Console: Vault & data requests
Search subjects, view the timeline, export, process DSAR, and embed a self-service portal.
Consent vault
Search by identifier (email:…, external_id:…, internal id) in the active environment (the test/live toggle in the top bar). For each subject: identifiers (masked unless ADMIN/DPO), current consent, and the full timeline (consent + preferences + merges) with decrypted IP. Export downloads the full record as JSON.
Data requests (DSAR) — admin flow
| Type | What it does |
|---|---|
| EXPORT | Full history + receipts. Returns a signed, expiring URL. |
| RECTIFICATION | Updates the subject’s identifiers (re-encrypts and re-hashes). |
| ERASURE | Crypto-shredding: destroys the encryption key for each identifier and nulls IP/UA/URL on the vault rows, keeping the anonymized log. Requires DPO/ADMIN approval before processing. Emits subject.erased. |
ConsentRecords are kept as defensive evidence. See Troubleshooting.Self-service portal (embed on your product)
Let users submit their own requests from a "Manage my data" button in your product — no support ticket required. Use a pk_ key; the subject authenticates with a one-time token you generate on your server.
// Server — generate a portal token for the signed-in user
const { token } = await tc.createPortalToken('email:' + user.email);
// Client — open the self-service request form
window.location.href = `https://api.tripticonsent.com/v1/data-requests/portal?token=${token}`;The user picks a request type (export, rectification or erasure), submits it, and your DPO/ADMIN sees it in the console queue. Status updates emit data_request.status_changed webhooks.
Data retention
Configure how long vault records are kept under Sites & API keys → [site] → Retention. The defaults are indefinite. Two settings:
- Record retention — hard-delete
ConsentRecord/PreferenceRecordrows older than N days. Use only if a regulation requires it; most don’t. - IP minimization — null out the IP, user-agent and page URL on vault rows after N days, keeping the decision itself. Useful for GDPR data-minimisation without losing the audit trail.