Docs

Console: Vault & data requests

Search subjects, view the timeline, export, process DSAR, and embed a self-service portal.

The vault is what turns “we have your consent” into a claim you can back up — searchable per subject, with the exact proof (IP, timestamp, statement version) behind every decision. Support and legal use the same screen for two different jobs: looking something up, and answering a rights request.

Search by identifier (email:…, external_id:…, internal id) in the active environment (the test/live toggle in the top bar). For each subject: identifiers (masked unless ADMIN/DPO), current consent, and the full timeline (consent + preferences + merges) with decrypted IP. Export downloads the full record as JSON. To show people their own history in your product, see Guide: showing a user their own history.

Data requests (DSAR) — admin flow

TypeWhat it does
EXPORTFull history + receipts. Returns a signed, expiring URL.
RECTIFICATIONUpdates the subject’s identifiers (re-encrypts and re-hashes).
ERASURECrypto-shredding: destroys the encryption key for each identifier and nulls IP/UA/URL on the vault rows, keeping the anonymized log. Requires DPO/ADMIN approval before processing. Emits subject.erased.
After an erasure the subject is unfindable by any identifier, but the anonymized ConsentRecords are kept as defensive evidence. See Troubleshooting.

Self-service portal (embed on your product)

Let users submit their own requests from a "Manage my data" button in your product — no support ticket required. Use a pk_ key; the subject authenticates with a one-time token you generate on your server.

// Server — generate a portal token for the signed-in user
const { token } = await tc.createPortalToken('email:' + user.email);

// Client — open the self-service request form
window.location.href = `https://api.croombit.com/v1/data-requests/portal?token=${token}`;

The user picks a request type (export, rectification or erasure), submits it, and your DPO/ADMIN sees it in the console queue. As the request moves through identity verification, dsar.* webhooks fire (see the event table), and completing an erasure emits subject.erased. Approving or completing an export or a rectification does not emit an event of its own.

Data retention

How long superseded history is kept, and when erased subjects get purged for good, is configured per site under Retention & purge — see Retention & purge.

PreviousWebhooks