Extracting Attachments from the OneTrust Platform

You can contact your OneTrust Consultant to submit a request to access your encrypted attachments. Customer Attachments are stored in an Azure Storage Account as private Blob documents in an encrypted format. OneTrust can share these attachments by decrypting them programmatically and encrypting them in a customer-provided Public Key. Your OneTrust Consultant will then contact the respective OneTrust Product Team to process the request and provide you with a download link of the data encrypted with your key. This download link will be valid for four weeks.

To request access

Please provide the following details to your OneTrust Consultant:

  1. Reason for why access is needed
  2. Email address of the individual with whom the download link should be shared
    Note:

    This individual should be authorized to view all attachment data within the tenant. It is recommended that they also have technical experience with downloading and decrypting the data, as needed.

  3. Public Key for encryption
    Note:

    When requesting to retrieve attachments from the platform, please ensure that you include a PGP public key for secure encryption. The OneTrust Team will use this PGP public key to encrypt your attachments so that they are secure during transfer. The download link will be sent to the email address provided in the request. Please note that only your specific PGP private key can decrypt the downloaded files.

    For comprehensive instructions on PGP key generation and decryption, see To generate PGP keys and decrypt attachments.

CAUTION:

If submitting this request through OneTrust Support, please include evidence that the request is from a Site Admin of your company, such as a screenshot of the Roles screen for the user submitting the request.

To generate PGP keys and decrypt attachments

Note:

The following guide is based on an open source GPG tool. Customers can use any encryption tool to generate a Private Key and Public Key.

CODE 
brew install gnupg
CODE 
gpg --version

Step 1: Install GNUPG

For Mac OS:

Ensure the gpg tool is installed on your machine. For Mac OS, you can use the following command:

CODE 
brew install gnupg

For Windows:

If you have Cygwin installed, you may already have GPG installed. You can verify if GPG is installed on your computer by running the following command:

CODE 
gpg --version

If this command throws an error, then GPG is not installed on your computer. You can install GPG using the following steps:

  1. Go to Gpg4win - Download Gpg4win and download the Windows version.
  2. Install the downloaded file.
  3. Add the GPG install directory to your system's PATH environment variable. For example:
    CODE 
    PATH = c:\windows;c:\utils;c:\Program Files\GNU\GnuPG
  4. Check the GPG version again by running this command:
    CODE 
    gpg --version

    You should now see the GPG version output.

Step 2: Generate PGP keys

For Mac OS & Windows:

  1. Generate the PGP key pair by following the instructions in The GNU Privacy Handbook. The private key will be required later to verify the offloaded data. Remember the passphrase/password you choose as it will be needed to decrypt the encrypted data.
    CODE 
    gpg --gen-key

    The gpg --genkey command creates a public-private key pair and stores it in the current user's gnupg config on the current machine.

  2. Run the following command, replacing test@test.com with the email you entered while generating the key pair using the gpg --gen-key command. This will export the key to a file named public.pgp.
    CODE 
    gpg --output public.pgp --armor --export test@test.com
  3. Save the key in either a .txt or .pgp file, and send this file to the OneTrust Team for attachments encryption.

Step 3: Download & Decrypt Attachments

  1. Download the encrypted attachments

    Once you receive the download link from the OneTrust Team, customers can either click the download link to download directly from the browser or use the following tools to download their encrypted attachments: Azure UI Tool - Azure Storage Explorer or Azure CLI Tool - AzCopy.

  2. Import the private key

    This step would not be required if the private key is already imported OR you have generated a key pair on your machine. Public-private keys would be imported when you generate a key pair on your machine.

    To import, if your private key file is secret.asc, then run this command:

    PYTHON 
    gpg --import secret.asc
  3. Decrypt the downloaded file

    For example, if downloaded.tar.gz.gpg is the downloaded file name, run this command to create the decrypted tar file out.tar.gz:

    CODE 
    gpg -d --output out.tar.gz downloaded.tar.gz.gpg

    Enter the password when prompted. This is the password from when the key pair was generated.

  4. Unzip the tar file

    Run this command to unzip the tar file:

    CODE 
    tar -xf out.tar.gz

Understanding the Manifest File

Along with the attachments, a manifest CSV file will be present in the export. An example of how the manifest file looks is shown below:



The following details outline how to map an attachment to its respective resource (object):

  • The ReferenceId column in the manifest file represents the unique identifier of the object, such as an Assessment ID, Vendor ID, or Inventory ID.

  • If you know the UUID of the object you're interested in, you can use it to find the corresponding AttachmentId.

  • The value in the AttachmentId column will be the name of the subfolder inside the exported download directory, which contains the files attached to the respective object.

Example from the sample manifest file in the image above:

  • ReferenceId: 2485c34e-c3c4-4e4e-a1fa-62565eac7c5a (represents an object)

  • Corresponding AttachmentId: be7d5199-5c0c-4832-b0b0-d3ccdb599902

  • The folder named be7d5199-5c0c-4832-b0b0-d3ccdb599902 will contain the file(s) attached to that object.