DataGrail Documentation

There are two ways to configure Okta SSO depending on how roles are managed:

1. Standard Configuration (Roles managed in DataGrail):

• Install the DataGrail app from the Okta App Catalog.
• Enter your DataGrail subdomain.
• Copy the IdP Metadata from the SAML Signing Certificates section.

2. Group Provisioning (Roles managed in Okta):

• Use a custom Okta App (not the catalog app).
• Create Okta groups with a consistent prefix (e.g., "DataGrail").
• Add Group Attribute Statements in the SAML config filtering by that prefix.
• Contact your Account Manager to complete the setup.
• Note: When Group Provisioning is active, roles cannot be managed within the DataGrail UI.

Access is restricted to email domains matching the account's primary domain. To invite users from different domains (e.g., agencies), contact support@datagrail.io for approval.

Invitation Methods:

• OIDC (Google/Microsoft SSO): Navigate to Settings > User Admin > Invite New User.
• SAML/SCIM: Assign the user or group to the DataGrail application within your Identity Provider (IdP).

The Live Data Map provides a view of privacy risk across systems. Inventory can be populated via:

1. System Detection: Automatic identification via Okta, Entra ID, and Google Apps (SAML/SSO) using internal networks and G2 catalogs.
2. Manual System Entry: For isolated or non-identifiable systems.
3. Responsible Data Discovery (RDD): A containerized API agent that identifies PII in integrated systems using ML models without transmitting the actual sensitive data.

Vera's AI capabilities can be accessed via Slack DMs. To set up:

1. Navigate to Settings > Slack > Connect Slack Workspace.
2. Map DataGrail users to Slack accounts under User Mapping.

Mapped users can interact with the Vera bot in Slack with the same permissions and capabilities as the web interface. Conversations maintain context within threads. Disconnecting the integration revokes access immediately, though user mappings are preserved.

Amazon SES is used as a transactional mailer. Configuration requirements:

• Use IAM AssumeRole (eliminates key rotation).
• A custom trust policy JSON with an External ID of 32+ characters is required.
• Ensure no configuration sets are applied to the Sender Identity.
• Ensure no IAM policies restrict AssumeRole.

The Privacy Request Center is the public-facing portal (default: privacy.yourdomain.com) where data subjects submit requests.

Requirements:

• CNAME DNS validation is required to host the center on your domain.
• Custom text and questions can be configured to collect organization-specific data.
• Request Policies: These determine the privacy rights offered globally. Contact support@datagrail.io to modify default policies.

A transactional mailer is required for identity verification and Direct Contact Workflows. Supported providers include Amazon SES, SendGrid, MailGun, Mandrill, Emarsys, and SendInBlue.

Setup Steps:

1. Go to Integrations > Configure New Integration.
2. Select the mailer provider.
3. Enable only the Transactional Mailer capability (do not enable Access/Deletion).
4. Contact support@datagrail.io with your Sender Email and Sender Name.

Best Practices: Configure Sender Identity verification, SPF records, and DKIM to prevent spam and ensure delivery.

The Risk Register allows organizations to track privacy risks. Risks can be created via:

• Assessments: Flag a specific question as a risk or add a risk to the entire assessment. These include a source link back to the assessment.
• System Profiles: Use the Risks tab on any system profile.

When adding a risk, users can select a Risk Type (or create a custom one) and choose from Suggested Mitigation Plans or a library of controls.

DataGrail Consent is a Consent Management Platform (CMP) for automating cookie and tracking compliance. There are two primary deployment methods:

1. Google Tag Manager (GTM): A turnkey integration where DataGrail manages tag execution and publishes the banner via the user's GTM account.
2. Embedded Deployment: Deploying consent.js directly on the website. This is used for sites not using GTM or as a supplement to an existing GTM setup.

DataGrail requires a customer-owned cloud bucket to store Privacy Request data (encrypted at rest and in transit). Supported providers are Amazon S3, Google Cloud Storage, and Microsoft Azure Blob.

Setup Steps:

1. Go to Integrations > Configure New Integration.
2. Select only the Privacy Request Storage capability.

Constraint: A minimum retention policy of 90 days is recommended; shorter retention periods may cause errors for in-progress requests.