
## Overview

One of the strongest features of Transcend's Assessments product is the ability to sync to the Data Inventory. There are several reasons to connect Assessments to the Data Inventory, such as:

1. Collecting information about your systems.
2. Evaluating your current systems.
3. Updating the information in your Data Inventory.
4. Collecting the information required to produce a ROPA report.
5. Checking the status of your vendor assessments directly from the Data Inventory.

We enable two different ways to connect your Data Inventory and Assessments:

1. **Sync Assessment responses to fields of the Data Inventory**: This feature allows you to send out Assessments that have certain questions mapped to fields of the Inventory and have the provided answers update the fields of the inventory.
2. **Link Assessment status to a row of the Data Inventory**: To ensure that each vendor, data silo, or other row of your Data Inventory has passed the required Assessments, you can have the status show up in their corresponding row.

Let's start with the first use-case.

## Sync Assessment responses to fields of the Data Inventory

To enable the option to sync responses from an assessment to fields of the inventory, you will need to first build that logic into the Assessment templates. You can decide to update an existing template, upload a template and then modify it, or create one from scratch. For this demonstration, we will create one from scratch.

### Configuring the syncing logic in the Templates

1. From the Assessments product page, navigate to the "Templates" tab.

2. Click on "Create new Template" on the top right.

3. Add a title, description, and any sections and questions you'd like.

4. Now, go to the questions you would like to sync to the inventory.

   4.a. If your question type is set to "Single-select" or "Multi-select", you will see an additional drop-down appear to specify the "-select type". Select one of the fields from your Data Inventory to automatically generate the "Answer Options" based on the available, applicable values in your Data Inventory.

   ![Select-type question](/public/docs/2024-07-30-assessments-select-type-selector.png)

   4.b. For example, if you selected "Data Category" as the "-select type" option, the respondent will see all of the available options for your configured "Data Categories" and will be able to select the one that matches the question.

   ![Selecting an existing Data Category](/public/docs/2024-07-30-assessments-smart-values-respondent-view.png)

5. Click on "Advanced Settings" and then toggle "Sync Response To Table" to "On".

![Toggle "Sync Response to Table" on](/public/docs/screenshot/2024-07-30-assessments-template-advanced-settings-toggle.png)

6. Now you will see the option to "Associate Table" and "Associate Field". Here you can select to which "table" these question answers should sync to, and within those tables, which "fields" (aka "columns") should be updated.

   > Note: Within the templates, you can associate the "Table" and "Column", while the "Rows" will be selected once an individual Assessment generated from that template is ready for review.

7. Continue associating tables and fields for any other question that you would like to connect.

Now that you have created the logic to map certain question answers to fields of the inventory, any assessment generated from this template will provide you with the option to sync the responses to corresponding values of the inventory.

### Specifying the rows that should be updated

Now that we have configured the logic within the templates, which determines the "Table" and "Column" that can be updated for a given answer, let's see how a reviewer can associate responses to a specific "Row" of the Data Inventory.

1. Create a new assessment based on a template that includes the "Syncing" feature toggled on for some questions.
2. Assign the assessment as you would normally.
3. Once an assessment is ready for review, click on "View Responses".
4. Here, you will see the "Table" and "Fields" that have been selected for a given question, as well as a drop-down element next to it. Click on the drop-down to select the "Row" where the answer should sync to.

![View Responses > Select Row](/public/docs/screenshot/2024-07-30-assessments-view-responses-sync-options.png)

5. Once the assessment is approved, the values will update the Data Inventory.

You have now successfully configured the mapping between questions and the Data Inventory, and updated the values for the corresponding rows.

## Link Assessment status to a row of the Data Inventory

Now, let's see how to track the status of an Assessment against a row of the Data Inventory. To begin, you will want to create a new custom field. For details on creating custom fields, follow the steps in the [Managing Custom Fields article](/_docs/overview/platform/custom-fields.mdx#adding-a-new-custom-field).

For custom fields that link to assessments, we recommend using the name of the assessment template you’re using, in addition to the word “Status” (e.g., “DPIA Status”).

During this setup, ensure the following options are set accordingly:

- Table Visibility: `enabled`
- Tables: `Assessments > Assessment`

![Table visibility checkboxes](/public/docs/screenshot/2024-01-26-custom-fields-title-desc-vis.png)

Note that you may add additional tables as desired, but the _Assessment_ option is required for the purpose of this guide. Remember to click on "Save changes" to confirm your changes to the custom field.

![Type Assessments in Custom Fields](/public/docs/screenshot/2024-01-26-custom-fields-type-template.png)

If you'd like to track the status of several assessments, feel free to create new custom fields for each assessment template.

## Review New Table Fields

After you've configured your custom fields, you can visit the tables that you selected under "Table Visibility" to check your newly added custom field.

Within the desired table, you can select the specific assessment related to each row of the table as pictured below.

![Data Inventory > Inventory view of custom field column](/public/docs/screenshot/2024-01-26-custom-fields-assessments-inventory.png)

As assessments move through their statuses, their respective custom fields will update in the selected tables to display their current status.


Adding Assessments to the Data Inventory


## Assessment Concepts

This document will outline the creation, sharing, review, and finalization of assessments. It should serve as a primer on including assessments as part of your data privacy program.

Within the "Assessments" page, you have the option of either importing your existing, completed assessments or creating new assessments based on templates. These groupings can be organized around your needs, such as by time (e.g., DPIA July 2024) or by orgs (e.g., AI Impact Assessment - Org ABC). Within these groups, you can then dynamically assign assessments.

## Importing an Existing Assessment

Importing completed assessments requires mapping a number of different fields from external platforms to corresponding fields within Transcend. Since each platform is unique, we will work to support several platform-specific formats starting from the most popular ones.

For now, Transcend supports the ability to import OneTrust-formatted assessments. To import your OneTrust assessments, navigate to "Templates", and click on "Import from OneTrust".

![OneTrust Import Assessment button highlighted](/public/docs/screenshot/2024-07-30-assessments-import-from-onetrust-button.png)

Here you will have the option to download the CSV template that should facilitate the mapping from OneTrust fields to Transcend fields.

![OneTrust Import Assessment Modal](/public/docs/screenshot/2024-07-30-assessments-import-from-onetrust-modal.png)

In the CSV template, you will find all the information needed to correctly import your completed assessments. Please note that all of the prepopulated column headers relate to the **metadata** of the assessment. This metadata should be included in the assessments that you export from OneTrust.

After this section of metadata, the rest of the assessment is represented with each column corresponding to a separate question and each row corresponding to its answer.

## Creating an Assessment

> Note: Assessments are based on templates. You can import or create your own templates under the "Templates" tab, or you can use some of the templates that are provided by default. For more instructions, review our [Templates guide](/_docs/assessments/templates.mdx).

In the **Assessments** tab, click on the “New Assessment” button.

![New Assessment Button](/public/docs/screenshot/2024-07-26-assessments-new-assessment-option.png)

A modal will appear where you can edit the title and description of the assessment and associate a template to it.

![New Assessment modal](/public/docs/screenshot/2024-07-26-assessments-new-assessment-modal.png)

## Assigning an Assessment

Once you have created this assessment, you will see a corresponding row added to your "Assessments" tab. Click on it and you will arrive at an empty page where you can start assigning this assessment.

![New Assessment List](/public/docs/screenshot/2024-07-30-assessments-request-assessment.png)

Now you are ready to share that assessment with your desired assignees. To do so, click on the "Request Assessment" button on the top right, which will open a new modal.

This view will let you assign folks by searching for their names or inserting their email addresses. Any assignee selected in this view will be able to collaborate on the same copy of the assessment.

![Share Assessment modal](/public/docs/screenshot/2024-07-30-assessments-request-assessment-modal.png)

You will also see a checkbox to "assign specific sections individually". Selecting this option will allow you to assign each section to a different assignee. Click on "send invites" when you've finished selecting your assignees.

![Assign Sections to different assignees](/public/docs/screenshot/2024-07-30-assessments-section-assignment.png)

If you'd like to quickly create and assign multiple copies of the assessment, rather than inviting several folks to the same copy, you can instead click on the hamburger button next to "Request Assessments", and then select the "Request Multiple Assessments" option. Adding several assignees in this view will create a separate copy of the assessment for each assignee.

![create and assign several copies of an assessment](/public/docs/screenshot/2024-07-30-assessments-request-multiple-assessments-modal.png)

Once you have assigned the assessment, you will see new rows appear within the assessment page for each copy of the assessment, and the assignee will receive an email requesting their responses to the assessment.

![Email prompt to respond to assessment](/public/docs/screenshot/2024-01-26-assessments-respond-to-assessment-email.png)

Within the assessment page, you can optionally customize the "Respondents", "Reviewers", "Section respondents", "Label", and "Due date" fields of the assessments for easier management.

![Assessment status after assignment](/public/docs/screenshot/2024-07-30-assessments-new-assessment-in-table.png)

You have now successfully shared your first assessments! We will now move to the "review" flow.

> Note: The person who sends out the assessment is set as the reviewer by default. This can be changed by selecting a different reviewer within the assessments table.

## Reviewing Assessments

Now that your assessments have been shared with the respective assignees, they will be responsible for filling them out and returning them to you for review.

To keep track of the status, you can refer to the "Status" field within each assessment page. When responses have been submitted by the assignee, the status will be updated to "In Review", and an email will be sent to the reviewers to let them know that a new response is ready for review.

![Assessment status in review](/public/docs/screenshot/2024-07-30-assessments-status-in-review.png)

Once an assessment is ready to be reviewed, you can hover over that row and click on the "View Responses" button that appears on the right side of the assessment row.

![Assessment hover > view responses button visible](/public/docs/screenshot/2024-07-30-assessments-hover-view-response.png)

Once you click on the "View Responses" button, a new page will open that allows you to review all the questions and their respective answers. You can do several things at this point:

1. Comment on individual questions.
2. Comment on entire sections.
3. Comment on the entire assessment response.
4. Sync supported responses to fields of the Data Inventory.
5. Request changes.
6. Approve the assessment responses.
7. Reject the assessment responses.

![Review Responses page](/public/docs/screenshot/2024-07-26-assessments-view-responses-expanded-section.png)

You can leave comments for the entire assessment by clicking on the "General Comments" button on the top left of the "View Responses" page. You can leave section comments by clicking on "Section Comments" on the right of each section, and to leave question level comments, you can do so by clicking on the "Comment" icon next to each question.

![Leave comments to responses](/public/docs/screenshot/2024-07-30-assessments-view-responses-leave-question-comment.png)

Additionally, you will be able to sync answers to certain supported question types to specific cells within the Data Inventory. You will see an element on the left of the "question level" comment button, with a _table_ and _field_ value, as well as an empty drop-down next to it. The _table_ refers to the table within the Data Inventory where you'd like that answer to sync to, the _field_ maps to the _column_ within the Data Inventory, and the drop-down will let you define the _row_ where the update should be applied. Please note that the update will not take effect until the entire assessment is approved.

![Map Assessment response to Data Inventory](/public/docs/screenshot/2024-07-30-assessments-view-responses-sync-options.png)

Requesting changes on a response will change the status of the assessment to "Changes Requested", and reopen the form to the assignees to address the feedback. They will be able to see the comments on each question and section, as well as their previous answers, and be able to make any changes necessary before re-submitting the assessment for review.

![Example comment on Assessment response](/public/docs/screenshot/2024-07-30-assessments-responder-change-responses.png)

Finally, once the assessment response is in good standing, you are able to "Approve" or "Reject" the assessment by clicking on the corresponding button on the top right.

Any action you take will update the status of the assessment to reflect the changes. Some of these changes will send a notification. For example, if you elect to "Request Changes", an email will be sent out to the assignee to allow them to address the feedback.


Creating an Assessment


## Introduction

A keystone of a company’s privacy program is the ability to find and mitigate risk in their data operations. Assessments allow companies to systematically identify, analyze, and minimize the data protection risks of a specific vendor, data system, project, or plan. It is a key requirement of GDPR and U.S. state regulations, and will help you demonstrate compliance with data protection obligations.

Assessments in Transcend allow you to operationalize your assessments process as well as integrate it directly into your Data Inventory & ROPA reporting process.

You can find [Assessments](https://app.transcend.io/assessments) in the sidebar navigation of Transcend’s Admin Dashboard under "Risk Intelligence".

![Assessments tab in the sidebar menu](/public/docs/screenshot/2024-01-24-assessments-side-nav-highlight.png)

In order to get started with Assessments, you will first want to create your templates.

Templates are reusable questionnaires that can be associated with different assessment cycles in order to capture information about certain processes, products, or vendors across your organization.

### Step 1: Building a template

> If you'd like to import your own template, follow the instructions [here](/_docs/assessments/templates.mdx)

To create your first template, click on the **Templates** tab and then **New Template** at the top right corner. This will open the _Template Editor_.

Here you can configure a _title_ and _description_ for the template, highlighting how the assessment should be used.

From here, the next step is to create sections. Sections are used to organize questions thematically and make assessments easier to review.

![New Template View](/public/docs/screenshot/2024-02-12-assessments-new-template-view.png)

To get started creating sections, click on **+ Add New Section** at the bottom left corner, which will prompt you to provide a title for the section.

You will also see that the new section has been added to the sidebar, and that a new button to add questions has appeared.

![New Template Section View](/public/docs/screenshot/2024-02-12-assessments-template-section-view.png)

Clicking on **+ Add New Question** will create questions within that section.

You can now create your first questions. From this view you can select the _question type_ to be used, add a _helper text_, or mark the question as _required_.

![New Template Question View](/public/docs/screenshot/2024-02-12-assessments-template-new-question-view.png)

In addition to the above, you can configure questions to show or hide based on the answers provided in previous questions, by clicking on **Advanced Settings** and then **Add Logic**

> Please note that the "Show / Hide Logic" can only work based on questions in the same section, and cannot be added to the first question of a section.

![New Question, Advanced Settings, Add Logic view](/public/docs/screenshot/2024-02-20-assessments-show-hide-logic-view.png)

Continue with the steps above until you are happy with your template. You can then save the template by clicking on **Save & Publish** or on the **kebab menu** icon for more save options.

Once saved, you can click on **Preview** to preview how the questionnaire will look to respondents.

![New Template Save & Publish or Preview view](/public/docs/screenshot/2024-02-12-assessments-template-save-view.png)

Once saved, you can navigate back to the **Templates** view to see your newly created template!

Next, we will cover how to use these templates to request assessment responses.

### Step 2: Creating and sending new assessments

Once you have created your desired templates, you can navigate to **Assessments** to create your new assessment.

Assessments can be organized according to their needs. To get started, click on the **New Assessment** button at the top right corner.

![New Assessment view](/public/docs/screenshot/2024-01-12-assessments-new-assessment-view.png)

You will then be prompted to add a _name_, _description_, and to associate your desired _template_ to this new assessment.

These fields will be used to organize your assessments according to your needs, so make sure to use specific titles and descriptions.

![New Assessment Modal](/public/docs/screenshot/2024-02-12-assessments-new-assessment-modal-view.png)

You will now see a new row has been added to the **Assessments** table. Click on that row to access the assessment screen. From here, you can assign and send your assessment to your desired respondents.

![Request Assessment view](/public/docs/screenshot/2024-02-12-assessments-new-assessment-new-request.png)

If you'd like to send a single copy of the assessment to several respondents, click on **Request Assessment**. If you'd like to send several copies of the assessment to several respondents, click on the **kebab menu icon** and select **Request Multiple Assessments**.

![Request Assessments single copy view](/public/docs/screenshot/2024-02-12-assessments-request-assessments-single-copy.png)

Once you click on **Send Invites**, new rows for each copy of the assessment will be created within the Assessments table, and the respondents selected will receive an email requesting their responses to the assessment.

![Email prompt to respond to assessment](/public/docs/screenshot/2024-01-26-assessments-respond-to-assessment-email.png)

### Step 3: Responding to an assessment

Once the respondent receives the email requesting their responses, they will be directed to their copy of the assessment to provide responses.

![New Respondent view](/public/docs/screenshot/2024-02-12-assessments-responder-view.png)

Once the respondents have completed the assessment and click on **Submit Assessment**, the status will change to _In Review_ and a notification will be sent to the reviewer that a new response is ready to be reviewed.

![Submit responses modal](/public/docs/screenshot/2024-02-12-assessments-respondent-submit-modal.png)

### Step 4: Reviewing responses

Within the _Assessments_ tab, the reviewer is able to click into the row corresponding to the assessment, and review each individual copy quickly and easily.

First, **hover** over the desired row, and then click on the **View Responses** button that appears.

![Assessment hover, view responses button visible](/public/docs/screenshot/2024-01-26-assessments-group-view-responses-hover.png)

This button will open the assessment, including their questions and provided responses, in a modal - allowing quick review of each answer.

Additionally, the reviewer can click on **General Comments**, where you will be able to leave general comments about the response provided.

![Modal to review responses on an assessment](/public/docs/screenshot/2024-02-20-assessments-review-general-comments.png)

The reviewer can then click on the **Comment** button next to any question and leave specific comments about the answers if desired.

![Leave comments to responses](/public/docs/screenshot/2024-01-26-assessments-view-responses-leave-comment.png)

Next, scroll to the bottom and decide whether to **Approve**, **Reject**, or to **Request Changes**.

When requesting changes, the respondent will see all the question-level comments that have been left to adjust their answers appropriately.

Finally, once the respondent has adjusted their answers, the reviewer will once again be notified and be able to review the updated assessment before deciding to approve, reject, or leave additional comments.

### Step 5: Connecting your assessments to your Data Inventory

For customers who perform assessments on items in their data inventories, you can track the status of each assessment in the appropriate section of your inventory.

For example, you can connect a copy of your "Vendor Risk Assessment" to your Salesforce data silo, in order to track the status of that specific vendor assessment.

To do so, you will first need to navigate to [Custom Fields](https://app.transcend.io/infrastructure/attributes) and click "**Add New Custom Field**"

![Add new custom field button view](/public/docs/screenshot/2024-02-14-custom-fields-add-new.png)

Include a _title_ and _description_, select the _tables_ where you'd like the status to appear, and select the _Custom Field Type_ **Assessments**. Now you'll be able to use the drop down on the right to select the **template** you'd like to keep track of.

![Configure new custom field](/public/docs/screenshot/2024-02-14-custom-fields-new-assessment-tracker.png)

Once you have selected your desired template, you can save your changes and navigate to the tables you selected to see that a new column has been created for the new custom field.

**Clicking** on any cell under that column will let you **select the corresponding assessment** that is based on the template you selected.

![Data Inventory > Custom Field view](/public/docs/screenshot/2024-02-14-data-inventory-data-silo-custom-field.png)

Once you are happy with the assessments you have selected, you'll be able to track their status as it changes directly from the Data Inventory.

The icon on the left of each assessment represents its current status between _Draft_, _Pending_, _In Review_, _Changes Requested_, _Accepted_ or _Rejected_.

![Data Inventory > Custom Fields Selected view](/public/docs/screenshot/2024-02-14-data-inventory-custom-fields-selected.png)

That's it! You have successfully created, assigned and reviewed your first assessments within Transcend.


Assessments: Quickstart Guide


## Introduction

Transcend Consent Management is a client-side Consent Management Platform (CMP) that lets you manage tracking events generated by third-party trackers integrated into your site. With it your site can allow some tracking events, and quarantine others and replay them only if and when your user later consents, at an appropriate place in their user journey. You can also block unwanted tracking events entirely.

> NOTE: Airgap works by regulating requests made in or forwarded to the [main thread](https://developer.mozilla.org/en-US/docs/Glossary/Main_thread) of the browser. If you’re considering moving scripts that require consent regulation (e.g., analytics or advertising scripts) out of the main thread and into a [web worker](https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Using_web_workers) (e.g., Partytown) we recommend carefully [testing](/_docs/consent-management/reference/debugging-and-testing.mdx) to ensure their requests are still being effectively regulated. Please reach out to your CX contact if you have any questions.

Setting up the Transcend Consent Management includes:

1. Initial set up and Data Flow collection
2. Configuring your Data Flows
3. Configuring your UI. This can include custom UI or integrating Transcend’s prebuilt UI banners into an appropriate place in your user journey
4. Setting it live!

With optional steps:

5. Debugging and testing with the user script
6. Creating an API endpoint in your backend to store the consent information generated by the consent manager. This is applicable if you want to store user consent information yourself (vs. stored with Transcend).

For small sites, we recommend that you do these steps in sequence. For larger sites, you may need to do them somewhat in parallel. Reach out to Transcend Support if you have questions about your rollout plan.

Maintenance of the Transcend Consent Management involves:

1. Adding and classifying new data flows
2. Understanding the ongoing analytics

## How Transcend Consent Management works

Transcend Consent Management manages tracking events by communicating with the Transcend airgap.js JavaScript library, which needs to be integrated to your site. This JS code snippet runs on your site and regulates outgoing requests based on the user consent and a set of configured “Data Flows”. A Data Flow represents some network request sent from your website, with some associated tracking purposes. It’s information about where data is flowing from your site, and why.

For example, if your site makes requests to googleadservices.com with user data for the purpose of advertising, our consent manager considers this a Data Flow with the value of googleadservices.com and the associated tracking purpose of Advertising. Transcend Consent Management would block the request(s) to googleadservices.com if your user hasn’t consented to giving up their data for the Advertising tracking purpose, or allow it if the user has given consent to Advertising tracking purposes.

A critical part of correctly implementing Consent is to label your site’s Data Flows correctly. This can be a sizable effort for any given website, but fortunately Consent is built with telemetry collection which makes this task easy.

## Understanding Data Flows vs Cookies

### Data Flows

![The data flows view in Transcend Consent](/public/docs/161867111-4b4359d9-e29b-4789-a13c-4238038cb8c0.png)

Consent’s primary method for managing tracking events is through the regulation of data flows.

A Data Flow represents a rule which matches network requests sent from your website with associated tracking purposes. By regulating these requests at the network-level, Consent is able to go beyond cookies and effectively manage 200+ tracking technologies. This helps ensure tracking technologies like XHR, Fetch, Pixels, Web Beacons, `iframe` elements and more don’t go unregulated and emit data that users have not consented to sharing.

Consent’s data flow regulation setup can also implicitly regulate third-party cookies when network requests that include cookies are categorized and regulated through the same network-level regulation engine.

### Cookies

![The cookies view in Transcend Consent](/public/docs/2022-04-19-cookies-tab.png)

Consent’s Cookies tab allows for the identification and categorization of individual
cookies to give additional flexibility when configuring regulation.{' '}

This can be especially helpful when configuring first-party cookies. Once you configure your cookie regulation settings, Consent will regulate modifications to these cookies in accordance with consent. If a user who has opted-in later changes their mind and opts-out of tracking, Consent will handle clearing the cookies that have been set on the client device.

## Adding the HTML script

When you begin setup, our onboarding steps will surface the exact `<script>` tag you need and ask you to add it to your site.

![A prompt to embed a script tag into your website.](/public/docs/2022-04-19-airgap-flip-the-script.svg)

You can also find the exact `<script>` tag to add to the `<head>` tag section of your site in Consent Management → Developer Settings.

Once the tag is added to your site, Consent is in “Reporting Only” mode by default and is only collecting telemetry data (the number of requests made to different domains) for the purpose of automatically filling out your Data Flows page. It does not regulate or block any requests yet, and should have no impact on your site functionality.

## Classifying with Telemetry

Once your script is set up, telemetry data is sent to our backend to be processed and classified, and will show up in your “Data Flows” and “Cookies” tables. Now, all you have to do is wait for enough telemetry data to come in -- the more visitors you have, the more pages they visit, the more quickly your data flows will fill up.

![The data flows view in Transcend Consent](/public/docs/screenshot/2022-04-19-data-flows.png)

_Note: The activity bar measures how many requests were made to a given domain, relative to the total # of requests we detected._

Occasionally, our backend may not be able to auto-classify the tracking purpose for a given domain. In these case, you’ll be prompted for help in the Consent Management dashboard:

![The Transcend Consent Management interface, requesting review for new data flows](/public/docs/screenshot/2022-04-19-review-data-flows.svg)

_Note: Your dashboard will let you know if there are data flows (in this case, 2) without any tracking purposes that require your review\._

If you use popular trackers such as Facebook or Google, you should check out [our additional documentation](/_docs/consent-management/configuration/integrations.mdx) on how to manually configure the data flows for them.

## A note on third-party frameworks

For the moment, we’re assuming that you aren’t using a third-party web framework or content management system and have very precise control of the HTML your site generates, because you will need to be able to strictly control the order in which scripts and other content are loaded in order for Consent to be most effective.

If you’re integrating Consent with a site built using a templating framework or with a third-party content management system, you will need to go through more steps specific to your web framework or content management systems. Please consult with Transcend Support for help.

For a site you’ve built from the ground up, integrating the airgap.js library is as simple as adding a `<script>` tag referencing the airgap.js library to the base HTML template of your site. The goal is to:

1. To ensure that the airgap.js script is loaded on every page of your site; and
2. To ensure that the airgap.js script is loaded first on every page of your site, before any other content or scripts which might result in network requests, e.g. images, even the favicon, CSS, or other JavaScript libraries.

To the extent possible, we strongly encourage you to add the airgap.js script to as few places as possible in your codebase. e.g. if your site has an inheritance hierarchy of HTML page templates, you add it as close to the top as possible, so ideally to the base or root template, and not to each individual leaf template.

## Updating the airgap.js script

Transcend's engineering frequently adds new features, bug fixes and optimizations to new versions of Airgap.
The version deployed on your websites can be easily modified with a few simple steps explained in details below.

1. Notice the version currently deployed, under `Deploy Status` in the top left corner of [`Consent Management > Developer Settings`](https://app.transcend.io/consent-manager/developer-settings).

![Consent Management Developer Settings`](/public/docs/2023-09-08-consent-dev-settings.png)

2. Go to the [`airgap.js Changelog`](https://app.transcend.io/consent-manager/developer-settings/changelog) tab and review the latest versions and their respective notes.
3. Select a version from the dropdown, or click `Update to latest version`.

![Consent Management Developer Settings`](/public/docs/2023-09-08-airgap-changelog.png)

4. Review the change by clicking the `Review Changes and Publish` button in the top right corner.
5. Make sure to select the correct bundle (Test or Prod) and review any previously staged changes that will apply along with this update, then click `Set Consent Manager Live` at the bottom of the review window.
6. Like with all changes published on your airgap.js bundle, you will be able to see its status in [`Consent Management > Developer Settings`](https://app.transcend.io/consent-manager/developer-settings). Your bundle status will briefly change to `DEPLOY_PENDING`, then `DEPLOYED`, at which point your airgap.js script will be configured to use the version you selected.


Consent Management Quickstart Guide


The Data Inventory hosts a wealth of information for the information within your Transcend instance. With Transcend, navigation and maintenance of that data is simple.

## Filtering in the Data Inventory

Each tab in the Data Inventory has extensive filtering options, allowing you to filter by any metadata, such as by Data Silo, Data Category, or Purpose of Processing.

Use the filter-search bar to pull the data you need.

![The filter button in the data inventory.](/public/docs/2023-11-13-search-filter-bar.png)

## Filtering the Audit Trail

You can filter the audit trail by the User who performed the event, the Event Type, whether the event was automated (i.e., by Transcend), and by a particular data silo.

![Filter audit trail](/public/docs/2023-11-13-data-inventory-audit-trail-filter.png)

## Configuring Columns in the Data Inventory

Columns in the Data Inventory can be reordered and hidden as desired. Click on the "Columns" button in the top right above a table to reveal these settings. Changes made to on the "Organization" tab will be applied to the whole organization, while the changes made on the "Personal" tab will only apply to your view of the given table.

Deselect columns from the list on the left to hide them from your table. Drag and drop columns on the right to reorder them in your table.

![Column configuration in the data inventory](/public/docs/screenshot/2023-11-13-data-inventory-column-filter.png)

## Exporting from Data Inventory

You can export a CSV from any table in Data Inventory. Any filters applied to the table will also apply to your export. You can also use our GraphQL API to access your Data Inventory programmatically.

![Export to CSV button in the data inventory.](/public/docs/165183605-029698dd-0b62-42fe-a786-8de645b6d7a6.png)


Managing the Data Inventory


## Introduction

A robust data privacy program requires up-to-date records of all processing activities within your organization. These records are crucial as they detail the collection, storage, usage, retention, and dissemination of data across your systems, vendors, products, and partners.

Transcend streamlines this process, allowing you to generate Records of Processing Activities (ROPA) reports based on your Data Inventory. This guide outlines each step required from filling out your data inventory, to generating your report.

Your Data Inventory in Transcend is structured into the following tables for clarity and ease of management:

- Data Silos
- Datapoints
- Vendors
- Data Categories
- Purposes of Processing
- Business Entities

To generate a comprehensive ROPA, we will need to populate some of these tables with information.

### Before getting started:

While the requirements for a GDPR ROPA are fairly well documented in Article 30 of GDPR, companies may have varying requirements or preferences in terms of what should be included in a ROPA report. Before getting started, it’s important to have a clear list of your desired fields and values that should be included in a ROPA report.

Below you can find some commonly requested fields:

- **Name and Contact details of the data controller / data protection officer**.
- **Purposes of Processing** - a description of the purposes for which personal data is being processed.
- **Categories of Data Subjects** - the categories of individuals whose data is being processed.
- **Categories of Personal Data** - the types of personal data being addressed (eg. names, addresses, email addresses, financial information, etc.)
- **Categories of recipients** - if applicable, information about who the data is being disclosed to, including recipients in third countries or international organizations.
- **Transfers to Third Countries** - if data is transferred to a third country or international organization, identify that country or organization and **document the basis of the transfer** (adequacy decision, standard contractual clauses, etc.)
- **Retention Schedules** - details of the time limits for erasure of the different categories of data, or if not possible, the criteria used to determine this period.
- **Technical and Organizational Security Measures** - description of the security measures implemented to protect personal data.
- **Legal basis for Processing** - the basis for processing personal information (eg. consent, contractual obligation, legal obligation, etc.)
- **DPIA** - If a data protection impact assessment is required, it should be tracked against the systems that require it.
- **Controllership status** - whether the third party is a joint controller, processor, or sub-processor.

> Please note that the above are examples of data mentioned in Article 30 of GDPR, and included in many different types of data reports. We encourage customers to further customize their tables and reports according to their specific needs.

### Recommended Workflow

To complete your Data Inventory, we recommend following these prioritized steps where possible:

- **Run Silo Discovery on your supported systems:**
  - Silo Discovery uncovers all the systems connected to your identity management providers, such as Okta, to start filling out your Data Silos table with the appropriate systems. If you can't run silo discovery, you can provide a list of your systems so we can import it for you.
- **Run Structured Discovery on your supported systems:**
  - Structured Discovery retrieves the data points, data categories, and other information relevant to the systems within your company, and adds them to your Data Inventory.
- **Send assessments to find missing systems or gather more information:**
  - If after adding systems manually you are still missing some information from other teams, you can send out assessments to retrieve information.
- **Add additional systems that were missed in the discovery tools:**
  - There are internal and external systems that cannot be captured by our automated discovery tools. Within the Data Inventory, you are able to add additional systems that are missing from the list.

## Step 1 - Collecting Information:

1. Now that you have a specific list of requirements for your ROPA, and a list of tools to fill out the inventory, the next step will be to start filling out the tables of the inventory. We recommend starting from your **Data Categories** and **Purposes of Processing** tables, as they represent essential aspects of a good ROPA report.

2. Review and add all your required [Data Categories](https://app.transcend.io/data-map/data-inventory/data-categories) to the corresponding table of the inventory.

![Reviewing Data Categories screen](/public/docs/screenshot/2024-04-26-data-inventory-data-categories.png)
![Adding new Data Categories to the table](/public/docs/screenshot/2024-04-26-data-inventory-data-categories-new-category.png)

3. Review and add all your [Purposes of Processing](https://app.transcend.io/data-map/data-inventory/purposes) to the corresponding table of the inventory.

![Purposes of Processing table](/public/docs/screenshot/2024-04-26-data-inventory-purposes-of-processing.png)
![Add new Purpose of Processing to the table](/public/docs/screenshot/2024-04-26-data-inventory-purposes-of-processing-new-purpose.png)

2. Run [Silo Discovery](/_docs/silo-discovery/index.mdx) on your Identity Management software to discover data silos in your organization and add them to your Data Inventory. Add the newly discovered silos.

![Silo Discovery Triage Step](/public/docs/screenshot/2024-04-30-data-inventory-silo-discovery-triage-highlight.png)

3. Assign owners, and review or add data categories to the discovered data silos.

4. There may be additional fields you want present in your ROPA, we encourage customers to add [Custom Fields](/_docs/overview/platform/custom-fields.mdx) specific to their needs.

![Adding new Custom Fields to show up in the Data Inventory](/public/docs/screenshot/2024-04-30-custom-fields-new-custom-field.png)

5. Navigate to the “Data Silos” table and add your systems manually if necessary.

![Data Silos view](/public/docs/screenshot/2024-04-26-data-inventory-data-silos.png)

1. Click on “Add Data Silos”
2. Find the integration that you would like to add, or add custom ones by clicking on “+ Add Custom Silo” and provide titles and descriptions.

![Data Silos view, add new data silo](/public/docs/screenshot/2024-04-26-data-inventory-data-silos-add-data-silo-add-custom-data-silo.png)

3. Click “Save” to save your new custom silos, and edit them on the Data Silos table if necessary.
4. If you are a [Structured Discovery](/_docs/structured-discovery/index.mdx) customer, run discovery on supported silos to retrieve information on the datapoints within them.
5. You can [add RegEx rules](/_docs/structured-discovery/index.mdx) for custom categories detection if applicable.

![Structured Discovery Main View](/public/docs/screenshot/2024-04-30-structured-discovery-main-view.png)
![Structured Discovery Data Points View](/public/docs/screenshot/2024-04-30-structured-discovery-datapoints-view.png)

5. If you are an Assessments customer, run [Assessments](/_docs/assessments/quickstart.mdx) to collect the missing information about each system from their owners.
   > Tip: While gathering data, pay special attention to the fields identified as being required in your ROPA. You can customize your Assessment templates around your needs.
6. Once your assessments are complete, you can fill out the information retrieved in the appropriate rows of the inventory.

## Step 2 - Report Creation:

1. Once you are happy with the information in your inventory, you will be able to create your report. To do so, navigate to [Data Reports](https://app.transcend.io/data-map/data-reports) and click on “New Data Report”.

![Data Reports main view](/public/docs/screenshot/2024-04-30-data-reports-main-view.png)
![Data Reports New Report view](/public/docs/screenshot/2024-04-30-data-reports-new-data-report.png)

2. Select a name for your report and click "next". Select all the tables that have information you’d like to add to your ROPA. You will still have the option to filter down the tables and fields you would like present in your ROPA.

![Data Reports New Report select table screen](/public/docs/screenshot/2024-04-30-data-inventory-data-reports-wizard-screen-1.png)

3. Many customers select “Data Categories”, “Purposes of Processing”, and “Data Silos” tables for their reports. These views include information that will likely meet the requirements of most customers’ data report needs -including ROPAs.
4. Click “Next”, and you’ll be able to apply filters on the table to only show what you want to include in the report. You can click on “Columns” to further refine the table by selecting only the fields you want present in your ROPA.

![Data Reports New Report filter tables and change columns view](/public/docs/screenshot/2024-04-30-data-inventory-data-reports-wizard-filters-and-columns.png)

5. Continue this process until you have refined each table according to your needs. Once finished, you will see the tables that you selected have been exported, and how many records were included.
6. Click “Download Data Report” to start downloading a ZIP file containing all the CSVs for each table. Click on “Save and Exit” to save this set of filters for future exports.

![Data Reports New Report ready for download](/public/docs/screenshot/2024-04-30-data-inventory-data-reports-wizard-report-ready.png)

7. You have now downloaded all the information required to run a ROPA! Review each file to ensure they meet your expectations, and decide how to customize it further.

> Please note that each table represents a different abstraction level of the data within your systems, so consolidating the exports into a single file is not possible.

Now that you have run and saved your report, you can re-run the same report by clicking on the relevant row under “Export Settings” and re-running the report. This will pull-in the latest information from your inventory before providing you with an export of it.


ROPA: Quickstart Guide


## Introduction

![Transcend Data Lineage](/public/docs/product/data-lineage.svg)

The Data Lineage feature aims to aid in data governance and oversight, allowing users to visualize data flows between different data silos.

![Data Lineage with several connected elements](/public/docs/screenshot/2023-11-08-data-lineage-full.png)

You have the ability to filter by data category and purpose of processing, providing a tailored view of data movements.

## Discovering Data Stores

First, be sure you have used Data Silo Discovery to discover data systems with personal data. This will give you a starting view of Data Silos in your organization to then draw the flows of data between those systems. View the [Connecting to Data Stores](/_docs/structured-discovery/connecting-data-stores.mdx) article for more details on completing this process.

### Adding relationships

In your Data Inventory > Data Silos tab, locate the `Sends data to` column. Input the data silos that receive data from the selected silo.

![Data Inventory, "Send Data to" Column](/public/docs/screenshot/2023-11-08-data-inventory-send-data-to.png)

Alternatively, you can use the Data Lineage UI to drag arrows to indicate relationships between the silos.

### Filtering

You can filter by `purpose of processing` or `data category` to visualize governance on the usage of data across these data silos.

![Data Lineage with filter for Purposes for Processing](/public/docs/screenshot/2023-11-08-data-lineage-purposes.png)

<TableOfContents tocEntries={tocEntries} />


Data Lineage


## Introduction

### **Introduction**

Transcend's DSR Automation offers a dynamic workflow management system for handling various data subject requests, including access, erasure, rectification, and more. DSR Automation facilitates compliance with data privacy regulations by providing tailored processes for different data subjects, data actions, regions, and legal requirements.

### Prerequisites

- In order to configure DSR Automation, you will need administrator access to Transcend and to the platforms that you wish to integrate to your DSR Workflows.

### Key Features

- **Configurable workflows**: You can configure your entire DSR pipeline, including custom authentication, erasure dependencies, enrichment, redactions, legal holds, and more. Find out everything you can do [here](/_docs/dsr-automation/configuring-requests/data-subject-requests.mdx).
- **Diverse and configurable data actions**: You can easily manage several different types of data requests, including access, erasure, opt-out/in, and more, across all your applicable data subject types. Find out more [here](/_docs/dsr-automation/configuring-requests/data-subject-requests.mdx).
- **Redactions**: You are able to configure a redaction step before returning access reports, to remove information that should not be included. Find out more [here](/_docs/dsr-automation/processing-requests/redacting-from-access-requests.mdx).

## Configuration

### Connecting DSR Integrations:

Before you can start using DSR Automation, you will need to ensure that all the required systems are connected and configured within Transcend. To do so, follow the steps below:

- Navigate to “Integrations”, click on “Add Integration”, and find your desired integration. Then click on the integration itself or on “Quick Add”.

![Integrations view all](/public/docs/screenshot/2024-01-08-integrations-view-existing.png)

- For initial testing, we generally recommend configuring an “AVC” type integration first, which results in automated email communications being sent to the owner of the specific integration. This solution works more widely than direct integrations, as it doesn’t rely on the API infrastructure of a third party. To configure an AVC Integration, visit the documentation [here](/_docs/dsr-automation/connecting-data-silos/automated-vendor-coordination.mdx). In this guide, we will move forward with connecting a direct API integration.

![New Integration > Workday](/public/docs/screenshot/2024-01-08-integrations-new-workday.png)

- Here you will see a description of the integration as well as a guide to retrieve the proper credentials to connect it. In this case, we see that we need to retrieve the Workday API keys.
- Under “Overview”, you will see the scope of the integration, including which DSRs can be run against it, and below it, under “Datapoints”, you can see which types of data would be in scope.
- Click on “+ Add” and you’ll be given the option of providing a title and an assignee to the integration, or choose to quickly create additional copies of it.
- To finish configuration, click on "Configure Integration" which will redirect you to the appropriate page to finish the set-up process.

![New Integration > Workday Configuration view](/public/docs/screenshot/2024-01-08-integrations-new-workday-click.png)

- Once you are satisfied with the integrations you have added, navigate to “Configure Integration”.

![New Integration > Workday > Configuration page](/public/docs/screenshot/2024-01-08-integrations-first-configuration.png)

- You will notice a red box at the top stating that the integration still needs to be connected. Navigate to the “Connection” tab to connect it.

![Integrations > Connection view](/public/docs/screenshot/2024-01-08-integrations-first-connection.png)

- Here, you will click on “Connect” and follow the steps on the right to connect the integration. In this case, it will look something like this:

![Integrations > Connect Workday > Example](/public/docs/screenshot/2024-01-08-integrations-connections-example.png)

- Follow the steps on the right side of the screen to connect your integration.

- Once satisfied, click on “Connect” or “Update”, scroll down to “Documentation”, review and accept the "Scopes" update if available, and then navigate to “Configuration”.

![Integrations > Configure Workday view](/public/docs/screenshot/2024-01-08-integrations-configuration.png)

Repeat the steps above for all the integrations that you would like to include in your DSR Workflows. Once you have all of your integrations configured to your liking, you can start configuring your Data Subjects, Data Actions, Preflight steps, and any additional settings. For more information on integrating with your SaaS tools, visit the documentation [here](/_docs/dsr-automation/connecting-data-silos/saas-tools.mdx).

### Configuring Data Subjects & Data Actions:

- Once you have connected all your desired integrations, navigate to “DSR Automation” > [“Request Settings”](https://app.transcend.io/privacy-requests/settings) where you will see all the data actions, data subjects, and authentication methods for your DSR workflows.
- From here, you can click on any of the pencil icons to edit each element.

![DSR Automation > Edit Data Action > Custom Opt-in View](/public/docs/screenshot/2024-01-08-dsr-edit-action-custom-opt-in.png)

- You can click on the “+” sign next to the “Data Subjects” to add data subjects to be supported.

![DSR Automation > New Data Subject view](/public/docs/screenshot/2024-01-08-dsr-new-data-subject.png)

- Once you are happy with the data subjects and data actions, you can navigate to the “Identifiers” page to configure all the identifiers that need to be supported.

![DSR Automation > Configure Identifiers](/public/docs/screenshot/2024-01-08-dsr-identifiers.png)

- Similarly, you are able to create new, or edit existing, identifiers and preflight steps on this page.

![DSR Automation > New Identifiers](/public/docs/screenshot/2024-01-08-identifiers-add-new.png)

For more information on configuring DSRs, visit the documentation [here](/_docs/dsr-automation/configuring-requests/data-subject-requests.mdx).

### Configuring Integrations:

- Once you have configured all the identifiers, data actions, and data subjects required for your workflow, you will need to activate these elements on the integrations that are part of your workflows.
- To do so, navigate to the integrations that you would like to configure for DSR automation, and click on the “DSR Automation” tab.
- Once there, you will see all your configured identifiers, data subjects, and dependencies. Toggle your identifiers to "on" to make sure that they are processed within that integration, and ensure that the data subject supported reflects your requirements.

![Integrations > DSR Automation > Configure Data Subjects, Identifiers, Dependencies](/public/docs/screenshot/2024-01-09-integrations-dsr-automation-configure.png)

- To ensure that the datapoints within your integrations are ready to process DSRs, navigate to "Manage Datapoints", and scroll to the right
- Make sure that all the desired data actions are toggled to "On", and that "export mode" is configured to your liking for the given datapoints.

![Integrations > Manage Datapoints > Toggle "Erasure" and "Access" On](/public/docs/screenshot/2024-01-08-integration-toggle-data-actions.png)

- When done, make sure to toggle “DSR Automation Live Mode" to "on".

![Integrations > DSR Automation > Toggle Live Mode](/public/docs/screenshot/2024-01-08-integrations-dsr-identifiers-status.png)

### Testing your DSR Workflow

- You have now successfully connected, configured, and activated your first DSR Workflow! At this stage, we recommend testing your workflow by creating a "test" request. To do so, navigate to the "DSR Automation" > ["Incoming Requests"](https://app.transcend.io/privacy-requests/incoming-requests) page, and click on "New Request". To learn more about testing, visit our documentation [here](/_docs/dsr-automation/connecting-data-silos/testing-a-new-data-silo.mdx).

![DSR Automation > Incoming Request view](/public/docs/screenshot/2024-01-08-dsr-incoming-requests.png)

- Make sure to configure the request to trigger the desired workflows, and to configure the request to be a "test" so that it doesn't impact your metrics.

![DSR Automation > New Test Request](/public/docs/screenshot/2024-01-08-dsr-incoming-new-request-test.png)

- Now you can monitor your test request as it moves through the stages and ensure that it is processed to your liking. For more information, you can visit [this](/_docs/dsr-automation/processing-requests/view-status-of-a-request.mdx) documentation page.

## Configuring your Privacy Center

- Finally, to start receiving requests via your [Privacy Center](/_docs/privacy-center/privacy-center.mdx), make sure that you toggle 'Show "Make a Privacy Request" button' and "Show Privacy Center" to "on", under "Privacy Center" > ["General Settings"](https://app.transcend.io/privacy-center/general-settings).

![Privacy Center > Toggle "Show DSR Button" and "Show Privacy Center"](/public/docs/screenshot/2024-01-08-privacy-center-show-dsr-button.png)

- For more information on configuring your Privacy Center, review the documentation [here](/_docs/privacy-center/privacy-center.mdx).

That's it! You are now ready to start receiving and processing Data Subject Requests.


DSR Automation: Quickstart Guide


You can persist your users' consent preferences to the Preference Store, and synchronize consent preferences across devices and apps.

## Authenticate a user's consent

When a user has signed in on your application, your backend will serve a token to your frontend, which allows Transcend's SDK to save this authenticated user's consent preferences.

### Generate a user token on your backend server

The token you'll serve is a [JSON Web Token (JWT)](https://jwt.io/) containing a unique identifier for this user.

The identifier is encrypted on your backend server, placed in a JWT, and signed by your backend server. The encryption and signing keys can be found in [the Admin Dashboard](https://app.transcend.io/consent-manager/developer-settings). More info about these keys can be found [here](#retrieving-your-keys).

The encryption algorithm is [AES-KWP](https://tools.ietf.org/html/rfc5649). The signing algorithm is HMAC-SHA-384.

### Storing and expiring the JWT token

In addition to the user ID, you may include a creation or expiry date to the token's payload (see examples below).
Ultimately this JWT token can be stored locally on the user's device, and we recommend creating a new one for each logged in session.
Note: some libraries (ex. JWT in TypeScript) will automatically insert an issue time (`iat`) to your payload.

#### Here is a sample function, written in TypeScript:

```ts
import * as crypto from 'crypto';
import * as jwt from 'jsonwebtoken';

function createConsentToken(
  userId: string,
  base64EncryptionKey: string,
  base64SigningKey: string,
): string {
  // Read on for where to find these keys
  const signingKey = Buffer.from(base64SigningKey, 'base64');
  const encryptionKey = Buffer.from(base64EncryptionKey, 'base64');

  // NIST's AES-KWP implementation { aes 48 } - see https://tools.ietf.org/html/rfc5649
  const encryptionAlgorithm = 'id-aes256-wrap-pad';
  // Initial Value for AES-KWP integrity check - see https://tools.ietf.org/html/rfc5649#section-3
  const iv = Buffer.from('A65959A6', 'hex');
  // Set up encryption algorithm
  const cipher = crypto.createCipheriv(encryptionAlgorithm, encryptionKey, iv);

  // Set an issued date for the token
  const issued: Date = new Date();

  // Encrypt the userId and base64-encode the result
  const encryptedIdentifier = Buffer.concat([
    cipher.update(userId),
    cipher.final(),
  ]).toString('base64');

  // Create the JWT content - jwt.sign will add a 'iat' (issued at) field to the payload
  // If you wanted to add something manually, consider
  // const issued: Date = new Date();
  // const isoDate = issued.toISOString();
  const jwtPayload = {
    encryptedIdentifier,
  };

  // Create a JSON web token and HMAC it with SHA-384
  const consentToken = jwt.sign(jwtPayload, signingKey, {
    algorithm: 'HS384',
  });

  return consentToken;
}
```

#### Here is the same function in Python:

Notes:

- PyJWT has [namespace conflicts](https://stackoverflow.com/questions/33198428/jwt-module-object-has-no-attribute-encode) with JWT.
- Avoid naming your scripts the same name as a library (for ex `jwt.py`).

**_N.B._** `pip install cryptography pyjwt`

```python
import base64
import jwt
from cryptography.hazmat.primitives.keywrap import aes_key_wrap_with_padding
from datetime import datetime

def create_consent_token(user_id: str, base64_encryption_key: str, base64_signing_key: str) -> str:
    # Read on for where to find these keys
    encryption_key = base64.b64decode(base64_encryption_key)
    signing_key = base64.b64decode(base64_signing_key)

    # encode user_id as bytes
    user_id_bytes = str.encode(user_id)

    # NIST's AES-KWP implementation { aes 48 } - see https://tools.ietf.org/html/rfc5649
    encrypted_identifier = aes_key_wrap_with_padding(encryption_key, user_id_bytes)

    # base64-encode the result
    base64_encrypted_identifier = base64.b64encode(encrypted_identifier)

    # Create the JWT content
    jwt_payload = { 'encryptedIdentifier': base64_encrypted_identifier.decode(),
                    'iat': datetime.now()}

    # Create a JSON web token and HMAC it with SHA-384
    consent_token = jwt.encode(jwt_payload, signing_key, algorithm="HS384")

    return consent_token
```

### Serve the token to the frontend when the user authenticates

Your server will generate the token and return it to the frontend (likely as part of the response payload for the login flow):

```ts
// When a user has authenticated
const consentToken = createConsentToken(
  userId,
  base64EncryptionKey,
  base64SigningKey
);

return {
  status: 200,
  body: {
    user: authenticatedUserData,
    consentToken,
  }
}
```

On the frontend, you will then pass this token to Transcend:

```js
// Authenticate the user to airgap, and sync their consent with Transcend's Preference Store
airgap.sync({ auth: consentToken });
```

### Retrieving your keys

The keys above, `encryptionKey` and `signingKey`, can be retrieved from the Admin Dashboard, under the "Preference Store" section on the [Developer Settings page](https://app.transcend.io/consent-manager/developer-settings).

1. Toggle "on" the Preference Store feature (see screenshot)
2. Click on **View Encryption Key** to see the `encryptionKey` in the code example above. Save the contents somewhere safe!
3. Click on **View JWT Signing Key** to see the `signingKey` in the code example above. Again, please save the contents somewhere safe!

![The toggle which enables syncing with the Preference Store](/public/docs/2023-04-30-managed-consent-database-toggle.png)

### Testing and Debugging Tips

1. Make sure **Reporting Only** mode is off
2. Your domain is included in the **Domains List** (_e.g._ `localhost:3033` if you're using the backend-consent-example)
3. Navigate to [Regional Experiences](https://app.transcend.io/consent-manager/regional-experiences) and make sure that you are in a region with an experience defined. (_e.g._ if you are in New York, set an experience using either the region of New York or the New York time zone (or both) and add a purpose (_e.g._ **Advertising**) to it.)
4. If you haven't already, copy the **HTML Snippet** into the page you want to test this on (using the Test bundle)

## Looking Up User Consent

Now that you've collected the user consent from the web, you may need to look up their consent record as part of executing backend data processes. This can be easily done using our <GlossaryItem term="Sombra" /> API.

[Endpoint reference: Query User Consent](/docs/api-reference/POST/v1/consent-preferences)

#### Looking up a single user's consent preference

Your backend server may need to gate tracking/data-processing logic based on the user consent preferences. An example of how to do so for user with email `foo@example.com`:

```js
const request = require('request');

const result = request.post(
  '{{yourOrganizationSombraURL}}/v1/consent-preferences',
  {
    headers: {
      // use the scope `View Preference Store Admin API`
      authorization: 'Bearer {{apiKey}}',
      // only required for single tenant sombra
      'x-sombra-authorization': 'Bearer {{sombraApiKey}}',
      'content-type': 'application/json',
    },
    body: {
      filterBy: {
        identifiers: 'foo@example.com',
        // grab this value from the Admin Dashboard > Consent > Developer Settings > Partition Key
        partition: 'ee1a0845-694e-4820-9d51-50c7d0a23467',
      },
    },
    json: true,
  },
);

const consentPreference = result.nodes[0];

// May be undefined/empty list if the user has never given consent
if (consentPreference?.purposes?.Advertising) {
  // The user has given consent to Advertising, perform some custom logic...
}

if (consentPreferences?.purposes?.Functional !== false) {
  // The user has NOT explicitly opted out of Functional tracking purpose, perform some custom logic...
}
```

#### Batch-processing user data

A common scenario: your company uploads a list of users to Facebook once a week, and you need to filter this list to exclude users who have opted out of targeted advertising. Here's an example of how you might do so:

```js
const request = require('request');

const { nodes: userConsentPreferences } = request.post(
  '{{yourOrganizationSombraURL}}/v1/consent-preferences',
  {
    headers: {
      // use the scope `View Preference Store Admin API`
      authorization: 'Bearer {{apiKey}}',
      'x-sombra-authorization': 'Bearer {{sombraApiKey}}',
      'content-type': 'application/json',
    },
    body: {
      filterBy: {
        identifiers: userIdentifiers,
        // grab this value from the Admin Dashboard > Consent > Developer Settings > Partition Key
        partition: 'ee1a0845-694e-4820-9d51-50c7d0a23467',
      },
    },
    json: true,
  },
);

const usersToUpload = userIdentifiers.filter((identifier) =>
  userConsentPreferences.find(
    (data) =>
      data.userId === identifier &&
      // This logic makes sure that the user has not explicitly opted out
      // You may also write your own logic here to check for explicit consent (opt-in) as well
      data.purposes?.Advertising !== false &&
      data.purposes?.SaleOfInfo !== false,
  ),
);

// Now you can safely upload `usersToUpload`
```

#### Paginating over all consent changes in a certain date range

There might be the need to query user consent preferences daily to update/trigger certain workflows. Here's an example on how to query daily user consent preferences with pagination:

```js
const request = require('request');

async function paginateThroughConsentPreferences() {
  let currentLastKey = undefined;
  const data = [];

  while (true) {
    const { nodes, lastKey } = await request.post(
      '{{yourOrganizationSombraURL}}/v1/consent-preferences',
      {
        headers: {
          // use the scope `View Preference Store Admin API`
          authorization: 'Bearer {{apiKey}}',
          'x-sombra-authorization': 'Bearer {{sombraApiKey}}',
          'content-type': 'application/json',
        },
        body: {
          filterBy: {
            // grab this value from the Admin Dashboard > Consent > Developer Settings > Partition Key
            partition: 'ee1a0845-694e-4820-9d51-50c7d0a23467',
            // updatedBefore and updatedAfter filters are set to retrieve consent records that were synced in the last 24 hours
            updatedBefore: new Date().toISOString(),
            updatedAfter: (new Date() - 1 * 24 * 60 * 60 * 1000).toISOString(),
            // using lastKey to paginate if it exists (will not for first iteration)
            startKey: currentLastKey || undefined,
          },
        },
        json: true,
      },
    );

    if (!nodes || nodes.length === 0) {
      break;
    }

    // Process the data received from the API call
    // For example, push the new data into an array
    data.push(...nodes);

    // Extract the lastKey from the API response
    currentLastKey = lastKey;

    // If there is no lastKey, it means we have reached the end of the data
    if (!currentLastKey) {
      break;
    }
  }

  return data;
}
// Call the function to start paginating through the API data
const consentPreferences = await paginateThroughConsentPreferences();

// Now you can loop through user preferences and use the data to trigger any internal processes!
```


Storing Consent Preferences


## What is my organization's Privacy Center?

The **Privacy Center** is the front-facing portal that connects your users to their data rights. Despite being built and wired-up by Transcend, the Privacy Center is designed to seamlessly integrate into the look and feel of your company's existing website, and is typically even hosted directly at `privacy.your-company.com`.

![A screenshot of The Athletic's Privacy Center](/public/docs/2022-06-27-privacy-center.png)

### Help users understand your company's policies

Once configured on your end, your companies data practices will be organized into an easy-to-understand format for your users. A side-menu navigation pane makes it easy for data subjects to explore your company's data practices and policies without being overwhelmed. It serves as a visualization of the data your company collects, how that data is used, and with whom it is shared.

### Provide an intuitive UI for submitting DSRs

Through the "Make a Privacy Request" tab, data subjects are able to submit the types of DSRs your organization supports through an intuitive interface.

![A screenshot of making a DSR on The Athletic's Privacy Center](/public/docs/2022-06-27-make-privacy-request.png)

## Set up your company's Privacy Center

Your company's Privacy Center can be configured from the [Privacy Center tab →](https://app.transcend.io/privacy-requests/privacy-center) of the same Admin Dashboard interface that your company uses to view and manage requests (see [Review and Approval](/_docs/dsr-automation/processing-requests/review-and-approval.mdx)). The steps for updating and deploying your company's custom Privacy Center can be broken into three steps:

### 1. Specify how your company interacts with customer data

The structure of your company's data is determined by [the Integrations](/_docs/dsr-automation/quickstart.mdx) and can be updated directly from the Admin Dashboard. This structure determines everything from how the side menu of your Privacy Center looks to how the bundle of data in a Data Subject Access Request presents itself. Since data regulations treat data differently based on how its collected and used, configuring your Integrations correctly is about more than the aesthetics.

The "Data Practices" tab on the left side menu has three panels that allow you to add Data Collections to your Integrations.

![Configuring your Privacy Center in Transcend's Admin Dashboard](/public/docs/screenshot/2023-11-30-privacy-center-data-practices.png)

On creation, Data Collections should be given a method based on how such data was collected by your company.

| Data Collection Method  | Description                                                                                |
| ----------------------- | ------------------------------------------------------------------------------------------ |
| `Info we track`         | Information that your company tracks about your users (e.g., analytics data from cookies). |
| `Info you give us`      | Information that your customers give you (e.g., information from forms they fill out).     |
| `Info shared by others` | Information that other vendors have shared with your company about your customers.         |

#### Disabling the Data Practices UI

If for some reason you wish to remove this interface, you can do so on the [General Settings](https://app.transcend.io/privacy-requests/privacy-center#GeneralSettings) section of the Privacy Center settings. Simply toggle on the setting "Hide data practices page"

![Hide Data Practices in your Privacy Center configuration](/public/docs/d606611-Screen_Shot_2021-09-16_at_8.59.51_AM.png)

### 2. Use the UI to customize your branding and messaging

The bottom three panes on the Admin Dashboard's Privacy Center configuration let you customize your Privacy Center's look and feel.

![Customize your Privacy Center design and branding](/public/docs/screenshot/2023-11-30-privacy-center-colors-styles.png)

#### UI Diagrams

**Web**

![A labeled diagram of the Privacy Center interface on a web browser](/public/docs/privacy-center-web-labeled.png)

**Mobile**

![A labeled diagram of the Privacy Center interface on a mobile device](/public/docs/privacy-center-mobile-labeled.png)

#### Assets (Media)

| Asset name                  | What it controls                                                                                      | Recommendations                                                                                                                | File type extension                                                                         | Location in diagram |
| --------------------------- | ----------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------- | ------------------- |
| `Logo`                      | Your company logo, shown on the header nav bar in mobile views                                        | Not white (header bar is white)                                                                                                | `.png` (`.svg` will render on the website, but not on certain communications such as Gmail) | **A1**              |
| `Favicon`                   | The shortcut icon to display on browser tabs                                                          | 1:1 aspect ratio                                                                                                               | `.png`, `.svg`, `.ico`                                                                      | N/A                 |
| `Logo on Side Menu`         | Your company logo, rendered atop your primary color or side menu background color, defaults to `Logo` | Different colored version of your logo as needed (i.e., black or white)                                                        | `.png`, `.svg`                                                                              | **A2**              |
| `Hero Image`                | The main image displayed on the hero banner                                                           | 3:2 aspect ratio, transparent background if you want the `Hero background` color to show through to prevent hard edge cut-offs | `.png`, `.svg`                                                                              | **A3**              |
| `Sidebar Widget Background` | The optional background image for the desktop view's sidebar widget                                   | Image height between approximately 400-600px in portrait orientation to allow ample space for text and button content          | `.png`, `.svg`                                                                              | **A4**              |

#### Colors

| Color name                          | What it controls                                                                                                               | Location in diagram |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | ------------------- |
| `Primary`                           | The primary or main brand color, used ubiquitously to color miscellaneous components, i.e., primary backgrounds, buttons, etc. | **C1**              |
| `Text on Primary`                   | The text color that is on top of the `Primary` color                                                                           | **C2**              |
| `Secondary`                         | The secondary brand color, used for components such as secondary buttons, etc.                                                 | **C3**              |
| `Text on about Transcend widget`    | The text color that is on top of the Transcend widget in the side menu                                                         | **C4**              |
| `Main paragraph text`               | The text color of the paragraphs in your policy                                                                                | **C5**              |
| `Lighten text`                      | The color for lighter text subtitles                                                                                           | N/A                 |
| `Background accent`                 | An light background accent color that lies behind the page's main content                                                      | **C6**              |
| `Error`                             | The color for error messages                                                                                                   | N/A                 |
| `Side menu background`              | The background color of side menu, defaults to `Primary`                                                                       | **C7**              |
| `Text on side menu`                 | The text color on the side menu, defaults to `Text on Primary`                                                                 | **C8**              |
| `Hero background`                   | The background color of the hero banner, defaults to `Primary`                                                                 | **C9**              |
| `Text on hero`                      | The text color on the hero banner, defaults to `Text on Primary`                                                               | **C10**             |
| `About Transcend Widget background` | The background color of the Transcend widget in the side menu, defaults to `Secondary`                                         | **C11**             |
| `Highlighted text`                  | The color of text highlighting on the webpage, defaults to a lighter variant of `Primary`                                      | N/A                 |

#### Text Descriptions

| Description Name   | What it controls                                                                                         | Location in diagram |
| ------------------ | -------------------------------------------------------------------------------------------------------- | ------------------- |
| `Hero title`       | The main title message on your hero banner, used as an introductory call out message                     | **T1**              |
| `Hero description` | Some description text in the hero that appears underneath the title                                      | **T2**              |
| `Meta title`       | The meta HTML title that displays on your web browser tab, used by search engines for indexing purposes. | N/A                 |
| `Meta description` | The meta HTML description, used by search engines for indexing purposes.                                 | N/A                 |

#### Custom CSS

You may also customize the look and feel of your Privacy Center using CSS. This includes applying custom CSS to your headers, buttons, body text, and hero image. These changes can be made under the Custom CSS Styles section of the Privacy Center → [Colors & Styles](https://app.transcend.io/privacy-center/colors-and-styles) page.

### 3. Launch the Privacy Center on your own domain

When you first start with Transcend, your Privacy Center will be initially hosted at a Transcend-owned subdomain `your-company.trsnd.co`. While here, this Privacy Center looks and acts exactly as it would once you launch it on your own domain, so you can customize and test the page to your liking.

When you are satisfied with the changes made to your Privacy Center, you can launch it on your own domain at `privacy.your-company.com` via the Admin Dashboard. To do so, visit the "General Settings" tab on the left side menu and click on the dropdown arrow next to "Privacy Center URL". Setting up the Privacy Center on your domain requires updating some DNS records in your DNS database, the instructions for which will be displayed when you expand the "Privacy Center URL" section.

![Configuring the URL on your Privacy Center](/public/docs/screenshot/2023-11-30-privacy-center-general-settings.png)

There are 3 steps to fully launching the Privacy Center on your domain:

#### 1. Request certificate

In order for Transcend to host the Privacy Center on your domain, a certificate must first be requested that can authenticate the domain name `privacy.your-company.com` and demonstrate that communication with the page is secure.

#### 2. Validate DNS

The certificate in the previous step must then be validated, and traffic from your page `privacy.your-company.com` must be routed to the Privacy Center. To do so, the "Privacy Center URL" section will display a couple DNS records that must be added to your DNS database. Your DNS provider will propagate the record changes, which may take some time.

#### 3. Launch Privacy Center

When the certificate has been successfully validated and your domain `privacy.your-company.com` correctly routes traffic to the new Privacy Center, click "Launch" to launch the Privacy Center at its new location!

### 4. (Optional) Configure Email Settings for the Privacy Center

You can configure the email addresses, email aliases, and even the domains from which we send Privacy Center emails.

This diagram is labelled with the fields as configurable in the Email Settings:

![Email sections view](/public/docs/custom-email-components.png)

| Location in diagram | Field name   | What it controls                                                                                                                                                           |
| ------------------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1                   | Email alias  | The sender name visible in email clients                                                                                                                                   |
| 2                   | Email prefix | The local portion of the email address, prefixes the unique ID used for reliably tracing email replies. This is only configurable when custom Email Domains are configured |
| 3                   | Reply to     | The email address that will be used when the end-user replies to this email                                                                                                |
| 4                   | Email domain | The domain from which the email is sent                                                                                                                                    |

These fields are configurable in two ways:

#### Global Configuration

This configuration is static across all requests, and is split between two pages: [Email Settings](https://app.transcend.io/privacy-center/email-settings) and [Email Domains](https://app.transcend.io/infrastructure/email-domains).

![Email Settings UI](/public/docs/screenshot/2023-12-14-dsr-email-settings-general.png)

![Email Domains UI](/public/docs/screenshot/2023-12-14-dev-tools-email-domains.png)

#### Conditional Configuration

Based on the attributes present on each request, use the closest matching conditional email address configuration when sending Privacy Center emails.

There is also an additional field for conditional configurations: Email body display name. This field populates a special template variable which can be used in Email Templates as `{{ prettySenderName }}`. This is most often used when conditionally configuring emails to be sent from teams within your organization.

Conditional configurations take priority over the Global configuration when any attributes match. If multiple attributes match a request, then the configuration with the highest number of matching attributes is used, otherwise the lower priority is used, otherwise the first one alphabetically by internal name is used.

![Conditional configuration UI](/public/docs/screenshot/2023-12-14-dsr-email-settings-genera-conditional-email-address.png)

### 5. Finalize Your Changes

When you have completed your initial configuration and are ready for them to be viewed by your end users, set your changes live by [reviewing & publishing your updates](/_docs/privacy-center/saving-and-publishing-to-the-privacy-center.mdx).


Configuring the Privacy Center


## Overview

The Privacy Preference Center empowers users to control their preferences, including consent and marketing choices. It also provides an option for unauthenticated/anonymous users to opt-out of "Do Not Sell My Personal Information" (DNSMPI) to comply with CPRA.

## Prerequisites

Before you start, make sure you have the following prerequisites in place:

- Enable Preference Store.
  - If you are self-hosting Sombra, please refer to the [Preference Store documentation](/_docs/preference-store/index.mdx) for a detailed guide.
  - If you are using Transcend-hosted Sombra, refer to the [following section](/_docs/preference-store/storing-consent-preferences.mdx#retrieving-your-keys) to enable this feature.
- Your [consent manager's](https://app.transcend.io/consent-manager/developer-settings) allowed domains list must include your Privacy Center domain. This is already true if your Privacy Center is on a subdomain of your primary domain (e.g. `privacy.your-site.example`)

## Setup Guide

### Do Not Sell My Personal Information (DNSMPI)

#### Self-Hosted Sombra

If you're self-hosting Sombra, ensure that your instances are updated to version `v7.197.0` or higher. Additionally, configure the environment variable `ALLOW_UNAUTHENTICATED_PREFERENCE_UPDATES` to `true`. This setting will enable anonymous users to opt-out of sale of personal infromation.

#### Multi-Tenant Sombra

If you are using Transcend-hosted Sombra, you can enable this configuration on [Preference Store settings](https://app.transcend.io/preference-store/settings).

![Preference Store > Settings > Preference Store Authentication](/public/docs/2024-06-27-preference-store-authentication-setting.png)

#### Update Privacy Center configuration and publish

To enable the Privacy Preference center, update the Privacy Center configuration to include `Show Manage your privacy` tab, under `Privacy Center > General Settings` on the Admin Dashboard. Once you've updated the configuration, publish the changes to make them live.

![Privacy Center > General Settings > Manage your privacy](/public/docs/2024-06-27-show-manage-your-privacy-tab.png)

Once these steps are completed, users will see the `Manage your privacy` tab on the Privacy Center. This tab will allow users to opt-out of sale of personal information. Once a user opts out, their preference will be stored in the Preference Store and a DSR will be triggered.

![Privacy Center > Manage your privacy](/public/docs/2024-06-28-privacy-center-manage-your-privacy.png)

### Consent and Marketing Preferences

In addition to DNSMPI, authenticated users can manage their consent and marketing choices on the Privacy Center. To enable this feature, update the Privacy Center configuration to include `Show Privacy Preferences`, under `Privacy Center > General Settings` on the Admin Dashboard.

![Privacy Center > General Settings > Show Privacy Preferences](/public/docs/2024-06-27-show-privacy-preferences.png)

> #### Note
>
> If a user is not logged-in, the consent and marketing preferences will not be stored in the Preference Store and thus will not trigger a DSR. However, the user's preferences will be stored on the browser's local storage or through Transcend [XDI sync](/_docs/consent-management/reference/xdi.mdx).

![Privacy Center > Manage your privacy > Privacy Preferences](/public/docs/2024-06-28-privacy-center-user-preferences.png)


Privacy Preference Center


## Viewing Newly Discovered Silos

As data silos are discovered by your various connected plugins, you’ll be prompted to review them in the Silo Discovery. In the sidebar of Transcend’s Admin Dashboard, click on “**Silo Discovery**”.

When you open Silo Discovery, newly-discovered data silos will be accessible for review:

![A list of data silos discovered](/public/docs/screenshot/2023-09-13-data-silo-disco-triage.png)

Furthermore, when you have newly-discovered data silos, this button will appear on the Data Silos tab of the Data Inventory.

![27 data silos found by Silo Discovery](/public/docs/165181843-1becfc4f-7875-47f0-815f-17baf96322f0.png)

## Approving or Rejecting Discoveries

You can approve discovered data silos in bulk by selecting them with the checkboxes on the left, or individually by hovering over the rows. Marking them as approved will send them to Data Inventory to be configured, marking them as Junk will send them to the Junk tab. You can always retrieve them from Junk at a later time if you mark a data silo as such by mistake. If you see a data silo that is a duplicate of something that already exists in Data Inventory, you can mark it as a duplicate.

![Options to approve or mark silos as junk.](/public/docs/165182034-b7b31cb8-c306-41c0-8206-86ad9e0f323c.png)


Review Silo Discovery Results


## Confirming Classifications

Transcend leverages machine learning techniques to quickly determine exactly where each and every personal datapoint lives within your individual data silo. With Structured Discovery, Transcend eliminates the need to derive queries for an internal database and maintain them through inevitable database schema changes. To learn more about the different classification methods, check out our [**Developing Classifications**](/_docs/structured-discovery/developing-classifications.mdx) article.

Confirming and correcting guesses in the train tab provides us with data to help tune the next version of our classifier. If you notice many incorrect guesses, please reach out to your Transcned account team to discuss.

_Note: If you would like to try the newest classifier leveraging a Large Language Model (LLM), please check with your Transcend account manager._

### Classification Training

From Structured Discovery, navigate to a specific data silo, then click on the “Train” tab. Answer our prompted question, Is the **NAME** datapoint a **CATEGORY|SUBCATEGORY**?” by either:

- Confirming by clicking on the button "Confirm Category" or pressing **c** on the keyboard.
- Selecting a different category from the dropdown, and then confirming it
- Skipping the category by clicking on the button "Skip Category" or pressing **s** on the keyboard.

![Train Transcend on classifying your personal data through a series of questions](/public/docs/screenshot/2024-04-16-train.png)

As you answer these questions, Transcend will improve our classifier for the various data categories in your data silos.

You can also confirm classifications in bulk for data points with the same name as the one presented. You can see all instances of datapoints with the same name by clicking on the “View all instances of 'name'” button, which will open a new tab with all instances of datapoints with the same name. You can then confirm the category for all instances of the datapoint by clicking on the “Bulk Confirm” button.


Confirming / Training Classifications


## Running your first scan

1. Visit the [Web Auditor -> Runs](https://app.transcend.io/auditor) section on the Admin Dashboard.

2. Click "Run Web Auditor".

   ![Web Auditor page showing a blank state](/public/docs/screenshot/2024-03-12-web-auditor-blank.png)

3. Input your URL to scan.

4. Click "Run". You can use the default Browser Automation steps.

   ![Web Auditor run configuration](/public/docs/screenshot/2024-03-12-web-auditor-run-configuration.png)

5. Click "View Results".

The scan should be finished in less than a minute, and then you can see the scan results. Once the scan is complete, head over to the "Findings" tab to view any potential compliance issues:

![Web Auditor scan findings](/public/docs/screenshot/2024-03-12-web-auditor-findings.png)

Here, you'll see an overview of findings—potential compliance problems—together with their severity level. You can drill down into the network requests or cookies that caused a finding by clicking the "View Requests" or "View Cookies" button on the finding. You can also use the "Network Requests" and "Cookies" tabs to inspect the full set of data processing activities encountered on your website.

### Download a PDF summary of findings

To share the scan results, you can download a PDF of the findings in your report.

![Summary report PDF](/public/docs/2024-03-12-web-auditor-report-pdf.png)

To download the summary report, click "Download" on the Runs page.

![Download report button](/public/docs/2024-03-12-web-auditor-download-button.png)

## Schedule a recurring scan

Now that you've run your first scan, you can schedule a recurring scan. Simply visit the "Schedules" page, click "New Schedule", and set up your scan settings and the scan frequency.

## Scan Errors

If a scan failed, the "Summary" tab will show an error message detailing the error.

Depending on the error, you may need to:

- Modify the Browser Automation steps to suit your website.
- [Allow us to scan](/_docs/web-auditor/allowlisting.mdx) your website if you're using bot protection technology.
- Re-run the scan.


Use Case Guides