Good to know.
Small caveats and edge cases that come up enough to mention up front.
Identity verification on email-submitted DSRs
Webform DSRs have identity verification built into the form. Email-submitted DSRs use sender authentication and the x-original-sender header (for authorized agent attribution), but full email-side identity verification is on our roadmap, not yet in production. The pragmatic implication: trust webform requests on their face, and treat ambiguous email requests as "Needs Info" until you can verify.
DROP
DROP is a separate Superset module that handles California's centralized deletion system, distinct from the Privacy Inbox. If you're a California-registered data broker, the August 1, 2026 DROP deadline is one you want to be on the right side of well in advance. The DROP onboarding guide lives at trustsuperset.com/docs/drop. Ping your Superset contact when you're ready to wire up.
Portability requests
Portability is the most operationally challenging DSR type. Our automation here is intentionally lighter than for Erasure or Opt-out, because portability requests usually need a human to assemble files from systems Superset doesn't sit in front of. If you start seeing portability requests in volume, that's a conversation to have.
Daily volume
One enterprise data broker has processed over 185,000 DSRs through Superset. The system is built for that kind of scale. If your inbound volume is more modest, none of this changes; the same workflows apply.
Data retention
By default Superset retains all records indefinitely. If your policy calls for it, an organization admin can turn on Automatic Record Deletion under Organization Settings to delete DSR and email-triage records after a set number of days.