## Access and accounts By invitation only. A tenant administrator invites you from Settings > Users with your name, email, role, and brand. You receive an email with a registration link, set your password, and sign in. There is no self sign-up page for the application. If your invitation link no longer works, ask your administrator to use Resend Invite. After you enter your email and password, Neostra shows the Select Organization screen when your account is linked to more than one tenant. Choose the one you want to work in. To change later, open the profile menu and choose Switch Organization. Yes. Any user can turn on two-factor authentication from Profile using an authenticator app; backup codes are issued during setup. A tenant administrator can make it mandatory under Settings > Tenant > Security with the Require two-factor authentication (2FA) switch. When it is on, users without 2FA are asked to set it up at their next sign in, and they cannot disable it themselves. If you belong to several organizations, the policy of the organization you select at sign in applies. After five failed attempts the account is locked for 30 minutes. Failed one time codes and backup codes count toward the same limit. Use Forgot Password if you no longer know your password; a reset link is sent to your email. Your session is refreshed automatically while you work, for up to 24 hours from sign in. After that you sign in again. Closing the browser tab does not sign you out by itself; use Logout in the profile menu on shared computers. Neostra ships with four roles: Super Admin, Admin, Privacy Owner, and Member. Roles bundle permissions such as viewing the request queue, editing workflows, inviting users, or managing tenant settings. Only Super Admins can create API tokens. Your administrator assigns a role and a brand when inviting you and can change them later in Settings > Users. Groups (Settings > Groups) let you organize users for task assignment. ## Modules Through an intake form you publish under Privacy Rights Manager > Intake Forms. Each published form has a public URL and an embed script for your website. The data subject picks a request type, fills in the fields you configured, and verifies their email through a link that is valid for the timeout you set on the form (30 minutes by default). You can also require a signed affidavit and a captcha. Your own systems can submit requests through the [Integration API](/integrations/api). They sign in to the request portal with their email address and request ID, then enter the one time access code sent to their email. In the portal they see their requests, exchange messages with your team, and download files you release once the request is processed. Published workflows contain stages and tasks with assignees. Rules on each workflow decide which incoming requests it handles, based on fields such as request type and brand. Tasks appear under Privacy Rights Manager > Tasks for the assigned users or groups, and the whole request is visible in Request Queue. Task deadlines can be extended from the task page when you need more time. Governance > Scanner runs the DPDP Readiness Assessment, a questionnaire organized into sections. As you answer, Neostra shows an overall risk level, section level risk, critical gaps, and remediation guidance. Separate DPIA (GDPR), DPIA (DPDPA), and RoPA templates are available under Assessments. Neostra scans PostgreSQL, MySQL, MongoDB, Amazon DynamoDB, and Amazon S3. Under Data Inventory > Configuration > Integrations you add an integration with its credentials, limit what is scanned on the Scope tab with inclusion and exclusion rules, run a scan, and review findings under Scan History. The Schedule tab runs scans automatically at a daily, weekly, or monthly frequency at a time of day and timezone you choose, and you can pause and resume a schedule. Systems you do not scan can still be recorded in the inventory to document where data lives and how it flows. When you log an incident and select the regulations that apply, Neostra calculates a notification deadline for each one from the time the incident was created plus that regulation's notification window. The windows come from Settings > Regulations, where GDPR, UK GDPR, DPDP, CCPA/CPRA, and most others are seeded at 72 hours and PIPA (South Korea) at 24 hours. You can change any value. See [Regulations](/regulations). ## Consent modal Open Consent Management > Collection Points, select your collection point, publish it, and open the Integration tab. Copy the Banner script tag and place it in the head of every page. The tag carries your collection point ID and a link to the script. Do not retype the snippet; copy it from the Integration tab so the script address and integrity value are correct. If you configured a preference center, the same tab gives you its URL to link from your footer so visitors can change their choices later. The full guide is at [Cookie Consent Modal](/integrations/cookie-modal). The modal reads the browser's Global Privacy Control signal and records it with the visitor's consent. Regulations in Settings > Regulations carry a flag that says whether GPC applies, which is set for CCPA/CPRA and the other US state laws. Under Consent Management > Consent Records you find Receipts (each consent event with its details) and Data Subjects (consent history grouped by person). The Dashboard shows totals and trends for each collection point. ## Data handling Yes. Every record belongs to one tenant, and users only see the tenant they are signed in to. Within your tenant, brands and roles further limit what each user can see and do. The application interface is available in 54 languages. Under Settings > Tenant you choose the Active Languages for your tenant. Intake forms, banners, privacy centers, and request types each have translation screens so data subjects see your content in their language. Yes. The request queue has an export action for the filtered list of requests. Consent receipts are available under Consent Management > Consent Records > Receipts, and consumer data files can be exported from a request. For system to system access to request status, use the [Integration API](/integrations/api); for push notifications, use [Webhooks](/integrations/webhooks).

FAQ

Access and accounts

Modules

Consent modal

Data handling