# DataGrail Documentation — Full Content

> DataGrail is a complete privacy platform built for brands that need to go beyond a box-check solution and build real trust with their consumers. It covers the four pillars of privacy management: data discovery and mapping, DSR (Data Subject Request) management, consent management, and privacy risk assessment. All products are built on the DataGrail platform and powered by patented risk intelligence technology and an industry-best integration network.
>
> Support: support@datagrail.io | Homepage: https://www.datagrail.io | API Docs: https://docs.datagrail.io/api/v2 | Status: https://status.datagrail.io

---

## Platform Home
Source: https://docs.datagrail.io/

DataGrail helps privacy, legal, and security teams reduce privacy risk and scale their privacy program without scaling costs.

### Products

**Request Manager** — The #1 automated DSR management platform. Automatically accesses and deletes data across SaaS and internal systems. Supports hundreds of integrations and complete workflow customization aligned to Processing Activities.

**DataGrail Consent** — Verifiable cookie and tracker compliance across all web domains. Fast setup via Google Tag Manager. Tracks which trackers are firing in real-time. Supports white-labeled, customizable banners.

**Live Data Map** — Superior system detection for a holistic view of applications in your stack. Always up-to-date system inventory, PII details for 2,400+ systems, and dynamic RoPA creation.

**Risk Assessments** — Intelligent workflows and auto-populated fields for real-time DPIAs and PIAs. Centrally manage, automate, and export assessments. Covers GDPR, CCPA, CPRA, and AI regulations.

**Responsible Data Discovery & Classification** — ML-powered data detection and classification. Automatically identifies personal data on-prem or in the cloud. Auto-populates Processing Activity Reports.

---

## Platform Overview: User Management
Source: https://docs.datagrail.io/docs/overview/user-management/managing-users/

DataGrail uses role-based access control (RBAC) across all products. User roles can be managed in Settings > User Admin, which supports Google and Microsoft SSO invitations.

DataGrail recommends following the Principle of Least Privilege (PoLP) — assign only the minimum role necessary for a user's tasks.

**Key roles include:**
- **Super Admin**: Full access to all DataGrail products and settings.
- **Connections Manager**: Required to connect integrations and Google Tag Manager. Needed for Consent product integrations.
- **Request Admin / Request Agent**: Access to Request Manager settings and request processing.
- **Live Data Map Admin**: Full LDM access including adding/removing systems and configuring exports.
- **Inventory Manager**: Manage and export Processing Activity Reports. Can be scoped to specific systems.
- **Consent Management Admin / Edit / Read**: Tiered access to the Consent product.

Modifying roles: Select the user > Edit User > Roles dropdown. For LDM system-level access, use the "Systems to manage in LDM" dropdown.

Customers using Group Provisioning or Just-in-Time Provisioning must manage roles in their SAML provider (not in DataGrail directly).

### Inviting New Users
Source: https://docs.datagrail.io/docs/overview/user-management/inviting-new-users/

DataGrail restricts access to email domains matching your account's primary domain. To add users with a different domain (e.g., agencies), contact support@datagrail.io to approve the domain.

For OIDC providers (Google/Microsoft SSO): Invite via Settings > User Admin > Invite New User. For SAML/SCIM: Assign the user or group to the DataGrail application in your IdP.

### Configuring Okta for SSO
Source: https://docs.datagrail.io/docs/overview/user-management/sso/okta/

**Standard configuration**: Install the DataGrail app from the Okta App Catalog, enter your DataGrail subdomain, and copy the IdP Metadata from the SAML Signing Certificates section. Roles are managed within DataGrail.

**Group Provisioning** (advanced): Uses a custom Okta App (not the catalog app). Requires creating Okta groups with a consistent prefix (e.g., "DataGrail"), adding Group Attribute Statements in the SAML config filtering by that prefix, then contacting your Account Manager to complete setup. Roles cannot be managed in DataGrail when Group Provisioning is active.

**Multibrand Group Permissions**: Map Okta users to Multibrand groups within DataGrail. Configure via Settings > Groups.

---

## Vera (AI Privacy Assistant)
Source: https://docs.datagrail.io/docs/vera/overview/

Vera is an AI-powered privacy agent built on responsible design principles. Provides always-on guidance and operational assistance via chat interface or product-embedded actions.

### Key Capabilities
- **Context-aware guidance**: Combines connectivity, metadata library, and privacy AI for actionable recommendations specific to your DataGrail environment.
- **Customer-specific insights**: Comprehensive risk view across the platform, underscored by the Risk Register.
- **Unrivaled security and trust**: Secure, isolated AI agent architecture — zero external training exposure, 100% isolation, time-limited access, sensitive field redaction.

### Example Use Cases
- Understanding your data: "Tell me about trends in my activities over the past 3 months." / "What areas of risk should I be aware of?"
- Managing workload: "Are there any tickets past due?" / "What risk assessments are in progress and past due?"
- Getting guidance: "How should I get started with Consent?" / "Summarize the RoPA Management doc."
- Monitoring operations: "Are there any errors processing data subject requests over the past 6 months?" / "What high-risk systems have been detected with a matching integration?"

### Privacy & Security Architecture

Core principles:
- **Strict tenant isolation**: Architecturally impossible for Vera to access data outside your organization.
- **Permission inheritance**: Vera inherits the exact same permissions as the asking user.
- **Separation of logic and data**: AI model (Claude Haiku 4.5 on AWS Bedrock) is completely separate from DataGrail's database. No direct database access.
- **No training on customer data**: Data is used only as context per request, never for model training.
- **Full auditability**: Every data request is logged. Logs available to customers on request.

### Secure Data Access Flow
1. User submits question in Vera chat.
2. A unique short-lived JWT (5-minute) is generated, tied to the user, org, and conversation.
3. Claude Haiku 4.5 on AWS Bedrock processes the question.
4. Vera requests data from DataGrail via a secure MCP API endpoint, presenting the JWT.
5. DataGrail verifies: token authenticity + expiry, tenant match, user match, permission check.
6. Only after all checks pass does DataGrail retrieve org-scoped data.
7. Vera synthesizes the authorized data into a natural language answer.

### Slack Integration
Connect via Settings > Slack > Connect Slack Workspace. Map DataGrail users to Slack accounts under User Mapping. Mapped users can DM the Vera bot in Slack with the same capabilities as the web interface. Conversations maintain context within threads.

Disconnecting revokes access immediately; user mappings are preserved for reconnection.

### External AI Tools & MCP
Source: https://docs.datagrail.io/docs/vera/vera-mcp/introduction-and-use/

DataGrail offers an MCP server for connecting Vera's capabilities to external AI tools and agents as part of broader business operations. Request access through your Account Manager.

---

## Request Manager
Source: https://docs.datagrail.io/docs/request-manager/getting-started/

Automates processing of Data Subject Requests (DSRs). Requires three setup components: Foundation Connections, Privacy Request Center, and Integrations.

### Foundation Connections

#### Transactional Mailer
Enables DataGrail to send emails on your behalf for identity verification and the Direct Contact Workflow. Supported mailers: Amazon SES, SendGrid, MailGun, Mandrill, Emarsys, SendInBlue.

Setup: Integrations > Configure New Integration > select mailer > enable only Transactional Mailer capability (not Access/Deletion) > contact support@datagrail.io with Sender Email and Sender Name.

Email authentication best practices: Configure Sender Identity verification, SPF records, and DKIM for reliable delivery and spam prevention.

Email Templates can be customized post-setup to align with brand and privacy posture.

#### Cloud Storage
DataGrail stores Privacy Request data in a customer-owned cloud bucket. Data is encrypted at rest and in transit. Supported: Amazon S3, Google Cloud Storage, Microsoft Azure Blob.

Setup: Integrations > Configure New Integration > select only Privacy Request Storage capability. Recommended minimum retention policy: 90 days (shorter retention causes errors on in-progress requests).

### Privacy Request Center
Hosted on your domain (default: privacy.yourdomain.com). Data subjects submit privacy requests here. Requires CNAME DNS validation. Supports custom text and questions to collect org-specific data needed for processing.

**Request Policies**: Determine Privacy Rights offered globally. DataGrail provides default policies for common frameworks. Contact support@datagrail.io to make changes.

### Workflow Automation
Source: https://docs.datagrail.io/docs/request-manager/settings/workflow-automation/

Controls for manual review steps. Accessible to Super Admin, Request Agent, Request Admin via Settings > Automation > Request Manager.

**Data Subject Requests settings** — Post-verification behavior:
- Auto-start extraction + send confirmation email.
- Auto-start extraction without confirmation email.
- Require manual review before extraction (stays in Active: Wizard State).

**Active: Wizard State entry point**:
- Step 1: Review all Data Subject information.
- Step 5: Jump directly to confirmation email decision.

**Deletion Request settings** (optional, must be enabled by Account Manager):
- Bypass email verification → move directly to Extracting Personal Data.
- Require email verification before extraction.

### Opt Out Requests
Source: https://docs.datagrail.io/docs/request-manager/opt-out-requests/

CPRA gives data subjects the Right to Opt-Out of the Sale of their Personal Information. DataGrail handles these through the Privacy Request Center intake form.

Upon form submission, DataGrail immediately sets a browser cookie (regardless of verification status) to opt the user out of tracking scripts/pixels on the website. First and Last Name fields are shown but not required for Opt Out Requests.

Requests can also be created manually in the Opt Out Requests tab or via the V2 API. The `ccpa_dnsmpi` field can only be set on requests created through the Privacy Request Center. The Opt Out Requests page provides filtering by Verification Status, Request Status, and Location.

---

## DataGrail Consent
Source: https://docs.datagrail.io/docs/consent/overview/

DataGrail Consent is a CMP that automates compliance with cookie and tracking opt-in/opt-out. Used by privacy and marketing teams to display region-specific consent options, update policies without developer intervention, audit tracking scripts, and fully customize the consent banner.

### User Roles
- **Super Admin**: Full access to all Consent actions.
- **Consent Management Admin**: Full access to all Consent actions.
- **Consent Management Edit**: Manage containers, policies, banner layouts, tracking services, and publishing.
- **Consent Management Read**: View all Consent areas and download Consent Audits.

### Deployment Options

**Google Tag Manager (GTM)**: Turnkey integration. DataGrail manages tag execution based on consent preferences and publishes the banner through your GTM account. GTM admin signs in with Google — DataGrail handles the rest. Over 90% of companies use GTM.

**Embedded Deployment**: Deploy consent.js directly on your site, with or without GTM. Useful for sites not using GTM or when adding Consent alongside an existing GTM setup.

### Google Consent Mode
DataGrail supports Google Consent Mode, which lets Google-owned tags (Analytics, Ads) adapt their behavior to DataGrail consent signals. When a user denies all tracking, Google-owned services continue to fire but send only limited, cookieless, anonymized pings.

### Consent Policies
Source: https://docs.datagrail.io/docs/consent/settings/consent-policies/

Geolocation-based policies control tracker execution per region. Each policy corresponds to a regulatory framework (GDPR, CPRA, etc.).

**Configuration options per policy:**
- **Visibility**: Visible (banner appears until consent is made — required for GDPR) vs. Hidden (banner only accessible via link — common for US opt-out states).
- **Layout**: Which banner layout version to show for that region.
- **Initial Tracking Behavior**: Opt-in (trackers blocked until explicit consent) vs. opt-out (trackers run until the user opts out).
- **Browser Signal Handling**: Whether GPC and DNT signals are honored and which categories are disabled upon receipt. CPRA requires respecting GPC.
- **Opt Out Request Handling**: Link offline opt-out requests (from Request Manager) to automatically update online consent preferences.
- **US Privacy Strings** (beta): Emit GPP US Privacy Strings (uspv1, usnat) for advertising networks serving personalized ads.

Default policies are established by DataGrail under legal counsel guidance. Contact support@datagrail.io to make changes.

### Cookie Management
Source: https://docs.datagrail.io/docs/consent/managing-trackers/cookie-management/

Manages first-party cookies only (third-party cookies cannot be blocked due to browser security). If a data subject opts out of a category, matching cookies are blocked and deleted.

**Cookie Scanner**: Enable via Plugins > Manage Cookies. Samples cookies from live site traffic (first results in a few hours). Appears in the Unmanaged tab. DataGrail auto-suggests rules based on observed cookies.

**Cookie Rules** — wildcard match patterns:
- `*` — any characters at end
- `{d}` — digit sequences
- `{h}` — hexadecimal sequences
- `{w}` — alphanumeric sequences

Rule fields: Match Criteria, Name, Category, Vendor (optional), Privacy Policy Link (optional), Description (optional), Retention (Time or Session; 400 days default).

**Unmanaged Cookie Behavior**: Configure default treatment for unmatched cookies — classify under a category, or block/delete all unmanaged cookies.

**Cookie Policy JSON Export**: Copy the JSON URL from Consent Management > Containers > container details. Use this to dynamically generate and display an accurate cookie policy on your website.

Best practice: All cookies should be managed. Prioritize script-level blocking first — blocking a tracking script prevents its downstream cookies from being set at all.

### Best Practices for Managing Tracking Services
Source: https://docs.datagrail.io/docs/privacy-guides/managing-trackers-best-practices/

Legacy solutions over-rotate on cookie management. DataGrail Consent provides full control over all trackers (scripts, cookies, in-app). Recommended approach:

1. **Tag Manager (GTM, Segment, Adobe Launch)**: Start here — controls the most services with least effort.
2. **CMS Platforms (WordPress, Shopify)**: Use DataGrail browser APIs to pass consent preferences to built-in app control mechanisms.
3. **Inline Scripts (6Sense, AdRoll, HotJar, Drift)**: Use the ScriptControl plugin to gate scripts loaded inline.
4. **Ad Networks** (advanced): Pass consent values to external ad network databases.

Note: `<noscript>` tags execute only when JavaScript is disabled and cannot perform tracking — they do not need to be managed by DataGrail.

### Testing Consent
Source: https://docs.datagrail.io/docs/consent/testing/testing-consent/

Always test on staging before production. Remove existing consent solutions and GTM firing triggers from staging first.

**Environment setup**: Use Google Chrome, incognito window, no ad blockers, no VPN, no GPC/DNT signals.

**Validation steps:**
1. Publish latest Consent config to site (changes are not auto-synced).
2. Run `window.DG_BANNER_API.config()` in browser console — verify `consentPolicy` name and `initialCategories` match your location's expected policy.
3. Confirm correct banner layout displays.
4. Use Privacy Inspector to validate scripts only fire for accepted categories — test Accept All and Reject All.

**If scripts fire after opt-out:**
- Confirm correct mapping and version is published.
- Check if it's a Google-owned service in Consent Mode (expected to continue firing).
- Check if the script is inline and unmanaged — use Inline Script Management if so.

**Browser console commands:**
- `window.DG_BANNER_API.config()` — view current policy and category config
- `window.DG_BANNER_API.showConsentBanner()` — manually show the banner
- `window.DG_BANNER_API.getUSPrivacyString()` — retrieve current US Privacy String

---

## Live Data Map
Source: https://docs.datagrail.io/docs/ldm/ldm-overview/

Provides a comprehensive, dynamic view of privacy risk across systems. Used to review PII-containing systems, detect Shadow IT, understand AI usage across the stack, and prepare RoPAs.

### System Inventory Population Methods
1. **System Detection**: Integrates with Okta, Entra ID, Google Apps (SAML/SSO) to automatically identify third-party systems using DataGrail's internal network and external catalogs (G2).
2. **Manual System Entry**: For systems not identifiable via integrations or isolated in the tech stack. Reports can be generated for any manually added system.
3. **Responsible Data Discovery (RDD)**: A containerized API agent that locates and identifies structured, semi-structured, and unstructured PII data in integrated systems.

### Features

**System Inventory**: View all systems, PII categories they process, and inherent risk. Supports Instant Risk Classification for sensitive data and AI usage detection.

**System Profiles**: Per-system hub for Processing Activities, Risk Assessments, Risks tab, and Data Discovery results. Manage high-risk systems by capturing associated use case, owners, and Processing Activities.

**Processing Activities**: Add and manage processing activities within Live Data Map. Navigate between activities and systems for cross-functional collaboration. Create system-level Processing Activity Reports. Manage systems in bulk by Processing Activity.

**RoPA Management**: Automates RoPA creation with auto-filled fields, secure contributor invitations (links valid for 7 days), real-time compliance alerts, and flexible export options. Always audit-ready.

**Data Classification (RDD)**: Purpose-built ML models identify and report on sensitive data without surfacing or transmitting the actual sensitive details. Supports SaaS applications and optionally on-premises or first-party data sources.

### User Roles
- **Live Data Map Admin**: Full access including system add/remove, categorization, export configuration.
- **Inventory Manager**: Manage and export Processing Activity Reports; can be scoped to specific systems.
- **Data Discovery Read**: Read-only access to Data Discovery results.

### Discovered Integrations
Systems detected in Live Data Map automatically surface on the Discovered tab of the Integrations page when they have supported integration capabilities, enabling one-click connection for Request Manager, Data Discovery, and System Detection.

---

## Risk Management

### Risk Assessments
Source: https://docs.datagrail.io/docs/risk-management/risk-assessments/overview/

Simplifies creation and maintenance of DPIAs and PIAs. Required by GDPR, CPRA, and other laws. The California Privacy Protection Agency (CPPA) requires compliance with risk-assessment obligations starting January 1, 2026.

Key capabilities:
- Pre-fill assessment fields using DataGrail's Intelligence Library and System Inventory data (2,400+ integrations).
- Uncover and mitigate AI privacy risk.
- Launch standardized assessments (privacy expert-created templates) or custom templates.
- Inbound Assessments: generate shareable links for risk assessments to embed in internal tools/workflows.
- Conditional questions: show/hide questions based on prior answers.

When a system is added to the System Inventory, associated Risk Assessments appear in the Assessments tab on the System Profile for historical auditing.

**DPIA specifics**: Required by GDPR Article 35 before implementing data processing technologies or activities posing high risk to individuals' rights and freedoms.

### Custom Assessment Templates
Source: https://docs.datagrail.io/docs/risk-assessments/custom-templates/

Template Editor features:
- Multiple question types: multi-select, radio, drop-downs, and more.
- Pre-filled Answers: auto-populate from DataGrail's Intelligence Library or existing system reports.
- Nested Conditional Questions: show/hide questions based on parent answers using Add Rule.

### Risk Register
Source: https://docs.datagrail.io/docs/risk-management/risk-register/overview/

Create, track, and mitigate privacy risks across the organization.

Adding a risk: Select Add Risk, choose a Risk Type (or create a custom type by typing a new name), select from Suggested Mitigation Plans or the full library of controls.

Risks can be created from:
- **Assessments**: Flag an individual question (Flag as Risk) or entire assessment (Add Risk at bottom). Risks auto-populate in Risk Register with a source link back to the assessment.
- **System Profiles**: Risks tab on any system profile.

Risk Register is connected to Risk Assessments: filter and sort Assessments by associated risk count. A Risks tab on the Assessment Overview page shows all flagged risks for quick review.

---

## Integrations
Source: https://docs.datagrail.io/docs/integrations/overview/

The DataGrail Integration Network features 2,000+ tech partners including Salesforce, Okta, Atlassian, HubSpot, Zendesk, and Greenhouse. Powers Request Manager (access/deletion), Live Data Map System Detection, RDD, and Consent deployment.

### Integration Types

**API Integrations**: Direct API link between DataGrail and a system's public API. Automated extraction, deletion, and discovery. Managed via the Integrations page.

**Internal Systems Integrations**: Programmatic access and deletion against first-party/bespoke data systems. Include custom internal systems on Privacy Requests.

**Direct Contact Integrations**: Email workflow for vendors without an API or customers preferring non-fully-automated processing. Involves internal or external parties in request handling.

**Webhooks**: Send notifications of new Privacy Requests to external systems; your systems process the request and report results back to DataGrail.

### Access
Accessible to Connections Manager and Super Admin roles. The Discovered tab surfaces Live Data Map systems with available integration capabilities automatically.

### Notable Connection Guides

**Amazon SES** (https://docs.datagrail.io/docs/integrations/connection-instructions/ses/): Transactional mailer. Uses IAM AssumeRole (no key rotation required). Requires a custom trust policy JSON with a 32+ character External ID. Ensure no configuration sets are applied to the Sender Identity and no IAM policies restrict AssumeRole.

**Salesforce** (https://docs.datagrail.io/docs/integrations/connection-instructions/salesforce/): API integration with access and deletion capabilities. Updated to API version 62.0.

**Braze** (https://docs.datagrail.io/docs/integrations/connection-instructions/braze/): Access and deletion capabilities. Supports whole-record deletion option for high-volume processors.

---

## API Reference
Source: https://docs.datagrail.io/api/v2/

The DataGrail v2 API enables organizations to access data and manage resources across DataGrail modules.

**Authentication**: Pass API key in the Authorization header: `Authorization: Bearer <api_key>`. All requests over HTTPS. Request API keys from your Account Manager or support@datagrail.io.

**Validation**: GET `/ping` → empty body with status 200 confirms valid credentials.

**Notable endpoints:**
- `privacy_requests` — manage and retrieve privacy requests. Supports optional `include_identifiers` field; extracted identifiers included in responses.
- Opt Out Requests — supported via V2 API for creation and management.

Legacy v1 API: https://docs.datagrail.io/api/v1/

---

## Changelog
Source: https://docs.datagrail.io/changelog/

Updated weekly on Fridays. Full history available by month (e.g., /changelog/2026-01/).

### January 2026
- Risks created within assessments now available on a new Risks tab on the Assessment Overview page.
- Released Consent Plugins for WordPress and Shopify.
- Enhanced wildcard rules for Cookie Management.
- Released Unmanaged Cookie Behavior controls for Consent.
- Complete Consent Audit Log now available by month in-app.
- Terraform module for deploying Request Manager Agents in AWS ECS.

### December 2025
- Browser Signal Notice Asset and new layout behavior for CCPA compliance.
- Failed integrations on privacy requests can now be retried in-app.
- AirTable Integration performance optimizations.
- Whole-record deletion option added to the Braze Integration.
- Activity Logs more precisely indicate skipped integrations vs. no data found.

### November 2025
- Multibrand Group Permissions via Okta.
- Integration Errors page for connection attempt errors.
- Request Manager Agent v0.14.0 (improved deletion transaction handling).
- Self-Service Policy Management (enable/disable policies, edit rights/durations, update locations).
- Integration Errors dashboard for API error monitoring.
- Risk Register connected to Risk Assessments.
- Local Session/Storage blocking plugin for Consent.
- Custom risk types in Risk Register.

---

## Additional Resources

- Support: support@datagrail.io
- Homepage: https://www.datagrail.io
- Blog: https://www.datagrail.io/blog/
- Status Page: https://status.datagrail.io/
- Guide to State Privacy Laws: https://www.datagrail.io/resources/reports/guide-to-state-privacy-laws/
- Data Privacy Trends Report: https://www.datagrail.io/resources/reports/privacy-trends-2024/
- Do Not Sell or Share Opt-out Guide: https://www.datagrail.io/resources/reports/do-not-sell-do-not-share-opt-out-guide/
- Privacy Basecamp (community): https://www.datagrail.io/community/

*Disclaimer: Information in this documentation does not constitute legal advice. Seek professional counsel before acting on or interpreting any material.*