Sandbox Management Overview
Customers that meet the minimum net spend threshold are entitled to one sandbox that is included as part of their subscription. Customers below that minimum threshold or those that meet the minimum threshold but need more than one sandbox have the option to purchase. For more information, please contact your OneTrust Account Representative.
Site admins can create a Sandbox account to test system updates that are upcoming in the OneTrust Platform before they are made live across all environments. Sandboxes are clones of your current account that can be created and managed directly by you from Sandbox Management within Global Settings. Every sandbox will be created with a unique Application Sandbox Domain and Data Subject Portal Sandbox Domain that can be linked in external sources. These URLs are separate from the production URLs for your account, allowing you to test changes without affecting any data within your production account.
If your account is on a dedicated cloud environment and you are interested in purchasing the Automated Sandbox Creation feature, your OneTrust Platform will need to be upgraded to 202408.1.0. Please contact OneTrust Support for assistance.
About Sandboxes - What is copied?
When a sandbox is created, the sandbox will contain a copy of the configuration data from the parent account. Configuration data is data or objects used to collect transactional data, such as workflows, web forms, templates, etc. This configuration data can then be tested and altered within the sandbox without any effect to the configuration data within the parent account. Sandboxes will not copy actual data from the parent account to avoid risks of exposing Personally Identifiable Information (PII) and to limit unintended notification to data subjects. GUIDs (e.g. Integration IDs) and object associations will remain the same between the parent account and the sandbox account. However, some reconfiguration may be required for other configuration data that may be more sensitive, such as OAuth client credentials.
During sandbox creation, the current user creating the sandbox will become the Sandbox Administrator by default and will be able to manage which users have access to the sandbox. In addition, all users and roles will be copied from the parent account to the sandbox account. All users, with the exception of the Sandbox Administrator, will be marked as Inactive within the sandbox upon creation. However, the Sandbox Administrator can reactivate any users that were copied over. The Sandbox Administrator can also add new users directly to the sandbox, providing these users with access only to the sandbox without any access to the parent account.
Data Copied from Production Accounts to Sandbox Accounts
The following table provides examples of the type of data that is copied and the type of data that is not copied from production accounts to sandbox accounts for a given product.
The table below is not a comprehensive list of all possible data or every possible object, but rather a representation of the types of data you can expect to be copied or not copied.
|
Product |
Examples of Copied Data (Configuration Data) |
Examples of Not Copied Data (Transactional Data, PII, etc.) |
|---|---|---|
|
Audit Management |
Configuration data such as workflows, attributes, and automation rules. |
Objects such as the controls library, audits, workpapers, and findings. |
|
Campaigns |
Configuration data such as settings. |
Objects such as campaign manager and rule based groups. |
|
Cookie Consent |
Configuration data such as language, locale, application permission, and application permission category. |
Objects such as websites, vendors, scripts, templates, and geolocation rules. |
|
Data Discovery |
Configuration data such as worker node settings, seeding, and classification metadata. |
N/A |
|
Data Governance |
Configuration data such as metadata settings for term/tag inheritance, classifier configurations, glossary configurations, saved searches, and data policies. |
N/A |
|
Data Mapping Automation |
Configuration data such as,
|
Objects such as inventories, relationships, personal data associations, and inheritance settings at the inventory level. |
|
Disclosures |
Configuration data such as templates, workflows, routing rules, questionnaire templates, disclosure types, and attributes. |
Objects such as disclosures, disclosure forms, and questionnaires. |
|
Enterprise Policy Management |
Configuration data such as templates and section templates. |
Objects such as policies, procedures, and standards. |
|
Helpline & Case Management |
Configuration data such as web forms and web form version IDs. |
N/A |
|
Incident Management |
Configuration data such as settings, schema definitions, and web form mapping. |
Objects such as incidents. |
|
IT & Security Risk Management |
Configuration data such as formula schema details, risk types, aggregation methodologies, risk settings, risk levels and matrices, risk user information, and risk templates. |
Objects such as risk data, risk entity link data, attachments, comments, activity, and controls. |
|
Mobile App Consent |
Configuration data such as categorizations, templates, and geolocation rules. |
Objects such as mobile apps and SDKs. |
|
PIA & DPIA Automation |
Configuration data such as approval workflows, routing rules, settings, assessment templates, and the question library. |
Objects such as assessments and all the related elements including question responses, activity tracking, comments, and notes. |
|
Policy & Notice Management |
Configuration data such as layouts and section templates. |
Objects such as notices. |
|
Privacy Notice Management |
Configuration data such as templates and section templates. |
Objects such as notices. |
|
Privacy Rights Automation |
Configuration data such as web forms, workflows, response templates, and settings. |
Objects such as the request queue, request resolutions, and subtask resolutions. |
|
QRA & Vendor Portal |
Configuration data such as settings, Trust Profile attribute configuration, attribute and attribute group configurations, and workflow configurations. |
Objects such as requests, customers, answer library, Trust Profile, and documents. |
|
Reports |
N/A |
N/A |
|
Settings & Administration |
Configuration data such as assignments (ABAC), organizations, users, roles, and user groups. |
N/A |
|
Third-Party Due Diligence |
Configuration data such as settings related to monitoring/screening usage notification recipients, Dow Jones content settings for screening/monitoring, and Dow Jones versions. |
Objects such as screening results. |
|
Third-Party Risk Exchange |
Configuration data such as risk domain metadata of the SIG assessment template. |
Objects such as the risk report. |
|
Third-Party Risk Management |
Configuration data such as,
|
Objects such as engagements, contracts, relationship data for engagements and contracts, activity, attachments, rule evaluation status, and stage change status and history. |
|
Training |
N/A |
N/A |
|
Universal Consent & Preference Management |
Configuration data such as Collection Points, Purposes, Data Elements, and Preference Centers. |
Objects such as data subjects' profiles, groups, and receipts. |
Sandbox Account FAQ
The following responses are supported solutions to frequently asked questions (FAQ) on sandbox accounts. The OneTrust team continuously monitors these inquiries and will make additional FAQ available as they are identified.
Am I entitled to multiple free sandboxes if I have multiple accounts/tenants?
Only one free sandbox is provided per Customer that meets the minimum net spend threshold, regardless of the number of accounts/tenants they have.
Will all modules within my current account appear in the sandbox account?
All modules will appear in the sandbox account. If a module does not appear in your sandbox, please refresh the sandbox. For more information, see the To refresh a sandbox procedure within Managing Sandbox Accounts.
What is the difference between a sandbox account and UAT?
Sandbox accounts are created in the same environment as your parent account in production whereas UAT is an entirely separate environment from your production environment. In addition, configuration data, such as workflows, web forms, templates, etc., is automatically copied from the parent account to the sandbox account. For more information, see Sandbox & UAT Differences.
Can the Automated Sandbox Creation feature be enabled for UAT environments?
No - the Automated Sandbox Creation feature can only be enabled for production environments.
Are Insights Dashboards and Reports available within sandbox accounts?
Insights Dashboards and Reports are not fully supported in sandbox accounts. OneTrust does not recommend relying on sandbox reporting data, as issues identified in sandbox dashboards or reports are not investigated or remediated.
Are Third-Party Due Diligence integrations with Dow Jones supported within sandbox accounts?
No - all screening is live and can only be done in production.
Will system emails be sent to data subjects, users, etc. within sandbox accounts?
Upon Sandbox creation, system emails will only be sent to the Sandbox Administrator. All users will be marked as Inactive within the Sandbox except for the Sandbox Administrator. In addition, Sandboxes will not copy actual data from the parent account to avoid risks of exposing PII and to limit unintended notification to data subjects. However, Customers can reactivate any users that were copied over, create new users, add data subjects, etc. to which system emails can be sent.
Notification summary emails are intentionally suppressed within sandbox accounts. Changes to settings on the User preferences > Notifications screen are not supported within sandbox accounts.
How long will it take to create and/or refresh a sandbox account?
The amount of time it takes to create and/or refresh a sandbox account will depend on the volume of data that is being copied from the parent account, which can range from a few minutes to a few hours to complete.
How often is the data within sandbox accounts refreshed?
Sandbox accounts are refreshed manually from the parent account. When a sandbox is refreshed, the sandbox will be cleared of all data except for the existing Sandbox details, Client Credentials, and SSO configuration, and the sandbox will be re-seeded with a copy of the current configuration data from the parent account.
If a configuration change is made in the production account after the sandbox is created, will that change immediately reflect in the sandbox account?
No - the sandbox would need to be refreshed in order for those configuration changes to appear in sandbox.
Can sandbox accounts be used to try new products prior to purchasing?
No - sandbox accounts will only have the products that you have purchased.
Can Preview Features be enabled on sandbox accounts without being enabled in production in order to test new functionality?
Yes - you may request Preview Features to be enabled within your sandbox account without enabling it in production. However, the Preview Feature will need to be re-enabled each time that the sandbox is refreshed.
Will sandbox accounts created in HIPAA environments (APP-HC) automatically follow those standards?
Yes - sandbox accounts are created in the same environment as your parent account in production.
Will existing, active integrations be automatically deactivated in sandbox accounts?
Yes - all integrations will be copied from the parent account to the sandbox account, but the integrations will be deactivated.
Can a sandbox account be copied into the parent account in production?
No - the Automated Sandbox Creation feature currently only copies the parent account to the sandbox account.
Can I create another sandbox account if I have an existing sandbox account pending deletion?
This depends on the number of sandbox accounts included as part of your subscription. For example, if you are licensed for one sandbox, you will not be able to create another sandbox while the other sandbox is pending deletion.
Does OneTrust support tenant copies from sandbox accounts to production accounts or sandbox accounts to UAT accounts?
No - tenant copies from sandbox accounts are not supported.
When an environment is upgraded to a new release version, will the sandbox account also receive the upgrade?
Yes - sandbox accounts are created in the same environment as the production account, so both the production account and sandbox account will be upgraded to the new release version at the same time.
Additional Resources
For more information and detailed procedures on sandbox accounts, see the following articles in the OneTrust Knowledge Base.