You already have a policy tool. You do not have a live processor list.
OneTrust-class platforms are good at policy, cookies, and RoPA documentation. DSAR execution still dies when the processor list is last year's. The clock starts. The team rebuilds vendors from memory and from the DPAs they already like. Shadow martech never entered RoPA because there was no PO. That is the gap we sell into. It is not a rip-and-replace speech.
Keep OneTrust (or whoever you use) for the legal-ops surface. Add ScopeMantle when you want Article 15 outreach to start from grants that exist this morning. Pair with counsel. We dispatch and track. Lawyers approve language. Templates in the DSAR playbook are operator-reviewed, not lawyer-reviewed. Not legal advice.
Where RoPA diverges from the IdP
RoPA is a document. OAuth is a live permission. They drift on different clocks. A quarterly diff is the minimum I would sign. Daily sync is what the product does. If you only open OneTrust when a subject emails, you will spend day 1 to day 4 on discovery and call it "complexity." It is a stale join key.
OAuth will not list every processor. Warehouse keys, mail-forwarding rules, and vendors that never touched Google or Okta stay in RoPA. Write that limitation on the case. Do not delete RoPA and declare victory.
What the DSAR module actually does
- Case open after your identity-verification process (you own KYC).
- Snapshot of grant inventory. Hash. Attach.
- Pre-fill vendor rows from that snapshot. Tier by scopes.
- Operator templates for Articles 15, 17, and 20. Counsel edits. Then send.
- Track replies. Day 7 / 21 / 28 reminders.
- Erasure: revoke the grant in governance, not only a deletion letter.
Processor correspondence only. Controller systems (your own apps) need an internal runbook. We do not pretend to crawl your monolith.
When OneTrust still wins the room
Enterprise policy management. DPIA workflows. Cookie consent. Cross-border assessment libraries. If those are live and loved, do not migrate them for sport. Export our CSV into their vendor object if that is how your team thinks. Integration via file is honest. We will not claim a GA OneTrust API that is not on integrations.
India, UK, US state laws
Clocks and legal bases change. Counsel swaps the header. The inventory procedure does not. See DPDPA for the India operator checklist. We do not certify DPDPA. We do not attested HIPAA. No BAA.
Pricing and trial
$5 per employee per month annual, $6 monthly, no seat min, custom 500+, 30-day trial. OneTrust pricing is theirs. Check it. TCO is not "replace the suite." TCO is hours not spent rebuilding the vendor tab while the subject waits.
What to tell procurement
"We are not ripping OneTrust. We are attaching a live OAuth-sourced processor list and a send/track loop. Templates are operator-reviewed. Entra is Beta. Here is a closed-case rebuild that missed N vendors on RoPA alone." Bring the N. Do not bring a vibe.
What to do this week
- Rebuild one closed DSAR from a fresh Google/Okta export. Count RoPA misses.
- Read the inventory template and freeze the columns.
- Put a counsel gate in front of send, even if you trial us.
- If you are an MSP, read white-label before you promise a portal.
A closed-case rebuild (do this before you buy anything)
- Pick a DSAR you closed last quarter. Note the vendor list you actually emailed.
- Export today's Google and Okta grants. Filter to mail, Drive, calendar, directory.
- Highlight rows that were not on the original list and that could hold that subject's data.
- Count them. Write the number on a slide titled "RoPA miss rate, n=1." Ugly. Honest.
- Estimate hours spent rebuilding the list during that case. That is the TCO input, not a vendor's ROI PDF.
If n=1 feels thin, do three cases. If the miss rate is zero, you may not need us yet. I would still ask how you will keep it zero when marketing installs next week.
Who should own which system
| Work | Keep in OneTrust-class tool | Do in ScopeMantle |
|---|---|---|
| RoPA / ROPA narrative | Yes | Diff source only |
| DPIA / LIA | Yes | Trigger when scopes contradict consent |
| Cookie banner | Yes | No |
| Live OAuth vendor list | Attachment | System of record |
| Vendor email send/track | If you already love it | Yes, on that list |
| Grant revoke | No | Yes (Google/Okta) |
Failure modes when people try to "replace OneTrust"
- Deleting RoPA because the CSV felt modern.
- Sending Article 20 to every OAuth client.
- Skipping counsel because the template looked official.
- Promising an API integration that is not on the integrations page.
- Treating cookie consent as proof that mail-scope grants are fine.
Children's data and special-category requests still need counsel filters. We will not add a magic toggle. HIPAA: not attested. Entra: Beta. $5 / $6, no seat min, custom 500+.
Migration without a big-bang
Month 1: keep OneTrust as the case UI if people refuse to move. Attach our snapshot to each new case by hand. Month 2: send vendor mail from ScopeMantle for Tier 1 only. Month 3: decide whether the OneTrust DSAR module is still earning its seats. Cookie and DPIA stay put. Nobody gets a medal for a messy rip-and-replace.
If OneTrust is also your RoPA, schedule the quarterly diff as a ticket with two owners (privacy plus security). When the diff is empty two quarters in a row, either you are clean or nobody is installing software. Check which. Marketing usually answers that question.
What to tell a OneTrust admin who feels attacked
You are not being replaced. The IdP knows about processors your RoPA never met. We are joining those lists. Your DPIA workflow is still the place legal work happens. Our templates are operator-reviewed starting points. If that still feels like a turf war, run the closed-case rebuild together and argue about the number, not the brand.
Field guide: a 60-minute working session with privacy and GRC
Minutes 0 to 10: pick one closed case. Minutes 10 to 25: export Google and Okta now. Minutes 25 to 40: highlight misses. Minutes 40 to 50: decide which system owns send for the next case. Minutes 50 to 60: write the quarterly RoPA diff ticket with two owners. Leave with a number and a ticket. Leave without a brand argument.
If privacy refuses to export IdP grants because "that is security's data," you have an access problem, not a tool problem. Fix access. ScopeMantle will not mediate your politics. It will snapshot whatever connectors you connect.
What stays in the policy suite forever
Cookie banners. DPIA records. Policy attestations. Transfer assessments. Those are not our product. People who try to move them into an OAuth tool will make a mess and then blame the OAuth tool. Keep the suite. Attach our CSV. If a salesperson on our side implies a rip-and-replace, send them this paragraph.
API honesty
CSV today. A deeper OneTrust API is not claimed as GA on integrations. If we ship one, it will be labelled. Until then, a predictable filename and a hash beat a vapor integration in a slide.
Templates operator-reviewed. Counsel adapts. Entra Beta. HIPAA not attested. $5 / $6, no seat min, custom 500+, trial. Companion: inventory template.
Mistakes I keep seeing after the first workshop
People export once and call it culture. People revoke by display name after a rebrand. People promise Entra completeness. People put OAuth rows in the user-access matrix. People send DSAR mail without a case ID. People treat a CASB invoice as grant inventory. People change a score threshold the night before audit. People staff an MSSP sprint with someone who cannot read a scope string. Each of those has a fix already on this page. The failure is skipping the fix because the demo looked polished.
Write the one thing you will not skip this week. Put it on a calendar. If you want the inventory to stay current, the 30-day trial is the productized version of the export. Five dollars per employee per month billed annually, or six dollars monthly. No seat minimum. Custom terms at 500+ employees. Microsoft Entra stays labelled Beta. HIPAA is not attested. Templates stay operator-reviewed. No fabricated customer counts on the customers page.
If you are evaluating us next to a GRC tool, keep both jobs honest. If you are evaluating us next to a consent-intercept tool, stack prevention and inventory. If you are an MSP, register the deal before the demo and keep the counsel gate in the SOW. If you are writing a board slide, use last quarter as the only benchmark we will stand behind. That is enough program for a quarter. The next quarter is whether the leftover-grant count actually moved.
A note for the privacy program manager
Your RoPA is not the enemy. Stale joins are the enemy. Keep the policy suite. Attach a live list. Run the closed-case rebuild before you buy anything, including us. If the miss count is zero and stays zero after a marketing install week, you may not need a new tool. If the miss count is ugly, you need a list that refreshes. That is the whole argument. Templates remain operator-reviewed. Counsel remains the send authority.
What you can do without buying anything
Export the IdP list. Deduplicate on client ID. Revoke three rows you cannot explain. Write the CC9.2 versus CC6.7 sentence for your auditor. Add OAuth grants equals zero to offboarding. Put an extension allow-list in one OU. Schedule a Friday tabletop with a fictional client ID. Hash a file and put it in GRC. Those steps do not require ScopeMantle. They do require a calendar and a human who will not skip them.
When those steps start to rot (and they will, usually by week six), the productized version is daily Google and Okta sync, scores, attestation expiry, bulk revoke, and DSAR snapshot on the same inventory. Price is public. Beta labels stay on the page. We will not invent a case study to make the last paragraph feel finished. Start the trial if the calendar is already losing.
Schedule the quarterly RoPA diff with two owners before you leave the sixty-minute session. An empty diff two quarters in a row means you are clean or nobody is installing software. Check which. Marketing usually knows.
Related reading stays on the internal paths already linked above: platform, integrations, demo, and the companion resources or blog posts for this topic. Use those links when you brief a colleague so they get the same product truth: public $5 / $6 pricing, no seat minimum, custom at 500+, Entra labelled Beta, DSAR templates operator-reviewed, no HIPAA attestation, no invented logos. That is the briefing. Everything else is the procedure you can run this week.