Subject Identity Verification

When you receive a privacy request, you are responsible for confirming the identity of the subject to ensure that you do not incorrectly disclose data. To verify an identity, ask only for what you need, and use information you already hold about the data subject where you can. When your process does need a document, such as an authorized agent's signed permission or a completed form, collect it with a document request instead of email.

Ethyca recommends using multi-factor authentication (MFA) for identify verification and Astralis offers built-in subject identity verifiation via MFA.

To ask for documents once a data subject has verified their identity, set the request type's document request to go out After identity is verified. See Collect documents.

Configuring Subject Identity Verification

To enable Subject Identity Verification, you need to:

1. Configure a messaging service
2. Configure Astralis to use this service for Subject Identity Verification

You may also customize the content of the email that is sent for this purpose. See our guide for configuring email templates to learn more.

Configure a messaging service

The available messaging services for Subject Identity Verification are:

• Configuring AWS SES for Email
• Mailgun for email
• Twilio for email
• Twilio for SMS

Click on the service you want to configure above to view the setup guide.

Configure Astralis

Astralis needs to be configured to enable Subject Identity Verification and to use the correct messaging service for this purpose. This can be configured using environment variables or the Astralis configuration file.

Using the Astralis configuration file

To set this in the Astralis Configuration file, please locate the variable within the appropriate fides.toml file. To learn more about where to find this file, please see the Astralis Configuration guide.

The two variables that must be set are:

[execution]
subject_identity_verification_required = true
 
[notifications]
notification_service_type = "mailgun"

Using environment variables

To configure Subject Identity Verification using Environment variables, please run the following commands from your Astralis environment replacing service with the correct setting for your environment. The options are: mailgun, twilio_text, or twilio_email

EXPORT FIDES__EXECUTION__SUBJECT_IDENTITY_VERIFICATION_REQUIRED = true
EXPORT FIDES__NOTIFICATIONS__NOTIFICATION_SERVICE_TYPE = "mailgun"

Verify consent requests

Consent requests decide whether to verify identity with their own setting, disable_consent_identity_verification. This covers consent preferences that data subjects manage in the Privacy Center and privacy requests submitted under a consent-only policy.

When disable_consent_identity_verification is set, it alone decides. When it isn't set, consent requests follow subject_identity_verification_required.

To verify consent requests while leaving other privacy requests unverified, set disable_consent_identity_verification to false:

[execution]
subject_identity_verification_required = false
disable_consent_identity_verification = false

What happens when a consent request needs a code

1. Astralis always sends the code. With property-specific messaging on, a property without an enabled verification template uses the default verification template.
2. Astralis rejects the request if it can't send the code. If no messaging service is configured, or the configured service has no saved credentials, the consent request fails at submission with an error. The data subject sees the error right away instead of waiting for a code that never arrives.
3. Astralis rejects the request if there's nowhere to send the code. A consent request that includes only a device ID or an external ID fails with a request for an email address or phone number.