DataGrail changelog

DataGrail extended IP allowlisting beyond user sign in to API keys, Agents and external MCP clients such as Claude Desktop and Cursor, with a separate set of approved IP ranges for each access path. Enforcement is continuous and every allowlist is off by default until an admin turns it on.

Buyer relevance. Privacy and legal teams connecting AI agents and MCP clients to a system holding data subject request records can now restrict each path to known networks, which limits exposure from a leaked key or token.

DataGrail added automatic high risk detection for data protection impact assessments, which fills Records of Processing Activities forms by identifying AI use, biometric data and targeting of vulnerable individuals. The same release adds custom system naming in the Live Data Map, optional fields in the Privacy Requests API, and version 1.3.0 of the Request Manager Agent with JMESPath support.

Buyer relevance. RoPA upkeep is the compliance task most teams are quietly behind on, because it is tedious rather than difficult. Automatic detection of the categories that trigger an assessment is worth more than the form filling, since missing a trigger is the failure that carries a penalty.