Field Level Controls

Field Level Controls let you choose which fields DataGrail includes when processing Access requests for an integration, and, for supported integrations, which objects DataGrail includes when processing Deletion requests. Most fields are included by default, though some are excluded by default depending on the integration. You can exclude or re-include specific fields or objects on a per-integration basis without affecting other connected integrations.

Super Admin and Connections Manager users can configure Field Level Controls.

Deletion Controls Availability

Access controls work at the field level. The Deletion column works at the object level and appears only for integrations that support it. Support is being extended to more integrations over time. See Deletion Controls for details.

Accessing Field Level Controls

The integration must be connected before the Field Level Controls tab is available.

1. Navigate to Integrations in the left sidebar of DataGrail.
2. Select the integration you want to configure.
3. Select the Field Level Controls tab.

Viewing Configuration

The Field Level Controls tab displays a table of fields grouped by category (e.g. users, logs), with an Access column showing whether each field is currently included in Access requests.

The table uses the following indicators to show a field's status:

Indicator	Meaning
Checkmark	The field is included in Access requests
Dash	The field is excluded from Access requests

Each category row shows a running count of selected fields, such as "17/18 Selected", so you can quickly see how many fields in that category are currently included.

If the integration supports Deletion Controls, the table also shows a Deletion column next to the Access column.

Required Fields

Some fields are required to identify the record and cannot be excluded. Required fields appear in the table with their checkboxes selected and disabled.

The integration's schema is fetched in real time whenever you open the Field Level Controls tab. Select Refresh Fields to re-fetch the schema on demand and pick up any recent changes.

Editing Configuration

Select Edit Controls to open an editable view of the field table.

1. Select Edit Controls.
2. Use the search bar to locate a specific field, if needed.
3. Select or clear the Access checkbox for an individual field, or select a category's checkbox to update every field within it at once.
4. If the integration supports Deletion Controls, select or clear the Deletion checkbox for an object.
5. Select Save to review your changes.

A category's checkbox reflects the selection state of the fields within it. Selecting the checkbox includes the entire category in Access requests; clearing it excludes the category, except for any required fields, which remain included. When only some fields within a category are selected, the checkbox displays an indeterminate state to reflect the partial selection.

The Deletion checkbox works differently: it controls the whole object and has no field-level selection. See Deletion Controls.

If you want to undo your changes, select Reset to Default to restore all fields in the integration to their initial state.

Deletion Controls

For supported integrations, Deletion Controls let you turn Deletion on or off for each object (category) of the integration, such as contacts, orders, or logs. Disabling an object keeps its data out of Deletion requests entirely.

The two columns control different request types:

Column	Applies To
Access	Access requests only
Deletion	Deletion requests only

When you enable or disable an object in the Deletion column, all fields within it are enabled or disabled automatically.

If you disable an object for deletion, DataGrail does not collect its records during the data collection phase of a Deletion request and does not delete them during the deletion phase. DataGrail decides what to process for a Deletion request using the Deletion column only, even during data collection. The Access column is not used for Deletion requests.

In the following Salesforce example, the lead object is disabled for deletion while contact remains enabled. The audit log records the change.

After you save, the table shows every field in lead as unselected in the Deletion column (0/84 Selected), while Access is unchanged.

Integration Dependencies

Some integration APIs have internal deletion dependencies that DataGrail can't control. For example, HubSpot can delete only contacts, through its GDPR delete endpoint. That delete also removes the contact's associated objects, so DataGrail marks those child objects complete once their contact is deleted. If you disable Contacts for deletion, DataGrail collects nothing and deletes nothing.

Confirming Changes

Before your changes are saved, a confirmation dialog summarizes the pending updates as Enabling and Disabling lists, each with a field count.

Select Confirm to apply the changes, or Cancel to return to the editable view without saving.

Changes Apply Going Forward Only

Field Level Control changes apply as soon as they're saved, but they do not apply retroactively. Requests that have already started processing use the configuration that was in place when they began.

Audit Log

Every change to Field Level Controls is recorded in the audit log, whether made by a user or attributed to the system, and includes the action taken, the affected field, the capability, and a timestamp. These entries are available in both the read-only and editable views. For example:

• "Emma Morgan selected firstName for access capability"
• "Alex Rivera deselected phoneNumber for access capability"
• "Emma Morgan deselected contacts for deletion capability"

SIEM Audit Log Export

If you have SIEM Audit Log Export configured, Field Level Control changes also appear under the Integration Connection Log category.