. Only the modal layout now blocks the page behind it.
• Resolved issues with consent banners where:
  • Publishing one SRI-enabled container could break TCF, GPP, and plugin scripts on your other SRI-enabled containers.
  • Enabling a new language overwrote tracking-details link translations.
  • Unmanaged and Archived cookie filters failed on high-volume accounts.
• Resolved issues where Discovered Integrations filters failed past the first page, and finished Data Discovery scans could still show "In Progress".
• Resolved an issue where Request Manager Agent API keys stopped working for accounts with multibrand permissions.
• Resolved issues where pasted edits to email templates weren't saved as changes, and weekly detection notification emails could be sent more than once.

Week of October 5​

🚀 Features Added​

• System Data Reports can now be customized. Admins can select Edit Template to add a Custom Questions section with their own questions, answer types, and options. Changes apply to every system in your inventory, while the standard fields stay locked so your core data map stays consistent.
• Security Audit Logs give Super Admins a searchable, 12-month record of every sign-in attempt and every allowed or denied access decision in your account. Find it under Settings → Security → Audit Log, or pull the logs into your own tools through the public API.
• Dixa is now available as a Request Manager integration, so you can automate Access and Deletion requests against Dixa instead of handling them by hand.
• Vera MCP can now assign, change, or remove system owners and contacts, including in bulk, and inventory searches now show who is assigned.

🛠 Changes Made​

• Sensitive personal information (SPI) data categories are now highlighted in yellow in assessments and processing activities, matching the Systems page, so sensitive data stands out during review.
• Greenhouse Access requests now return jobs, rejection reasons, current stage, and offers.
• Salesforce can now find and anonymize Nonprofit Success Pack (NPSP) address records.
• Inbound phone requests now start processing after 1 minute instead of 5.

🐛 Bugs Squashed​

• Resolved issues with privacy requests where closing a request didn't record the reason you chose, editing several request policies in a row could disable the Save button, requests could get stuck in Extracting Identifiers, and inbound emails with non-UTF-8 characters were dropped.
• Resolved issues where Email Intake left clear deletion emails unclassified, verification emails could fail to send, and Resend Download Link could time out.
• Resolved issues with assessments where rule pickers mislabeled nested questions, starting from an inbound link didn't show the Submit button, external contributor actions were missing from Change History, and Risk Monitor Admins couldn't open notification settings.
• Resolved issues where consent banner headings could produce invalid HTML and cookie rule patterns couldn't include $.
• Resolved an issue where Arity always created both request types. You can now choose Disclosure or Law Enforcement.
• Resolved an issue where accounts could be blocked from connecting new MCP clients.
• Resolved an issue where Explain with Vera on a workflow didn't answer from your actual workflow.
• Resolved issues where data broker status uploads could report unfinished records as "not found" or fail on temporary processing errors.

Week of September 28​

🚀 Features Added​

• Vera can now read images you upload to an assessment — screenshots, data flow diagrams, architecture docs, and more. Vera uses them when suggesting answers and generating "Analyze with Vera" insights, cites each image by file name, and adds an attachment summary describing what it found in the image.
• Forethought is now available as a Request Manager integration, so you can automate Deletion requests against Forethought instead of handling them by hand.

🛠 Changes Made​

• Consent log exports are now dramatically faster, so your exports stay reliable and up to date.
• Detected Risks now show which Vera Skill found each risk, and the Skill Library now separates interactive skills from detection skills.
• Data broker compliance — select any row in the DROP Status table to see its details, including why a CSV upload failed and step-by-step instructions to fix it. Manual uploads now also accept CalPrivacy removal lists, which withdraw earlier deletion requests.
• Zoom now supports additional fields for Field Level Controls.
• Klaviyo now uses Klaviyo's latest API version.
• Salesforce Service Cloud OAuth connections now support PKCE for added security.

🐛 Bugs Squashed​

• Resolved an issue where Zendesk field detection could miss newer custom fields on large accounts.
• Resolved an issue where renaming the custom section in a System Data Report template didn't update the System Overview page, and where newly inserted questions could appear out of order.
• Resolved an issue where Adobe Tags stopped syncing daily and Adobe rules weren't gated by their consent category when published. Disabled Adobe rules are now also clearly labeled.
• Resolved an issue where archived request policies could appear in the GTM template and consent interface. Regenerate and republish your GTM template to apply the fix.
• Resolved an issue where Banner Preview with a simulated location didn't apply that location's GTM consent defaults.
• Resolved an issue where saving a cookie rule could fail, and where deleted cookies still appeared under their domains.
• Resolved an issue where a stuck Data Discovery scan could block scheduled scans from running.
• Resolved an issue where request queue deadlines could show as due one day early in US timezones, and where the Data Subject Relationship filter was missing for some customers.
• Resolved an issue where long queries in the Agent query configuration box didn't wrap.
• Resolved an issue where resending a download link didn't reset identity verification, and where Verify Identity could stall when its email was suppressed.
• Resolved an issue where emails for unsupported locales didn't fall back to English.

This page documents all customer-facing changes to the DataGrail application made in September 2026. Additional entries will be added every week on Friday.

Week of September 21​

🚀 Features Added​

• IP allowlisting now covers every major way into your environment — user sign-in, API keys, Agents, and external MCP clients like Claude Desktop and Cursor — each with its own set of approved IP ranges. Enforcement is continuous and every allowlist is off by default, so nothing changes until an admin turns one on.
• Talon.One is now available as a Request Manager integration, so you can automate Access and Deletion requests against Talon.One instead of handling them by hand.

🛠 Changes Made​

• Assessment contributions — any assessment member can now submit their own contribution, including someone who both created an assessment and is a contributor on it. Approval authority is unchanged, so who can contribute stays separate from who can approve.
• Auth0 connections now accept private-cloud tenant domains, not just standard .auth0.com domains, so customers on private Auth0 instances can connect.
• You can now send a test email for DataGrail-hosted mailer senders directly from the integration's edit page, and the sender's status updates immediately after the test instead of waiting for the next health check.

🐛 Bugs Squashed​

• Resolved an issue where the Demandbase integration could fail to authenticate, so connections and token refreshes now work reliably.
• Resolved an issue where Greenhouse deletion requests didn't fully anonymize the configured candidate fields.
• Resolved an issue where the Apollo integration could stop authenticating after Apollo changed how API keys must be sent.
• Resolved an issue where SMS identity verification codes weren't sent for phone numbers entered without a country code.
• Resolved an issue where authorized-agent requests could stay stuck in "Awaiting Verification" instead of advancing as soon as the verification link was selected.
• Resolved an issue where a data broker deletion status upload could get stuck partway through after an interrupted deploy.
• Resolved an issue where the 45-day data broker deletion compliance deadline could be measured from the upload time instead of from when the list was accessed.

Week of September 14​

🚀 Features Added​

• Assessment template settings — assessment templates now have a Settings panel where you can set a default approver and one or more owners. On Risk Monitor templates, set the approver once and every assessment created from it — however it's created — gets the right person assigned automatically.
• Assessment Requester role — a new role lets you separate the people who create and work on assessments from the people who approve them. Requesters can do everything a Creator can — create, edit, invite contributors, upload documents — except approve an assessment, submit it for approval, or be assigned as an approver.
• Assessment email templates now cover the full assessment workflow — contributor invitations, assignment notices, reminders, and completion and approval notices can all be customized to match your own wording and branding.
• Field Level Controls are now available for Access requests on SurveyMonkey, DocuSign, Slack, and Zendesk, so you can choose exactly which fields DataGrail collects from each.

🛠 Changes Made​

• We reduced the size of the consent template generated for your Google Tag Manager container, freeing up publish headroom if you're running many privacy policies. Publish your container once to pick up the smaller template — no configuration changes needed.
• IP allowlisting in Settings > Security is easier to edit safely — the sign-in allowlist and machine IP range catalog now save independently and guard against accidental lockouts, and you can now restrict a new Agent's API key to specific IP ranges at creation instead of only after the fact.
• Data broker deletion CSV uploads that get rejected now show you the specific reason why — like an incorrectly named file — instead of a generic error, so you know exactly what to fix before re-uploading.
• Request Manager Agent 1.3.1 — routine maintenance and a security patch for a dependency vulnerability.

🐛 Bugs Squashed​

• Resolved an issue where an Adobe consent container in embedded delivery could be left with an empty consent rule that no longer did anything.
• Resolved an issue where @-mentioning a Creator, Requester, or Contributor in an assessment comment wouldn't surface them in the suggestion list.
• Resolved an issue where an assessment answer could fail to save and force you to restart the assessment — the answer is now preserved so you can retry without losing progress.
• Resolved an issue where the Intake Form editor could crash when loading certain relationship questions.
• Resolved an issue where bulk-editing contacts could silently drop a selection from the list.
• Resolved an issue where an automated data broker deletion status update could get stuck retrying and never complete, due to an internal filename mismatch.
• Resolved an issue where certain unclassified email-sourced privacy requests didn't receive their closure notification email.

Week of September 7​

🚀 Features Added​

• Contacts in Settings > User Admin — you can now manage everyone who owns a system in DataGrail but doesn't need a login from one searchable, sortable page, right alongside Users and Invitations. Each contact shows which systems they own and whether they were synced from your identity provider (Okta, OneLogin, and others) or added manually, and deleting a contact tells you up front how many system assignments will go with it.
• Field Level Controls are now generally available for Access requests across 13 integrations, including Salesforce, Stripe, HubSpot, Shopify, and Klaviyo. If you have Super Admin or Connections Manager permissions, you can choose exactly which fields (or entire field categories) DataGrail retrieves for an Access request, directly within each connected integration, and review your changes before saving. No action is needed — the defaults match what DataGrail includes today.
• Box deletion — Box can now process deletion requests automatically through its API, so you no longer have to find and remove files by hand. DataGrail locates the files, folders, and web links tied to the data subject and deletes them. Two new connection settings let you control whether items are purged from the trash immediately for permanent erasure or left to Box's retention window, and how non-empty folders are handled.
• Show only my assignments on Risk Assessments — contributors and reviewers on long risk assessments can now turn on "Show only my assignments" to filter the form down to just the sections and questions assigned to them. It's opt-in, off by default, and works for both internal and external contributors.
• Explain automated workflows with Vera — a new "Explain with Vera" button on the workflow view opens a Vera chat that walks through a workflow from top to bottom, covering every branch, condition, and path in plain language. You can keep the conversation going to dig into specific logic or ask how a workflow could be improved.
• Upload documents to an assessment via API — you can now attach a document to an existing risk assessment through the v2 API, so external systems like a procurement integration can add supporting files directly. The upload is attributed to the right person by email and appears in the assessment's attachments just like an in-app upload.

🛠 Changes Made​

• Assessment progress and status now appear in two separate, sortable columns in the assessments table. A new Progress column shows each assessment's completion as a readable percentage for the first time and is included in the CSV export, while Status stays a clear text label.

🐛 Bugs Squashed​

• Resolved an issue with how IAB TCF vendor data categories are synced from the Global Vendor List.
• Resolved an issue where custom systems you added yourself were left out of your RoPA export.
• Resolved an issue where the TSV viewer could hang your browser when opening large files.
• Resolved an issue where compound condition rules couldn't be edited in assessment templates.
• Resolved an issue where the Additional Info panel didn't load its saved title and description.
• Resolved an issue where a multibrand group wasn't copied to the inventory item when connecting an integration.
• Resolved an issue where deactivated users could still receive notification emails.

Week of August 31​

🚀 Features Added​

• Custom system names — you can now rename inventory items in the Live Data Map to match your own internal naming (for example, calling Salesforce "CRM"), which is especially helpful when you have more than one item for the same system. Anyone with edit permissions can set a custom display name from the three-dot menu on an inventory row or system profile. The original catalog name is preserved, and search matches both the custom and original names.
• User job titles and a smarter contact picker — each user can now have an optional job title (like "DPO" or "Legal Counsel") set in Settings > User Admin, and the system contact picker now shows each person's email and title alongside their name, with a badge indicating whether they're a DataGrail user or an external contact.
• Risk source assessments — risks flagged by an assessment now show the source assessment's ID and name (like "RA-0042 · Q3 Vendor Review") in a new Assessment column and in the risk detail panel, so you can trace any risk back to where it was identified.
• Automatic High Risk (DPIA) detection — RoPA forms now fill in their own High Risk (DPIA) answers by reading what's already known about an activity and its linked systems, checking the boxes for AI use, biometric data, genetic data, and targeting of children or vulnerable individuals. Every auto-filled answer is traceable to its source, unchecks itself if the source changes, and never overwrites an answer you entered. This is live for all customers, including a backfill of in-progress RoPAs.
• Weekly assessment emails — a new personalized weekly email lists only the assessments where you still have work to do — sections or questions to complete, or an assessment awaiting your approval — with a link straight to each one, and it's skipped in weeks when you're all caught up. It joins the account-wide admin summary email, and both are opt-in per person under Settings > Notifications.
• Request Manager Agent 1.3.0 — the Request Manager Agent can now send custom headers on OAuth2 client-credentials token requests and extract fields from API responses using JMESPath, giving you more flexibility when connecting custom APIs through the agent.

🛠 Changes Made​

• Salesforce Order Management PKCE support — the Salesforce Order Management OAuth flow now supports PKCE, so you can connect it even when your Salesforce org requires PKCE on its Connected App. The change is backward-compatible and needs no action for existing connections.
• Ada integration on v2 APIs — the Ada integration now uses Ada's Bulk End-User Deletion API for deletion requests, bringing more reliable deletion processing, clearer visibility into deletion progress, new deletion behavior configuration options, and a simpler setup with one less token to manage. No action is needed for existing connections.
• Assessments API — the v2 API now returns each assessment's identifier (like "RA-0042"), lets you assign and read an assessment's approver, and attributes API-created assessments to the correct creator and contributors by email.
• Email templates for Risk Assessments — email template settings are now available to Risk Assessments customers, so more teams can review and customize the emails DataGrail sends.

🐛 Bugs Squashed​

• Resolved an issue where an assessment creator couldn't approve it once an approver had been assigned.
• Resolved an issue where Adobe consent containers didn't appear in the picker across all projects.
• Resolved an issue where archived URLs still counted against your consent URL limit.

This page documents all customer-facing changes to the DataGrail application made in August 2026. Additional entries will be added every week on Friday.

Week of August 24​

🚀 Features Added​

• Multi-condition assessment logic — assessment templates can now branch on multiple conditions with AND/OR logic instead of a single trigger answer. You can show or hide entire sections, and automatically spin up a follow-on assessment (like escalating a threshold check into a full DPIA) when specific answers are given, with contributors invited automatically and the new assessment linked back to its parent.
• Cancel and reopen assessments — you can now cancel a stalled assessment instead of only finishing or deleting it. Cancelling makes it read-only, revokes external contributor access, and drops it from due-date reminders and completion-rate reporting. Reopen it later to pick up exactly where you left off.
• Assessment notifications in Slack — assessment assignments, comment @mentions, and due-date reminders can now be delivered as Slack direct messages from Vera, not just email. Connect your workspace, map your users, and each user can turn on Slack notifications in their preferences.
• Privacy Requests API fields — the list-requests and get-a-request v2 API endpoints now support an optional extra_fields parameter that returns approval status, assignee, closed date, and last updated date. It's opt-in, so existing integrations are unaffected.
• Download all request results — for integrations that generate multiple TSV result files, a new Download All button bundles every file into a single ZIP, replacing what used to be hundreds of individual downloads.
• Universal Consent iOS SDK 1.7.0 — the iOS Consent SDK now supports both reading and writing Universal Consent, so mobile apps can share and honor consent state consistently.

🛠 Changes Made​

• Processing Activity Systems tab — the Systems tab edit view now splits into a Linked Systems section (what's already attached, removable in place) and an Available Systems section (the rest of your inventory), so it's clear what's already linked versus what you're adding. Select All now applies only to your search-filtered results instead of your entire inventory.

🐛 Bugs Squashed​

• Resolved an issue with the Oracle Opera Cloud integration's handling of deletion requests.
• Resolved an issue with how the Ada integration processes email identifiers.
• Resolved an issue where consent audit log exports weren't scoped to the project you were viewing.
• Resolved an issue where the inventory risk filter still included dismissed and archived risks.

Week of August 17​

🚀 Features Added​

• Rich text editing for assessment answers — assessment answer boxes now support full rich text formatting, including bold, italic, underline, bulleted and numbered lists, and links. Exported PDFs preserve the formatting, and existing answers continue to work unchanged.
• Weekly assessment digest — admins now receive a weekly email summarizing assessment activity, so you can track outstanding work without opening the app.
• Processing Activity contact exclusions — Processing Activities now include a contact exclusions table so you can specify contacts that don't apply to an activity.
• Vietnamese consent support — consent management now supports Vietnamese for banners and preference displays.
• Unclassified request filter — the Request Type filter in Request Manager now includes an Unclassified option so you can surface requests that haven't been categorized yet.

🛠 Changes Made​

• Processing Activity Overview redesign — the Overview tab now shows the whole activity at a glance: a RoPA progress card with percent complete and questions remaining, a processing risk card with personal data types and data subjects, dedicated Linked Systems and Contacts cards (contacts now show which systems they're tied to), and new Recent Attachments and Recent Changes cards. Understanding an activity no longer means digging through separate tabs.
• Assessment template question numbers — the template builder now shows question numbers, making questions easier to reference and organize.
• System contact titles — the "Contact Type" field on system contacts is now called "Title" and appears next to each contact's name and email on the system profile, so you can label contacts as "Data Owner," "Legal Lead," and the like.
• Google Tag Manager consent delivery — stored consent is now delivered to Google tags on page load, with more reliable container lookup and automatic failover when publishing, so consent is applied consistently.

🐛 Bugs Squashed​

• Resolved an issue where the consent policy drawer could overlay the publish drawer.
• Resolved an issue where the Adobe consent banner could inject when another tag owner was already live.
• Resolved an issue where assessment creators couldn't remove approvers.
• Resolved Live Data Map issues with the "Detected By" filter and a false unsaved-changes warning when a System Data Report was approved elsewhere.
• Resolved an issue where the System Profile page didn't handle integration-loading errors gracefully.
• Resolved multibrand issues where notifications wouldn't save, the Privacy To-Do List returned a permission error, and detection notifications weren't scoped to the correct brand.
• Resolved an issue where connecting Cursor to DataGrail over MCP could fail during setup.

Week of August 10​

🚀 Features Added​

• Processing Activity change history — Processing Activity RoPA forms now have a Change History tab showing who changed what and when: answer edits, status changes, contributor and document changes, and system or contact links. Filter by category, expand any entry to see the before-and-after, and export the full history to CSV.
• Individual assessment submissions — each contributor can now submit their own part of an assessment when they're done, without blocking teammates. Once everyone has submitted, the assessment automatically moves to review, and a reviewer can send a single contributor's work back for more detail without reopening it for everyone else.
• Bulk skip failing integrations — when an integration breaks across many open requests, a new Integration Status filter surfaces every affected request so you can skip the failing integration across all of them in one action instead of opening each request individually. Every skip is recorded in the audit trail.
• Opt Out Request Received email control — you can now decide independently whether a Request Received email is sent when an Opt Out request comes in, instead of it being tied to the verification email setting. The email template is linked directly from the setting for quick review.

🛠 Changes Made​

• Google Tag Manager container opt-in — after connecting GTM, you now choose exactly which containers to share, with nothing selected by default, so containers can't be shared without explicit consent.
• Greenhouse upgraded to Harvest v3 — the Greenhouse integration now supports OAuth 2.0, ahead of Greenhouse retiring its legacy API-key authentication on August 31, 2026. Reconnect your Greenhouse integration with OAuth before then to avoid interruption.
• Consent Auditor scan results — the Failed filter now matches the Failed count, and each issue shows a plain-language description and suggested action instead of an internal code.
• System Inventory — items inside large rolled-up systems now paginate instead of loading all at once, keeping big systems fast to open.
• Live Data Map suggestions — the suggestions sidebar now shows every source behind a suggestion, grouped by vendor, and the RoPA Add Suggestions toast reports how many activities were created versus added to existing ones.
• System Overview — read-only attributes now refresh automatically the moment a System Data Report edit is saved, with no page reload needed.

🐛 Bugs Squashed​

• Resolved Salesforce issues so access and deletion request errors and upstream timeouts are classified and handled reliably.
• Resolved an issue where the Formstack integration returned a 400 error.
• Resolved an issue where cookie rule validation errors weren't shown in the interface.
• Resolved an issue where Consent Analytics charts formatted the time axis incorrectly.
• Resolved an issue where the About card collapsed when switching to the Contacts tab in the Live Data Map.
• Resolved an issue where RoPA edits could be lost during propagation.
• Resolved an issue where email intake requests didn't fall back to your configured email locale when no language was detected.
• Resolved an issue where deleting an assessment with contributor comments could fail.

Week of August 3​

🚀 Features Added​

• Proofpoint Secure Email Relay — a new integration lets you route DataGrail's transactional email through a Proofpoint Secure Email Relay, so outbound mail flows through your organization's approved email path.
• System Data Reports and RoPA are now live documents — SDRs and RoPAs no longer use the Approve/Draft/Edit cycle. They're always live and editable, so what you see in the report, the System Overview, and the Inventory table stays consistent. Your changes autosave, and versions are still captured automatically in the background after a period of inactivity.

🛠 Changes Made​

• User management at scale — Settings > User Admin and the assessment Invite Contributor picker now load quickly and search smoothly for organizations with thousands of provisioned users. Pagination, sorting, and search now run server-side, and the contributor picker supports search-as-you-type across your full directory instead of a capped list.
• Mixpanel batch deletion — the Mixpanel integration now processes multiple deletion requests together in a single batch, making large deletion runs faster and more reliable.

🐛 Bugs Squashed​

• Resolved an issue where editing or deleting a Privacy Request Center form could serve a stale, archived copy of a draft instead of the live draft.
• Resolved an issue where email previews appeared blank on request lists with more than 25 email intake tickets.
• Resolved an issue where the Stop Processing action was hidden for direct-contact deletions when API access automation was turned off.
• Resolved an issue where the email template assigned by a workflow automation wasn't pre-selected when sending email from an individual request — the standard template was used instead.
• Resolved an issue where confirmation emails weren't sent for some email intake requests even when confirmations were enabled.
• Resolved Salesforce issues so access and deletion request errors are captured and requests authenticate reliably.
• Resolved an issue where a missing integration could cause an error when loading configured integrations.

This page documents all customer-facing changes to the DataGrail application made in July 2026. Additional entries will be added every week on Friday.

Week of July 27​

🚀 Features Added​

• Vera now classifies Email Intake requests — instead of keyword matching, Vera reviews each inbound email to identify the data subject and accurately classify it as an Access, Deletion, or Opt Out request. When Vera isn't confident enough, the request is marked Unclassified so you can review it and select the correct type — or create an Opt Out request — directly from the wizard. Vera's classifications and any changes you make are recorded in the request activity feed. Nothing changes about how you forward emails, and accounts without Vera continue using the existing process.
• Assessment My Assignments drawer — a new button in the assessment header opens a drawer listing everything assigned to you in that assessment, grouped into section and question assignments. Each card shows the status, linked title, and who assigned it and when. Select an assignment to jump straight to it, mark assignments complete individually or all at once, and see assignment changes in the assessment's change history.

🛠 Changes Made​

• Audit Log downloads — each row in the Consent Audit Log table now has a dedicated Download action. When an export takes more than a moment to prepare, a Download in Progress indicator appears on that row so you know it's working and won't start competing downloads. If a download fails, you'll get an error with the option to retry.
• Assessment template builder — the template builder now highlights invalid questions and sections wherever they are, even in parts of the form you haven't opened, and the sidebar shows an error indicator so you can jump straight to the problem instead of hunting for why a template won't save.
• Session expiration — when your session expires while a tab is open, you now see a banner asking you to refresh to log in, instead of being silently redirected mid-action.

🐛 Bugs Squashed​

• Resolved an issue where Adobe containers were left out of the consent publish preview.
• Resolved an issue where newly seen cookies could be attributed to the wrong consent project instead of the project they were collected under.
• Resolved an issue where Vera charts displayed time-based and date-range categories out of order.

Week of July 20​

🛠 Changes Made​

• Rippling integration upgraded — the Rippling integration now runs on Rippling's modern Platform API, keeping this HR connection reliable as Rippling retires its legacy API. Authentication is now a single API token, and the same rich employee data — including sensitive fields like home address and date of birth — is still fully supported.
• Assessment export options — when downloading an approved assessment, you can now choose exactly what to include: toggle risk information and attachments on or off to get a standalone PDF, a full ZIP with attachments, or anything in between.
• Assessment country selection — country questions in assessments now use a collapsible checkbox tree grouped by region, with shortcuts for common selections like Global and EEA + UK — no more scrolling through 200+ countries one at a time. The same picker now powers country selection in the Live Data Map bulk-edit drawer.
• Assessment template visibility — Admins and Risk Monitor Admins can now hide DataGrail's default assessment templates, so only your organization's approved custom templates appear when creating a new assessment — reducing the risk of the wrong template being used for regulatory work like GDPR transfer impact assessments.
• Inbound Assessments — inbound assessment links now recognize when the submitter is already a platform user with the right access (Admins, Risk Monitor roles, Assessment Creators/Contributors) and route them straight into the app instead of sending a "check your email" link. Unmatched submitters see no change in their experience.
• Assessment creation — the Systems dropdown when starting a new assessment now lets you pick a specific system instance in addition to the parent system, and prefill data is aggregated across all instances when you select the parent.
• Processing Activities — systems with multiple connected instances (like separate production and sandbox environments) now collapse into a single expandable row instead of listing each instance separately, matching System Inventory's behavior.
• User management — the Users and Invitations tabs now support search and filtering.
• Assessment contributors — you can now search by name when inviting contributors to an assessment.

🐛 Bugs Squashed​

• Resolved an issue where the data subject request wizard language field didn't default to English correctly.
• Resolved an issue where cookie export patterns weren't consistently scoped to the correct consent project.
• Resolved an issue where a risk badge could display as undefined or an assessment's second risk wasn't linked correctly when re-adding it.
• Resolved an issue where Notion access requests could stall under rate limits.
• Resolved an issue where a DSAR download link didn't refresh after the original link expired.
• Resolved an issue where the Inventory table didn't show an error state when it failed to load.
• Resolved an issue where cookie rule match patterns rejected colons.
• Resolved an issue where the backend's TCF publish-ready status wasn't reflected in the UI.
• Resolved an issue where the Source filter was missing Adobe managed properties.
• Resolved an issue where a Vera chat thread reset before an in-flight run was cancelled.

Week of July 13​

🚀 Features Added​

• System Inventory bulk removal — you can now select up to 500 systems and remove them in a single action, instead of deleting them one at a time.
• Vera document awareness — Vera can now reference your system and processing activity documents when answering questions, giving more grounded and complete responses.

🛠 Changes Made​

• Processing Activities redesign — the Processing Activities table has a new look built around progress, not warnings. Each activity now shows a completion progress bar at a glance, and you can customize which columns appear so your team can surface what matters most.
• Assessment approvers — approvers are now easier to find when assigning them, and they're notified automatically when an assessment is assigned to them for approval.
• Document downloads — in the document drawer, the View button is now labeled Download, and selecting it downloads the file directly with the correct file extension instead of opening a new tab — so it's clear what will happen and your device recognizes the file type.
• Configure Email template link — the Configure Email workflow step now includes a View Template link, so you can jump straight to the email a workflow will send.
• Vera reasoning — Vera now keeps its reasoning visible after you accept a suggestion, so you can see why it made a recommendation.

🐛 Bugs Squashed​

• Resolved integration issues affecting Salesforce, Notion, Rippling, TeamUp, and Salesforce Marketing Cloud request processing.
• Resolved an issue where a long value in a Google Cloud Storage connection field could be truncated during setup.
• Resolved an issue where Manage Languages wouldn't save when no locale was selected.
• Resolved an issue where a leftover confirmation window appeared after approving a suggested data subject in the Live Data Map.
• Resolved an issue where the Manage Layout button could be hidden behind the top navigation bar.
• Resolved issues where custom consent tags and consent service metadata weren't correctly scoped to individual consent projects.

Week of July 6​

🚀 Features Added​

• Evidence documents — you can now attach supporting evidence documents directly to systems and processing activities, keeping documentation alongside the records it supports.
• SAP SuccessFactors — a new SAP SuccessFactors integration is now available, letting you search employee data across HR, payroll, and directory records.
• Assessment version history — assessments now show a list of related versions, and creating a new version records a change-log event, making it easier to track how an assessment evolved.

🛠 Changes Made​

• Consent Analytics — analytics are now easier to interpret at a glance, with descriptions on each chart, clearer metric definitions, and added context to help privacy, marketing, and engineering teams understand what they're looking at and what to do next.
• Vera upgraded to Claude Sonnet 5 — every Vera agent now runs on Anthropic's latest and most capable model, for sharper reasoning, more nuanced answers, and stronger instruction-following across the board.
• Vera chat — charts in Vera reports now appear inline right where they're referenced, answers stream live as they're written, Vera remembers more of a conversation at once, and Vera suggests a wider range of your day's tasks.
• Workflow Automations — the "Add an Action" drawer now groups the Configure Email action with the send steps that depend on it, making workflow setup clearer.

🐛 Bugs Squashed​

• Resolved an issue where the Edit Systems drawer pre-selected all AI-suggested systems instead of leaving the choice to you.
• Resolved an issue where intake requests submitted in a non-English language could get stuck due to mismatched email locales.
• Resolved an issue where an integration group assignment was dropped when editing a non-OAuth integration.
• Resolved an issue with BambooHR credential validation.
• Resolved an issue where integration setup errors showed a generic message instead of the specific permission that was missing.
• Resolved an issue where Email Templates appeared for Live Data Map-only customers who don't use them.
• Resolved an issue where duplicate access categories could prevent unchecking data types on a data subject request.

Week of June 29​

🚀 Features Added​

• Cisco Duo SSO — customers using Cisco Duo can now configure SAML 2.0 single sign-on. Follow the new setup guide, paste in your metadata URL, and users log in with their existing Duo credentials, with new users provisioned automatically on first login.
• Configure Email in Workflow Automations — a new Configure Email action lets you control exactly what email a workflow sends, or suppress it entirely, directly in the workflow. Send a specific published template or suppress emails per workflow — for example, suppress deletion-results emails for employee requests while keeping them for consumers, without touching global settings.

🛠 Changes Made​

• Automations index — the workflows list is now a sortable, filterable, searchable table. Sort by name, phase, status, or error count, filter by published or draft, and see error counts inline. "View in automations" links throughout the app now open a pre-filtered list showing just the relevant workflows.
• Vera ticket filtering — Vera can now match privacy requests across multiple statuses at once and exclude specific states in a single query, so questions like "active requests not in the setup wizard" or "closed requests that weren't spam" resolve cleanly. Past-due queries no longer drop closed tickets.
• Intelligence Library data subject accuracy — data subject categories in system metadata are now more accurate, with fewer false positives. Some fields may now be intentionally empty where the data genuinely can't be known.
• Domain verification — when email domain verification times out, you now see a clear "Verification Failed" state with retry guidance instead of a request that hangs on "Pending."
• Assessment assignments — the assignments panel is easier to use, with an empty state, a sticky Assign button, a pending-count badge, and alignment fixes.
• Assessment template permissions — managing assessment templates is now restricted to admins; Assessment Creators have read-only access to templates.
• iOS Consent SDK 1.6.0 — text elements now respect the style settings in your configuration for correct title, header, and body sizing, and a config parse failure affecting choice buttons has been fixed.
• Android Consent SDK 1.6.0 — the banner now recovers gracefully from a corrupted keyset instead of crashing the host app on launch.

🐛 Bugs Squashed​

• Resolved an issue where the Live Data Map dropped active filters (such as high-risk) when scrolling past the first page of results.
• Resolved an issue where automation settings showed a false success message when a save had actually failed (for example, for users without permission).
• Resolved several Suggested Processing Activities issues: duplicate activities from rapid clicks, an error when reusing an archived activity's name, and a delay before archived activities disappeared.
• Resolved an issue in Consent where you couldn't add a Links element back to a layer after removing the last link.
• Resolved an issue where the Monetate integration failed to refresh its OAuth token.
• Resolved assessment collaborator role issues so Contributors can correctly comment, add risks, and be assigned questions.

This page documents all customer-facing changes to the DataGrail application made in June 2026. Additional entries will be added every week on Friday.

Week of June 22​

🚀 Features Added​

• Language selector for privacy requests — agents can now set or change the language on any request submitted by email, phone, or API, and the correct translated email template goes out automatically. Selectable languages match those you've already enabled for email communications.
• Multi-brand sender aliases — multi-brand customers can now configure different sender names and email addresses for each brand or group within a single transactional mailer integration, so consumers immediately recognize which brand is contacting them. Email logs now capture the sender address used, making it easy to confirm each request went out from the right identity.
• Claude Compliance system detection — a new integration that tracks which MCP servers and tools are connected and used across your Claude enterprise environment, giving you visibility into your AI data sources.
• Assessment assignment lifecycle — assessment work assigned to teammates can now be resolved, unresolved, or cancelled, giving contributors clear direction on what's still outstanding.
• Domain-level email blocking — block entire email domains to prevent spam submissions to your privacy request intake.

🛠 Changes Made​

• Vera response persistence — Vera now keeps generating your answer even if your browser refreshes, disconnects, or navigates away; when you return, the completed response is waiting, with a clear retry prompt if anything went wrong. The Stop button now reliably cancels generation even before streaming begins.
• Vera ROPA answers — Vera can now filter your processing activities by legal basis, country, system, and data owner ("which activities rely on legitimate interest?"), and surface the full ROPA record for any activity on demand — purposes, legal role, consent origins, special-category data, safeguards, retention, transfers, and DPIA status.
• Vera data discovery status — Vera can now look up your Data Discovery agent status in real time, including whether each agent is connected, when it last ran, and whether any scans are active.
• Smarter integration troubleshooting — the "Troubleshoot this error" banner now appears only when there's real error data to analyze, and the AI only sees actual status codes and response bodies. This eliminates fabricated diagnoses (like phantom "401 Unauthorized" errors) on integrations that never returned a response.
• Intelligence Library personal data accuracy — personal data in system metadata is now significantly more accurate, with far fewer false positives. Some fields may now be intentionally empty where the processed data genuinely can't be known. Applies to newly added systems.
• Consent banner accessibility — hidden screen-reader labels (such as "Close," "Consent preferences," and "Search vendors") now follow the banner's active locale across 25+ languages, with English as a fallback.
• Final email suppression warning — a compliance warning now appears before you suppress the final email to a data subject.
• Android consent banner styling — banner text elements now respect the style settings in your configuration for proper title, header, and body sizing.

🐛 Bugs Squashed​

• Resolved an issue where the ROPA CSV export left the Transfer Impact Assessment column blank for every customer.
• Resolved a crash on the API Credentials page for users with no active keys.
• Resolved an issue where email-based requests could incorrectly auto-skip a step in the request wizard.
• Resolved an issue where privacy requests could get stuck in a Pending Delete state due to a timing race.
• Resolved an issue where skipped result emails were incorrectly shown as sent to the requester, and where "send results email" copy appeared during the initializing phase.
• Resolved an issue where unpublishing an automation redirected you away from the page you were on.
• Resolved Amplitude failures when downloading results.
• Resolved an issue where comments on approved assessments were still editable.
• Resolved an issue where assessment deletion could fail when a contributor was also an assignee.
• Resolved an issue where the Agents navigation was hidden for certain customers.
• Resolved several Consent issues: cookie rules returning a 422 error on save, and consent layout updates being applied to the wrong project.
• Resolved an issue where inbound assessments recorded the wrong author in the creator, email sender, and change history.
• Resolved Vera failing to retrieve your processing activities when asked.
• Resolved a SQL Server failure on deletion and opt-out requests that use stored procedures.
• Resolved an Android consent banner issue where switching between light and dark mode could leave the banner blank, plus fixes for button text casing and category parsing.

Week of June 15​

🚀 Features Added​

• Assessment collaboration — two new permission-scoped roles control who can build and fill assessments: Creators build assessments and templates and manage the full lifecycle for assessments they own, while Contributors answer questions, upload documents, and request AI review on assessments they're a member of. You can also assign ownership of specific questions or sections to individual users, and read the full (view-only) comment history on approved assessments.
• Archive per-policy intake form customizations — admins can now revert a published per-policy Privacy Request Center form back to the default "All Policies" form with a single Archive action, directly in the customization editor. The live form immediately serves the All Policies content, new drafts pick up from the right starting point, and historical ticket answers still display the labels from when they were submitted.

🛠 Changes Made​

• Google Consent Mode Auditor — Consent Scanner has been renamed to Google Consent Mode Auditor. The navigation tab is now "GCM Auditor" and "scan" wording is now "audit" throughout.
• Brevo integration — the SendinBlue integration has been migrated to Brevo following the rebrand and API change. The existing direct-contact integration was also renamed to "Brevo Direct Contact."
• Consent scan errors — when a scan fails because a URL can't be resolved, the page now shows exactly which URL failed and why, and keeps your list open so you can fix and resubmit.
• Assessment context copy — the Assessment Context description now accurately explains that Vera uses your provided context and documents to suggest answers.

🐛 Bugs Squashed​

• Resolved an issue where large opt-out request exports could time out.
• Resolved an issue where privacy requests could silently get stuck in a pending state and never advance to completion.
• Resolved authentication failures in the Amplitude and Salesforce integrations that could cause access requests and processing to fail.
• Resolved an issue where first-time SAML/SSO logins in multibrand setups landed on a blank or forbidden page until a second login.
• Resolved an issue where the Create Assessment drawer lost system data after canceling and reopening, producing assessments with missing systems.
• Resolved several Consent issues on large accounts: cookies staying "Unmanaged" despite a matching rule, slow or incomplete cookie categorization, inaccurate counts in the bulk cookie-rule toast, and a consent banner that failed to render when its categories layer was missing.
• Resolved Consent Project scoping issues where records, publish errors, and policy categories could be saved to or surfaced from the wrong project.

Week of June 8​

🛠 Changes Made​

• Microsoft UET Consent Mode — new documentation walks you through configuring Consent Mode for the Microsoft Ad Platform.
• Arity — the Arity integration now supports Access (data disclosure) requests in addition to deletion.
• Consent Analytics — the analytics dashboard has a refreshed full-width layout with redesigned charts, clearer compliance tables, and CSV export.
• Accessibility — button keyboard-focus outlines now meet WCAG contrast requirements for clearer keyboard navigation.

🐛 Bugs Squashed​

• Resolved an issue where one invalid URL could fail an entire Consent scan batch; invalid URLs are now validated up front and automatically disabled after repeated failures.
• Resolved an issue where the bulk Process Requests action reset your view to "All Requests" instead of preserving your filters.
• Resolved an issue where integrations could not be deselected on deletion requests; the include/exclude list is now editable until deletion runs.
• Resolved an issue where re-adding a previously deleted Consent scan URL returned a "URL has already been taken" error.

Week of June 1​

🚀 Features Added​

• Assessments API — programmatically create assessments from templates, submit answers with validation, monitor progress, and download finished assessments as PDFs. Requires an API key with the new Assessment and AssessmentTemplate scopes.
• Assessment Change History — every edit, contributor action, document upload, AI suggestion, and status change is now automatically logged with a full audit trail. Filter by question, contributor, or activity type and export as CSV for audit documentation.
• Assessment approver assignment — restrict who can approve a Risk Monitor assessment by assigning a specific approver.
• Assessment @mention support in comments — tag contributors and admins directly in assessment comments to notify them of specific questions or discussions.
• Assessment # reference autocomplete — insert clickable cross-references to any question or section directly from within a comment.
• Assessment comment resolve/unresolve — close resolved comment threads to reduce noise; toggle a filter to view them again when needed.
• Assessment link support in comments — external links in assessment comments are now clickable, with a safety prompt before opening.
• Data Classification tab on System Profile — view Data Classification results scoped to a specific system directly from its profile page, with the same table, filters, and details drawer you already know from the main Data Classification page.
• Ironclad for Live Data Map — Ironclad is now available as a connectable integration for the Live Data Map.
• Self-service SAML/SSO domain management — add and remove email domains for SAML/SSO login directly from Settings > Additional Domains, without opening a support ticket. Supports bulk entry, real-time validation, and immediate effect.
• DG-hosted mailer custom domain setup — configure and validate custom email domains for DataGrail-hosted transactional mailers directly in settings, with step-by-step DNS configuration instructions.
• Vera Global Context — the Global Context editor is now available directly from the Vera home screen as its own dedicated tab.

🛠 Changes Made​

• Vera real-time agent steps — Vera now surfaces each tool she uses as a collapsible step in the conversation, showing what she searched, fetched, or analyzed and how long it took. Steps collapse by default so the answer stays front and center.
• Consent layouts — the layouts page is dramatically faster and more reliable, eliminating the failure mode that caused multi-minute load times under database pressure.
• Request Manager email search — searching for a data subject by email in the privacy request inbox is now over 100× faster.
• System Detection on new authentication — configuring a new System Detection-capable authentication now immediately triggers detection jobs, so systems appear in your inventory in under an hour instead of 24–48 hours.
• Bulk system edit marks assessments as reviewed — bulk-editing systems in the Live Data Map now automatically marks their linked assessments as reviewed.

🐛 Bugs Squashed​

• Resolved an issue where Consent Analytics CSV downloads were failing.
• Resolved an issue where the System Inventory page could time out under cold-cache conditions.
• Resolved an issue where dates in the Processing Activities table were displaying in an incorrect format.
• Resolved several UI issues in the Invite New User dialog.
• Resolved an issue where the Vera MCP Write Access toggle appeared to revert visually after being enabled.
• Resolved issues where cloned Consent Projects could have corrupted layer data or missing group assignments.
• Resolved an issue where the base taxonomy root node displayed "DataGrail Base Taxonomy" instead of the customer's account name.
• Resolved an issue where verification reminder emails were not sent for requests stuck in an initializing workflow state.
• Resolved an issue where direct contact requests remained stuck in a queued state after ticket closure.

This page documents all customer-facing changes to the DataGrail application made in May 2026. Additional entries will be added every week on Friday.

Week of May 26​

🚀 Features Added​

• Consent Projects — create and manage multiple, fully isolated consent configurations within a single account. Each project gets its own banner layouts, cookie rules, privacy policies, categories, and locales — and publishes independently, so changes to one brand never touch another.
• Consent Analytics (Beta) — a new Analytics tab provides real-time visibility into consent banner performance, including opt-in/opt-out rates, geographic breakdowns, consent trends over time, and per-category insights.
• Sender Alias self-service configuration — you can now configure your transactional mailer sender name and from address directly in integration settings, without opening a support ticket.
• Assessment collaboration suite — leave comments on assessment questions and sections with markdown formatting, edit your own comments, see comment counts per card, and assign questions or sections to specific team members or external contributors.
• Phone number search in Request Manager — search the request queue by phone number from the sidebar. Supports full numbers, formatted numbers, or partial matches like the last few digits.
• A/B testing integration guides and pattern library — 6 new guides (Optimizely, VWO, LaunchDarkly, AB Tasty, Convert, Kameleoon) with pre-built cookie and storage blocking templates you can apply to gate experimentation tools behind consent.
• Email Template Publisher diff view — review exact inline diffs of template changes (red for previous, green for updated) before publishing, so you can see precisely what will change.
• Monetate integration for Request Manager — connect Monetate to process access and deletion requests via the Data Privacy API.
• Phaedon Tally integration for Request Manager — connect Phaedon Tally to process access and deletion requests via the Tally Platform API.

🛠 Changes Made​

• Vera drawer coexistence — drawers now open alongside the Vera assistant instead of covering it, so you can reference Vera while working in any drawer.
• iOS Consent SDK 1.5.0 — includes fix for banner open event parameter handling.
• Android Consent SDK 1.5.0 — includes consent container version tracking, policy UUID support, and rich text banner rendering.

🐛 Bugs Squashed​

• Resolved an issue where "Block All" or "Allow All" could not be saved as the default cookie handling behavior.
• Resolved an issue where recategorized scripts could be incorrectly blocked after a "Reject All" action when categories changed between published versions.
• Resolved an issue where opt-out submissions via custom intake forms were not processed correctly.
• Resolved an issue where the "Cookies Matched" count always displayed 0 when viewing cookie rule details.
• Resolved an issue where the BambooHR integration was failing due to an API URL migration.
• Resolved an issue with consent configuration version handling during publishing.

Week of May 19​

🚀 Features Added​

• Stream integration for Request Manager — you can now connect Stream (getstream.io) to process access and deletion requests. The integration retrieves user profiles, chat messages, and moderation reports, and supports asynchronous deletion with completion polling.
• Bulk "Process Request" action — you can now select multiple pending requests in the Request Manager list view and process them all at once, eliminating the need to open each ticket individually.
• Consent banner preview mode — a new "Preview" button lets you see exactly how your unpublished banner changes will look and behave on any URL before publishing. Preview configs auto-expire and never affect your live banner.
• Change History tab for System Reports and Processing Activities — a dedicated Change History tab on System Data Report and Processing Activity drawers shows a chronological timeline of every versioned export, grouped by date with direct links to PDF snapshots.
• Readiness Checks for Webhook integrations — you can now configure Webhook integrations to send automated Readiness Check requests, receive structured responses via callback, and drive conditional workflow logic — all without manual coordination.
• Vera integration performance insights — you can now ask Vera about historical integration outcomes, including failure trends over time, per-phase breakdowns (e.g., access vs. deletion), direct-contact responder behavior, and rankings by failure rate.
• Cookie Store API enforcement in Consent — DataGrail Consent now intercepts the modern Cookie Store API on both the main page and inside Service Workers, blocking unconsented cookie writes through the newer browser API that bypasses traditional document.cookie enforcement.
• Consent banner accessibility improvements — category toggle checkboxes now include proper ARIA labels in every supported language, ensuring screen readers can announce what is being toggled. Automated WCAG 2.1 Level AA checks now run on every update to catch regressions in color contrast, keyboard navigation, and focus management.

🛠 Changes Made​

• Assessment version indicators — versioned assessments now display their version number (Version 2, Version 3, etc.) directly in the assessments table, overview page, and question view as clean dot-separated metadata.
• Inbound assessment creator attribution — inbound assessments now display the actual contributor's name instead of a generic "Inbound" chip, giving you better visibility into who submitted each assessment.
• Assessment Analysis UI improvements — the insights drawer now features simplified copy, improved checkbox styling, larger system logos, a "New Insights" chip on the assessments table, and a "View Insights" button on the overview status card. Terminology has been updated from "Insights" to "Analysis" throughout.
• Assessment file upload size guidance — the attachment upload area now displays "Maximum file size: 10MB" and shows a more actionable error message when a file exceeds the limit.
• System Profile responsive layout — the System Profile page now adapts gracefully to smaller viewports, with buttons that wrap cleanly, a two-column layout that stacks vertically, and a fluid sidebar that scales with screen width.
• GA4 deletion API migration — the Google Analytics 4 integration now uses Google's new Admin API for user deletion, replacing the deprecated endpoint.

🐛 Bugs Squashed​

• Resolved an issue where Salesforce token refresh could fail under concurrent requests due to a race condition.
• Resolved an issue where the deny request flow for phone-submitted tickets did not render the email input field, blocking operators from sending denial notifications.
• Resolved an issue where request modal inputs displayed incorrectly after the recent icon migration.
• Resolved an issue where attempting to add an integration with a name already in use showed a generic error instead of a specific message.

Week of May 12​

🚀 Features Added​

• Vera source citations — every answer Vera gives in web chat that draws on our knowledge base or privacy laws now includes a Sources section with direct links.
• Global search for all tenants — the top navigation bar with global search is no longer gated behind Vera. All tenants now get the search bar with Cmd+K / Ctrl+K shortcut and results popover, making it easy to find pages, systems, and requests without digging through the sidebar.
• Risk assessment IDs in global search — assessment identifiers like "RA-729" are now recognized by both global search and Vera. Type an ID to get instant access with key details including template, status, creation date, and contributors.
• Search history in global search — your recent searches are now saved and displayed in a merged History tab, making it easy to revisit previous queries across search and Vera.
• Assessment contributor names — contributors are no longer just email addresses. You can now add a first and last name when inviting contributors, and names display on contributor cards throughout the assessment workflow.
• AI auto-categorization for consent tags — when the scanner detects scripts on your site, the system now automatically categorizes them, identifies the vendor, writes a description, and links to the vendor's privacy policy. Auto-classified tags show an AI badge and live on the draft until you publish.
• Vera support tickets and feedback — you can now ask Vera to create support tickets, submit product feedback, or check the status of existing tickets directly in chat.

🛠 Changes Made​

• Assessments table redesign — the assessments table now matches the modern system inventory design with column customization, smart sizing, pinned columns with horizontal scroll, a three-dot action menu, and a new product type filter.

🐛 Bugs Squashed​

• Resolved an issue where the Last Updated filter on the Policies page returned a TypeError.
• Resolved an issue where cookie rules showed as uncategorized on published consent sites.
• Resolved an issue where "Mark as Reviewed" was not working on system reports.
• Resolved an issue where discovered integrations were accessible without the Request Manager product.

Week of May 5​

🚀 Features Added​

• IAB TCF support in Consent — you can now enable the IAB Europe Transparency & Consent Framework directly in DataGrail Consent. Align your consent experience with the industry-standard framework used across the ad-tech ecosystem, including standardized purposes, vendor disclosures, and consent signals — all without needing an external CMP.
• Rich text formatting in consent layouts — the layout builder now includes a built-in rich text editor for body text and category descriptions. Bold, italic, underline, hyperlinks, and bulleted or numbered lists are all supported and render consistently across web, iOS, and Android. Formatting is preserved through translations, and all content is sanitized on save for security. Target rich text elements with CSS selectors for additional customization.
• Sub-Processor legal role in Live Data Map — you can now designate systems as "Sub-Processor" in your data inventory, a legally distinct role from "Processor" under GDPR. This distinction is available across system profiles, assessment templates, and system data reports.
• Assessment insights on System Profile — AI-powered risk and data suggestions from assessments are now surfaced directly on the System Profile page. A banner shows pending suggestions across all assessments for that system, and you can accept or dismiss them without navigating into the assessment.
• System Data Report to RoPA auto-sync — changes saved on a System Data Report now automatically propagate to all linked Records of Processing Activities, keeping RoPA data in sync without manual updates.
• Vera search processing activities — you can now ask Vera about processing activities in the Live Data Map. Search by name, filter for stale or incomplete RoPAs, and view associated systems, contacts, and status.

🛠 Changes Made​

• Vera auto-pagination — Vera now automatically pages through large result sets when searching tickets, risks, inventory items, assessments, and other records, so you get complete answers without asking for more results.

🐛 Bugs Squashed​

• Resolved an issue where multi-paragraph rich text in consent banners collapsed into a single line after saving.
• Resolved an issue where inserting a link in the rich text editor placed it at the beginning of the text block instead of wrapping the selected text. You can now also click an existing link to edit it.
• Resolved an issue where assessment due date edits were blocked even when the date hadn't changed.
• Resolved an issue where assessments with no questions returned an error.
• Resolved an issue preventing unverified requests from being closed if they were submitted via the app.
• Resolved an issue where consent scan submissions failed for URLs that couldn't be resolved.

This page documents all customer-facing changes to the DataGrail application made in April 2026. Additional entries will be added every week on Friday.

Week of April 27​

🚀 Features Added​

• Vera MCP write tools — Vera can now take action through external AI clients like Claude, Cursor, and Windsurf. Five new write tools let you add systems, create assessments, answer assessment questions, update assessments, and associate processing activities — all from your AI client. Write tools are off by default and require explicit admin enablement per user. A new MCP Logs page provides full visibility into every tool call.
• Bulk edit system profiles — you can now select multiple systems and edit processing activities, contacts, and assessment fields (legal basis, legal role, processing countries, data subjects, personal data categories) in a single operation.
• Assessment insights — AI-powered suggestions now surface potential risks and system data recommendations directly on assessments, helping you identify gaps faster.
• Local and session storage scanning — consent controls now extend beyond cookies to localStorage and sessionStorage. You can detect storage keys, review unmanaged storage activity alongside cookies, block storage reads and writes based on consent state, and apply Vera-suggested rules based on detected patterns.
• Global search by UUID and phone number — you can now search for tickets by pasting a UUID or typing a phone number in any format. Phone numbers are normalized automatically, so "(415) 555-1234", "+14155551234", and "4155551234" all find the same ticket.
• Readiness checks for custom direct contact integrations — you can now send automated readiness checks during request initialization to collect a response from an internal team before deciding how a request proceeds. Define a custom question, provide structured response options, and use the answer to drive conditional workflow logic.
• Delay execution workflow action — a new "Then delay execution" action node lets you insert a configurable pause (in hours) between workflow steps, giving upstream integrations time to finish processing before the next action runs.
• Assessments "Date Approved" column — the Assessments table now includes a sortable "Date Approved" column so you can see when each assessment was approved directly from the list view.

🛠 Changes Made​

• TSV download format options — when downloading request results as a TSV, you can now choose between rows (each record as a row) or columns (existing behavior), making large datasets easier to review and filter.
• Vera search history — removed the one-year lookback limit so Vera can search further back in your request and ticket history.
• Integration error banners — disconnected integration warnings now display as separate, clearer banners for transactional mailers and cloud storage, with improved error detection for sender issues.
• Released rm-agent:v1.0.5 - Fixed Valkey permissions in Docker container to enable deployments on Cloud Run and other container orchestration platforms with strict security contexts.

🐛 Bugs Squashed​

• Resolved an issue where Vera included closed and completed requests when answering questions about overdue privacy requests.
• Resolved an issue where deleted GTM tags still appeared in the consent banner tracking services shown to end users.
• Resolved an issue where DSR notification emails showed the wrong workflow state.
• Resolved an issue where policy names in the request modal dropdown didn't match the Policies page.
• Resolved an issue where the "Other" close reason was missing from the Bulk Close Requests modal.
• Resolved an issue where changing a consent tag's category didn't update in the UI.
• Resolved an issue where consent audit log CSV and TSV exports downloaded with the wrong file extension.
• Resolved an issue where a consent locale could not be re-enabled after being disabled.
• Resolved an issue where Privacy Request Center translation generation failed for certain locales.
• Resolved an issue where parent systems in the grouped inventory view showed the earliest child system's "date added" instead of the most recent.
• Resolved an issue where large cookie CSV exports timed out.
• Resolved an issue where data exports returned an error when integration data contained decimal numbers.

Week of April 20​

🚀 Features Added​

• Self-service SSO configuration — new customers can now configure their own SSO during onboarding. A secure link lets you choose your SSO provider (Google Workspace, Microsoft Entra ID, or custom SAML), enter your identity provider details, and activate SSO.
• Rokt integration — you can now connect Rokt in Request Manager to process deletions via API.
• Out-of-the-box consent layouts — new customers now start with three pre-configured consent layouts: GDPR (EU + UK), CPRA (California), and a Default fallback for all other locations. You can publish immediately and be compliant across the most common regulations from day one.

🛠 Changes Made​

• HubSpot integration upgrade — new HubSpot connections now default to v3 of the API. Existing v1 connections continue to work.
• "Mark as Verified" for request initialization — you can now mark a request as verified directly during the initialization phase without waiting for automated checks.
• Workflow automation deletion safeguard — you can no longer delete an unpublished workflow while requests are still actively running through it.
• Integrations table layout — the Integrations page now uses vertical space more efficiently, reducing excess whitespace.

🐛 Bugs Squashed​

• Resolved an issue where Pendo returned an error when a visitor was not found.
• Resolved an issue where the email template translations dropdown was missing for some customers.
• Resolved an issue where consent layouts returned an error when updating close behavior or creating new layouts with multi-layer link elements.
• Resolved an issue publishing consent cookie rules to live sites.
• Resolved an issue where adding contributors to assessments returned an error for certain assessment types.
• Resolved an issue where API key group assignment silently dropped the selected group on creation.
• Resolved an issue where consent publishing failed for customers with large Google Tag Manager containers due to API rate limits.
• Resolved an issue where Gladly deletion requests failed when a customer record had been merged.
• Resolved an issue where inbound call transcription incorrectly retried on authorization failures, eventually closing the request as spam.

Week of April 13​

🚀 Features Added​

• Configurable authorized agent verification — you can now choose whether data subjects must verify their identity when an authorized agent submits a request on their behalf. A new "agent only" option skips data subject verification when written authorization is sufficient.
• Customizable Opt-Out intake forms — you can now remove and restore the first name and last name fields on your Opt-Out intake form without affecting other privacy rights. Simplify your form when regulations don't require collecting a name for Do Not Sell requests.
• Vera inline chart visualizations — when you ask Vera questions about trends or distributions, she can now generate interactive charts — bar, line, pie, and scatter — displayed inline alongside her written response.
• Consent Subresource Integrity (SRI) — you can now enable Subresource Integrity for consent scripts, allowing browsers to verify that scripts haven't been tampered with before they run. Toggle SRI on in container settings, republish, and swap in the updated script tag.

🛠 Changes Made​

• Multiple user assignments in workflow automation — automation workflows now support multiple user assignment steps, so different stages of a request can be assigned to different team members.
• Safe workflow automation unpublishing — unpublishing a workflow no longer interrupts requests already in progress — they continue through the original workflow to completion.
• Risk register systems column — the Systems column now displays the system name directly for single-system risks and shows logos with hover labels for multi-system risks, making the register easier to scan.
• New Consent developer guides — two new guides for developers who need fine-grained control over how third-party content loads: Progressive Consent covers blocking embedded content behind a consent prompt, and Blocking Page Reloads documents three methods to prevent full-page refreshes when consent preferences change.

🐛 Bugs Squashed​

• Resolved an issue where editing a Merge! integration returned a 403 error.
• Resolved an issue where consent publishing failed for customers with large Google Tag Manager containers due to API rate limits.
• Resolved an issue where daily Okta user syncs timed out for customers with large tenants.
• Resolved an issue where deletion requests submitted via email or API incorrectly triggered verification emails.

Week of April 6​

🚀 Features Added​

• Email templates redesign — email templates have been rebuilt with a redesigned editing drawer, template duplication, language management with one-click translation regeneration, a review and publish flow with preview emails, and multiple template selection at send time.
• Ringside CRM integration — you can now connect Ringside CRM in Request Manager to retrieve personal data via API and process deletions via direct contact.

🛠 Changes Made​

• Customizable Additional Comments section — the Additional Comments section on intake forms is now fully optional. Remove it to eliminate noise from high-volume request queues, or re-add it anytime from the section drawer.
• RoPA CSV export by multibrand group — the RoPA CSV export now respects multibrand group permissions, so your export only includes processing activities and systems for the brand groups you have access to.

🐛 Bugs Squashed​

• Resolved an issue where consent publishing failed for customers with large Google Tag Manager containers (200+ tags) due to API rate limits.
• Resolved an issue where the Consent Mode settings page crashed for customers with incomplete category mappings.
• Resolved an issue where direct contact emails always included an SSO login link even when SSO was not required, blocking recipients without SSO from responding.
• Resolved an issue where users with the Live Data Map Admin role could not access the RoPA tab in Processing Activities.
• Resolved an issue blocking support access.

Week of March 30​

🚀 Features Added​

• Adobe Experience Platform Tags consent integration — you can now connect Adobe Experience Platform Tags (Adobe Launch) properties to manage consent and publish DataGrail.

🛠 Changes Made​

• Webhook data retrieval before deletion — webhook-connected integrations can now retrieve customer data before processing a deletion request.
• Group filter on Processing Activities — you can now filter the Processing Activities page by brand group.
• Multibrand Groups for Suggested Processing Activities — suggested processing activities are now scoped per brand group. A processing activity that exists for one brand no longer suppresses suggestions for another.
• Refactored the Request Manager Agent Terraform module for AWS ECS to support egress-only Agent versions.

🐛 Bugs Squashed​

• Resolved an issue where PDF generation failed when content contained emoji or special Unicode characters.
• Resolved an issue preventing the System Inventory table from scrolling past a certain point for some customers.
• Resolved an error in the System Inventory grouped view for non-admin users.

This page documents all customer-facing changes to the DataGrail application made in March 2026. Additional entries will be added every week on Friday.

Week of March 23​

🚀 Features Added​

• Initialization phase for Workflow Automation — a new automated workflow phase that runs immediately when a Privacy Request is submitted. Branch logic based on request source (API, Intake Form, Request Queue), verify identity, send confirmation emails, and extract identifiers — all before processing begins.
• Privacy Inspector 6.0 — a redesigned Chrome extension with new diagnostic tabs for cookies, integrations (Google Consent Mode, Shopify, WordPress, and more), and settings, plus the ability to set consent preferences and open banners directly from the extension.
• Discuss assessments with Vera — after approving a Risk Assessment, you can now ask Vera about the questions, answers, and source documents used during the assessment.
• Group filter on Agents page — users with multiple brand groups can now filter the Agents page by group, matching existing behavior on Systems and Data Classification.
• Multibrand Groups for Processing Activities — you can now assign brand groups when creating processing activities.
• Clear answer selections on Risk Assessments — easily clear radio, dropdown, multi-select, and date answers before an assessment is approved.

🛠 Changes Made​

• Vera chat UI refresh — wider response container, reduced visual density, and improved spacing for a more readable conversation experience.

🐛 Bugs Squashed​

• Resolved an issue preventing Risk Assessment PDF downloads from completing.
• Resolved an issue where email intake misclassified access requests as deletions due to keywords in email footers.
• Resolved an error in Consent audit log exports.
• Resolved an issue where deletion integrations could fire simultaneously instead of following the configured tier order.

Week of March 16​

🚀 Features Added​

• Consent banner preview by location — you can now preview exactly what banner a visitor would see based on geographic location, directly from within DataGrail. No more VPN testing or location spoofing to validate banners across jurisdictions.
• Cross-container sharing for custom tags and services — custom tags are now automatically available across all Consent containers by default, eliminating repetitive manual setup in multi-container environments.
• Added a Gem Integration with access and deletion capabilities on Privacy Requests.

🛠 Changes Made​

• Improved the preview banner UX in Consent layouts.
• Improved Vera top bar responsiveness across different screen sizes.
• Disconnected integration notifications are now scoped to the relevant brand group.
• Integration webhook callbacks now return 409 Conflict for duplicate requests instead of 400, providing clearer signals for retry logic.
• Request Manager agent polling is now ~280x faster (p95 latency from ~3 min to 658ms), meaning Privacy Requests get picked up and processed significantly faster.

🐛 Bugs Squashed​

• Resolved an issue preventing RoPA PDF downloads from completing.
• Resolved an issue causing duplicate elements in Consent layers.

Week of March 9​

🚀 Features Added​

• Wildcard search has been added for Privacy Requests, Systems, Integrations, and Cookies, allowing for more advanced queries within DataGrail using ^ and +.
• The language picker for Consent is now its own asset, allowing you to place it anywhere on your banner.
• Added a Drip Integration with access and deletion capabilities on Privacy Requests.
• Added an MCP tool for DataGrail's Knowledgebase, allowing you to search DataGrail’s knowledgebase documentation from your favorite AI tools.

🛠 Changes Made​

• Multiple improvements to the Vera UI.
• Consent container settings now auto save.
• The third-party disclosures list can now be sorted flexibly.

🐛 Bugs Squashed​

• Resolved an issue preventing some Privacy Requests from moving forward, despite all integrations completing.
• Resolved an issue preventing the Consent Audit Log from downloading for some larger datasets.
• Resolved sporadic 500 errors from Persona Integration on Privacy Requests.

Week of March 2​

🚀 Features Added​

• Released DataGrail's Model Context Protocol (MCP) Server, allowing you to interact with DataGrail through AI tools like Claude and ChatGPT.
• Added OIDC support for DataGrail login.

🛠 Changes Made​

• Refreshed the Risk Assessments UI for easier navigation and readability.
• The language picker on the Privacy Request Center now shows translated language names.

🐛 Bugs Squashed​

• Resolved an issue creating inconsistencies when sorting or using filters on the System Inventory.
• Resolved an issue causing some managed trackers to appear in the New Uncategorized Trackers email.
• Resolved a PDF encoding issue when exporting content from DataGrail.
• Resolved an issue creating some inconsistencies with the Risk Assessment Contributor status.
• Resolved an issue preventing the Risks table from being visible on System Profiles.

This page documents all customer-facing changes to the DataGrail application made in February 2026. Additional entries will be added every week on Friday.

Week of February 23​

🚀 Features Added​

• Policies can now be added directly through the DataGrail app, giving your team full control of policies within DataGrail.
• Released a Shopify System Detection Integration, allowing your team to automatically surface systems from connected Shopify instances.
• Vera now features a unified search bar that lets you search across the entire platform. Type a query and instantly see results from Requests, Opt-Outs, Integrations, Assessments, Data Map, Workflows, Policies, Agents, and Processing Activities.

🛠 Changes Made​

• Risk Register risks can now be deleted.
• Vera responses are now streamed, so you can see answers formed in real time.
• When test mode is enabled for Consent, events are logged so you can validate behavior and confirm events are firing as expected.
• Agents can now be deleted.

🐛 Bugs Squashed​

• Resolved an issue causing some downloaded PDFs to display a missing font error.
• Resolved an issue preventing detected risks from being sorted correctly in the table.
• Resolved an issue preventing categories from being autoselected on Access Categories requests.

Week of February 16​

🛠 Changes Made​

• Multiple Vera UI improvements to make interacting with the search bar easier.
• Children of Internal System Integrations now inherit the multibrand group of the parent.

🐛 Bugs Squashed​

• Resolved an issue blocking Appsflyer deletion for some customers.
• Resolved an issue causing Salesforce to show as disconnected for some customers, despite a successful connection.
• Resolved an issue causing some invalid direct contacts to show in the Expired Direct Contact Summary email.
• Resolved an issue causing Marketo to show as disconnected for some customers, despite a successful connection.

Week of February 9​

🚀 Features Added​

• Direct Contact Integration duration can now be adjusted per Request Policy, allowing for specific control of processor SLA by location.
• Privacy Request start time can now be configured by Request Policy, allowing you to "start the clock" either when the request is created or verified.

🐛 Bugs Squashed​

• Resolved an issue preventing some assessment PDFs from being downloaded.
• Resolved an issue preventing some Shopify Integration deletions from completing.
• Resolved an issue blocking some Privacy Requests from moving to the next workflow step after all integrations were complete.
• Resolved an issue installing the GitHub Integration.
• Resolved an issue requiring some Privacy Requests to enter the wizard step, despite having an automation setting to skip it.

Week of February 2​

🚀 Features Added​

• You can now detect systems through the new Cisco Umbrella Integration.
• You can now opt out data subjects through the Salesforce Integration.

🛠 Changes Made​

• Privacy Request voicemails can now be downloaded at any stage of the workflow.
• The Discovered Integrations page now includes a filter for detected risk level.
• Migrated the Shopify Integration to the GraphQL Admin API.

This page documents all customer-facing changes to the DataGrail application made in January 2026. Additional entries will be added every week on Friday.

Week of January 26​

🚀 Features Added​

• Added support for the following languages in Request Manager and Consent: Indonesian, Hindi, Arabic, Korean, Malay, Thai, and Chinese (Simplified & Traditional).
• Added anonymization support for the Oracle Opera Cloud Integration on deletion requests.
• The Tracking Details asset can now group entries by name or vendor, allowing for better organization when many tracking services are listed.
• Tracking services can now be exported from DataGrail as JSON to support programmatically generated cookie policies.

🛠 Changes Made​

• Multiple System Inventory performance optimizations, resulting in a 98% speed improvement.
• System Inventory items are now grouped by system to make larger inventories more manageable.
• Multi-Brand users will now only see integrations associated with their group/brand, except for the Super Admin role.
• New integration processing options in Workflow Automations
  • Skip all - Don't process any remaining integrations
  • Process all - Process every integration
  • Process by brand - Only process global integrations + integrations assigned to the request's brand/group

🐛 Bugs Squashed​

• Resolved formatting issues when filtering the integration list by a multi-brand group.
• Resolved an issue processing identifiers for some multi-brand groups.
• Resolved an issue preventing the specific location for Opt Out Requests from showing.

Week of January 19​

🚀 Features Added​

• Suggested Processing Activities can now be dismissed.
• Discovered Integrations can now be filtered by type.
• Terraform module to support deploying Request Manager Agents in AWS Elastic Container Service (ECS).

🛠 Changes Made​

• Improved error message UI on the login page.

🐛 Bugs Squashed​

• Resolved an issue causing some scanned cookie domains to show as obfuscated.
• Resolved an issue blocking some Amplitude Integration deletions when the provided User ID is an email address.
• Resolved an issue preventing some users from being identified with the Cordial Integration.

Week of January 12​

🚀 Features Added​

• Risks that are created within assessments are now available on a new Risks tab on the Assessment Overview page for an easy overview.
• Released Consent Plugins for WordPress and Shopify, allowing consent preferences to be sent to the platform from DataGrail automatically.

🐛 Bugs Squashed​

• Resolved an issue preventing some months from being included on the Consent Dashboard and Audit Logs.

Week of January 5​

🚀 Features Added​

• Enhanced wildcard rules have been added for Cookie Management, allowing you to better categorize consistent cookie patterns.
• Released Unmanaged Cookie Behavior controls for Consent, allowing you to treat unmanaged cookies as classified under a category, or even block and delete all unmanaged cookies.
• The complete Consent Audit Log is now available by month directly within the DataGrail app.

🛠 Changes Made​

• Readability improvements to the integration list.
• Added the ability to archive unmanaged cookies that are not relevant or adding noise to the list.
• Introduced batch deletion for the MailChimp Integration, offering better processing efficiency for high-volume customers.

🐛 Bugs Squashed​

• Resolved an issue causing the Inspectlet Integration to fail on some Privacy Requests.