Capability
The support tickets you stop receiving.
Your customers manage their own preferences, addresses, sign-in methods and devices, and exercise their own data rights, at a per-tenant URL wearing your brand. Export, consent history and erasure are self-service — which is also what makes the statutory one-month deadline a non-event.
Six panels, no ticket.
Preferences
Every purpose and channel shown and changed independently — accept service updates by email while declining marketing by SMS, in one screen. A confirmation email follows every change, with guidance to contact you at once if it was not them.
Addresses
Typeahead lookup with a manual fallback for anything the provider cannot find. A manual entry is valid; it simply is not marked verified.
Shared notes
Only notes you have explicitly marked as shared appear here. Internal working notes are not shown live — though they can still be requested as part of a formal data request, and are reviewed with disclosure as the default.
Sign-in methods
Every current method listed, with a link-then-remove flow for changing email provider. Nobody can remove their last method, so self-lockout is structurally impossible.
Devices & sessions
Every signed-in device with its last-used time, and a remote sign-out per device. Changing a password signs out every other active session.
Appearance
A choice of themes including several designed for accessibility — larger text, higher contrast, colour-blind-safe palettes, reduced clutter, dyslexia-friendly. The choice persists across sign-ins.
Three buttons that answer most of a DSAR.
Download my data returns a machine-readable file containing everything held, excluding credential material. See my consent history shows when each permission was given or withdrawn and by what mechanism. Delete my data removes the record from your organisation only — other organisations using the same portal are unaffected.
Consent history deliberately survives deletion. It is your evidence of lawful processing, it contains no name or contact detail, and Article 17(3) permits keeping it. That should be stated in your privacy notice rather than discovered later, which is why the portal says it plainly to the person too.
- Sign-in is uniform whatever the role or tenancy — no separate login screen per audience
- The portal renders timestamps in the reader's own device time zone
- Portal traffic is refused immediately if a tenancy is suspended — one lever, no data touched, reversible
- A trusted handoff from your own site drops an already-authenticated user straight in with no second login
Questions about the portal
Does it look like our site?
It looks like whatever you tell it to. Every label is renameable, you set the logo and font, and you choose the default theme and the allow-list your customers pick from. There is no 'powered by' anywhere on it.
What if somebody erases themselves by mistake?
Erasure is deliberate and confirmed, and it is scoped to your tenancy — their record with any other organisation is untouched. The consent history remains as evidence of what was agreed while the record existed, and the erasure itself leaves a tombstone with a timestamp, so what happened is never in doubt.
Can a customer be in more than one tenancy?
Yes, and that is the point of the model. The same person can be registered with several organisations using the same portal, and each organisation sees only its own relationship with them. Erasing from one leaves the others intact; the underlying record is deleted only when the last tenant erases.
Do we still need a support process for data requests?
Yes, for requests that arrive by other routes and for identity verification, which is yours as controller and cannot be delegated to us. What changes is volume: the common requests are answered by the person themselves, immediately, which is also how the statutory deadline stops being a scheduling problem.
Related capabilities
A demonstration portal in your own brand takes very little setting up, and it is the surface your customers will actually judge.