April 2026 | DataGrail Documentation

This page documents all customer-facing changes to the DataGrail application made in April 2026. Additional entries will be added every week on Friday.

Week of April 27

🚀 Features Added

• Vera MCP write tools — Vera can now take action through external AI clients like Claude, Cursor, and Windsurf. Five new write tools let you add systems, create assessments, answer assessment questions, update assessments, and associate processing activities — all from your AI client. Write tools are off by default and require explicit admin enablement per user. A new MCP Logs page provides full visibility into every tool call.
• Bulk edit system profiles — you can now select multiple systems and edit processing activities, contacts, and assessment fields (legal basis, legal role, processing countries, data subjects, personal data categories) in a single operation.
• Assessment insights — AI-powered suggestions now surface potential risks and system data recommendations directly on assessments, helping you identify gaps faster.
• Local and session storage scanning — consent controls now extend beyond cookies to localStorage and sessionStorage. You can detect storage keys, review unmanaged storage activity alongside cookies, block storage reads and writes based on consent state, and apply Vera-suggested rules based on detected patterns.
• Global search by UUID and phone number — you can now search for tickets by pasting a UUID or typing a phone number in any format. Phone numbers are normalized automatically, so "(415) 555-1234", "+14155551234", and "4155551234" all find the same ticket.
• Readiness checks for custom direct contact integrations — you can now send automated readiness checks during request initialization to collect a response from an internal team before deciding how a request proceeds. Define a custom question, provide structured response options, and use the answer to drive conditional workflow logic.
• Delay execution workflow action — a new "Then delay execution" action node lets you insert a configurable pause (in hours) between workflow steps, giving upstream integrations time to finish processing before the next action runs.
• Assessments "Date Approved" column — the Assessments table now includes a sortable "Date Approved" column so you can see when each assessment was approved directly from the list view.

🛠 Changes Made

• TSV download format options — when downloading request results as a TSV, you can now choose between rows (each record as a row) or columns (existing behavior), making large datasets easier to review and filter.
• Vera search history — removed the one-year lookback limit so Vera can search further back in your request and ticket history.
• Integration error banners — disconnected integration warnings now display as separate, clearer banners for transactional mailers and cloud storage, with improved error detection for sender issues.
• Released rm-agent:v1.0.5 - Fixed Valkey permissions in Docker container to enable deployments on Cloud Run and other container orchestration platforms with strict security contexts.

🐛 Bugs Squashed

• Resolved an issue where Vera included closed and completed requests when answering questions about overdue privacy requests.
• Resolved an issue where deleted GTM tags still appeared in the consent banner tracking services shown to end users.
• Resolved an issue where DSR notification emails showed the wrong workflow state.
• Resolved an issue where policy names in the request modal dropdown didn't match the Policies page.
• Resolved an issue where the "Other" close reason was missing from the Bulk Close Requests modal.
• Resolved an issue where changing a consent tag's category didn't update in the UI.
• Resolved an issue where consent audit log CSV and TSV exports downloaded with the wrong file extension.
• Resolved an issue where a consent locale could not be re-enabled after being disabled.
• Resolved an issue where Privacy Request Center translation generation failed for certain locales.
• Resolved an issue where parent systems in the grouped inventory view showed the earliest child system's "date added" instead of the most recent.
• Resolved an issue where large cookie CSV exports timed out.
• Resolved an issue where data exports returned an error when integration data contained decimal numbers.

Week of April 20

🚀 Features Added

• Self-service SSO configuration — new customers can now configure their own SSO during onboarding. A secure link lets you choose your SSO provider (Google Workspace, Microsoft Entra ID, or custom SAML), enter your identity provider details, and activate SSO.
• Rokt integration — you can now connect Rokt in Request Manager to process deletions via API.
• Out-of-the-box consent layouts — new customers now start with three pre-configured consent layouts: GDPR (EU + UK), CPRA (California), and a Default fallback for all other locations. You can publish immediately and be compliant across the most common regulations from day one.

🛠 Changes Made

• HubSpot integration upgrade — new HubSpot connections now default to v3 of the API. Existing v1 connections continue to work.
• "Mark as Verified" for request initialization — you can now mark a request as verified directly during the initialization phase without waiting for automated checks.
• Workflow automation deletion safeguard — you can no longer delete an unpublished workflow while requests are still actively running through it.
• Integrations table layout — the Integrations page now uses vertical space more efficiently, reducing excess whitespace.

🐛 Bugs Squashed

• Resolved an issue where Pendo returned an error when a visitor was not found.
• Resolved an issue where the email template translations dropdown was missing for some customers.
• Resolved an issue where consent layouts returned an error when updating close behavior or creating new layouts with multi-layer link elements.
• Resolved an issue publishing consent cookie rules to live sites.
• Resolved an issue where adding contributors to assessments returned an error for certain assessment types.
• Resolved an issue where API key group assignment silently dropped the selected group on creation.
• Resolved an issue where consent publishing failed for customers with large Google Tag Manager containers due to API rate limits.
• Resolved an issue where Gladly deletion requests failed when a customer record had been merged.
• Resolved an issue where inbound call transcription incorrectly retried on authorization failures, eventually closing the request as spam.

Week of April 13

🚀 Features Added

• Configurable authorized agent verification — you can now choose whether data subjects must verify their identity when an authorized agent submits a request on their behalf. A new "agent only" option skips data subject verification when written authorization is sufficient.
• Customizable Opt-Out intake forms — you can now remove and restore the first name and last name fields on your Opt-Out intake form without affecting other privacy rights. Simplify your form when regulations don't require collecting a name for Do Not Sell requests.
• Vera inline chart visualizations — when you ask Vera questions about trends or distributions, she can now generate interactive charts — bar, line, pie, and scatter — displayed inline alongside her written response.
• Consent Subresource Integrity (SRI) — you can now enable Subresource Integrity for consent scripts, allowing browsers to verify that scripts haven't been tampered with before they run. Toggle SRI on in container settings, republish, and swap in the updated script tag.

🛠 Changes Made

• Multiple user assignments in workflow automation — automation workflows now support multiple user assignment steps, so different stages of a request can be assigned to different team members.
• Safe workflow automation unpublishing — unpublishing a workflow no longer interrupts requests already in progress — they continue through the original workflow to completion.
• Risk register systems column — the Systems column now displays the system name directly for single-system risks and shows logos with hover labels for multi-system risks, making the register easier to scan.
• New Consent developer guides — two new guides for developers who need fine-grained control over how third-party content loads: Progressive Consent covers blocking embedded content behind a consent prompt, and Blocking Page Reloads documents three methods to prevent full-page refreshes when consent preferences change.

🐛 Bugs Squashed

• Resolved an issue where editing a Merge! integration returned a 403 error.
• Resolved an issue where consent publishing failed for customers with large Google Tag Manager containers due to API rate limits.
• Resolved an issue where daily Okta user syncs timed out for customers with large tenants.
• Resolved an issue where deletion requests submitted via email or API incorrectly triggered verification emails.

Week of April 6

🚀 Features Added

• Email templates redesign — email templates have been rebuilt with a redesigned editing drawer, template duplication, language management with one-click translation regeneration, a review and publish flow with preview emails, and multiple template selection at send time.
• Ringside CRM integration — you can now connect Ringside CRM in Request Manager to retrieve personal data via API and process deletions via direct contact.

🛠 Changes Made

• Customizable Additional Comments section — the Additional Comments section on intake forms is now fully optional. Remove it to eliminate noise from high-volume request queues, or re-add it anytime from the section drawer.
• RoPA CSV export by multibrand group — the RoPA CSV export now respects multibrand group permissions, so your export only includes processing activities and systems for the brand groups you have access to.

🐛 Bugs Squashed

• Resolved an issue where consent publishing failed for customers with large Google Tag Manager containers (200+ tags) due to API rate limits.
• Resolved an issue where the Consent Mode settings page crashed for customers with incomplete category mappings.
• Resolved an issue where direct contact emails always included an SSO login link even when SSO was not required, blocking recipients without SSO from responding.
• Resolved an issue where users with the Live Data Map Admin role could not access the RoPA tab in Processing Activities.
• Resolved an issue blocking support access.

Week of March 30

🚀 Features Added

• Adobe Experience Platform Tags consent integration — you can now connect Adobe Experience Platform Tags (Adobe Launch) properties to manage consent and publish DataGrail.

🛠 Changes Made

• Webhook data retrieval before deletion — webhook-connected integrations can now retrieve customer data before processing a deletion request.
• Group filter on Processing Activities — you can now filter the Processing Activities page by brand group.
• Multibrand Groups for Suggested Processing Activities — suggested processing activities are now scoped per brand group. A processing activity that exists for one brand no longer suppresses suggestions for another.
• Refactored the Request Manager Agent Terraform module for AWS ECS to support egress-only Agent versions.

🐛 Bugs Squashed

• Resolved an issue where PDF generation failed when content contained emoji or special Unicode characters.
• Resolved an issue preventing the System Inventory table from scrolling past a certain point for some customers.
• Resolved an error in the System Inventory grouped view for non-admin users.