Quickstart
Set up a new Neostra tenant, from first sign in through organisation structure, users, and developer integrations.
This guide walks a new tenant through its initial setup. It is organised by who typically performs each part: every user signs in, a tenant administrator configures the organisation, and a developer or integration owner configures APIs and webhooks.
The modules and menus you see are controlled by your organisation's subscription, and the actions available within them are controlled by your role. If a menu or button described here is missing, check with your tenant administrator.
Signing in
Accept your invitation
Open the registration link in your invitation email, set a password, and sign in with your email address and password.
Select your organisation
If you belong to more than one tenant, the Select Organization screen appears. Choose the organisation to work in. You can switch organisations later from the profile menu.
Set up two-factor authentication
Two-factor authentication can be enabled by any user from their profile, and a tenant administrator can make it mandatory for everyone. If it is required and you have not yet set it up, the 2FA Setup screen appears: scan the QR code with an authenticator app, enter the generated code, and store the backup codes securely. Subsequent sign ins ask for a code from the app or a backup code.
After five failed sign in attempts an account is locked for 30 minutes.
Tenant administrator setup
The following steps are performed by a tenant administrator from the Settings menu. Settings apply to the whole tenant and to every module.
Configure the tenant
Open Settings > Tenant.
- General: set the tenant name and the domains associated with your organisation.
- Branding: upload a rectangular logo and a thumbnail. These appear across the application and on public pages.
- Email Settings: set the sender name, sender email, and email logo used on every email Neostra sends on your behalf, including invitations, request notifications, and verification emails.
- Supported Locales: choose the Active Languages for your tenant. This list applies to all modules and determines which languages you can translate intake forms, banners, privacy notices, and privacy centers into.
- Security: turn on Require two-factor authentication to enforce 2FA for every user. Users without 2FA are asked to set it up on their next sign in and cannot turn it off while the setting is on.
- Data Retention Policy: shows the retention period applied to request and consent records. Retention is managed by Neostra according to your agreement and is shown here for reference.
Invite users and assign roles
Open Settings > Users and click Invite User. Enter the user's first name, last name, and email address, choose a role, and select the brands the user works with. The user receives an invitation email; until they register they appear as pending, and you can resend the invitation.
Neostra provides four roles: Super Admin, Admin, Privacy Owner, and Member. Roles determine which menus and actions a user can access. Assign the least privileged role that lets each person do their job. Use Settings > Groups to organise users into groups for task assignment within workflows.
Create brands, processes, and sub-processes
Open Settings > Brands and click Add New. Enter a brand name and description and upload a rectangular logo and a thumbnail for the brand. Brand branding is used on the public pages and emails associated with that brand, so a tenant with several business units can present each one in its own identity.
Within a brand, add processes and, under each process, sub-processes. Processes describe the business activities that handle personal data and are used to scope assessments, requests, and inventory records.
Define tags
Open Settings > Tags to create the tags your teams will use to label requests, incidents, assessments, and other records. Each tag has a name, a description, and the brand it belongs to. Tags can also be applied automatically by rules in the modules.
Review regulations
Open Settings > Regulations. Neostra ships with a library of privacy laws that other modules use, for example to compute breach notification deadlines. Review the entries relevant to your organisation and add any regulation of your own. See Regulations.
Once these are in place, module owners can configure their own areas: intake forms and workflows in Privacy Rights Manager, collection points in Consent Management, templates in Assessments, and so on. Each module guide begins with its own setup steps.
Developer setup
The following steps are for the person who owns your organisation's integrations. They require familiarity with HTTP APIs and are typically performed by a developer or IT administrator with the Super Admin role, from the Integrations menu.
Set up API configurations for outbound calls
Open Integrations > API Configuration. An API configuration describes an external endpoint that Neostra can call, such as a webhook receiver, a ticketing system, or an internal service. Give it a name and description, set the target URL and operation type, and choose an authentication method: none, API key in a named header, bearer token, or username and password. Credentials are stored encrypted and cannot be read back once saved.
Set the retry behaviour with Max Attempts, Retry Interval, and Retry Timeout. Failed calls are retried according to these values and can be replayed from Integrations > Webhook Delivery Logs.
A configuration is independent of any module. Once created, it can be selected from the rule builders in Privacy Rights Manager, Breach Management, Assessments, and Consent Management, so you can create configurations as the need arises in each module. See Webhooks.
Create API tokens for inbound calls
Open Integrations > API Tokens and click Create Token. An API token lets your own systems call Neostra's Integration API without a user signing in. Give the token a name, select only the scopes it needs, and set an expiry date if your policy requires one. The secret is shown once; store it in your secret manager. Tokens can be revoked at any time from the same page. See Integration API.