SecureCMS (Consent Management Platform) — Fiduciary Onboarding & Integration Guide

A comprehensive onboarding guide for Data Fiduciaries to configure, integrate, and operate the SecureCMS platform in compliance with India's Digital Personal Data Protection (DPDP) Act, 2023.

---

1. Overview & DPDP Act Foundation

The Digital Personal Data Protection Act (DPDP Act), 2023 establishes a legal framework for processing digital personal data in India. It recognizes both the right of individuals to protect their personal data and the necessity to process such personal data for lawful purposes.

Core DPDP Act Roles & Principles

Terminology	Definition under DPDP Act	Role in SecureCMS
Data Principal	The individual to whom the personal data relates (user, customer, employee).	The end-user granting, reviewing, or revoking consent, accessible via the User Dashboard (cms-user.securedapp.io).
Data Fiduciary	Any person/entity that determines the purpose and means of processing personal data.	You (the client organization / enterprise) creating and managing apps, policies, and purposes via cms-app.securedapp.io.
Consent Manager	An interoperable platform registered with the Data Protection Board that enables a Data Principal to give, manage, review, and withdraw consent.	SecureCMS, serving as the trusted, neutral consent capture and immutable audit-logging infrastructure.
Data Processor	Any person/entity that processes personal data on behalf of a Data Fiduciary.	Downstream service providers and processors synchronized via Webhooks.

Fundamental Principles Enforced by SecureCMS

1. Notice & Informed Consent: Every request presents clear notice specifying purposes and exact data items (e.g., PAN, Address, Email).
2. Itemized & Granular Choice: End-users can accept or decline individual purposes.
3. Multilingual Accessibility: Support for scheduled Indian languages as mandated under DPDP rules.
4. Ease of Withdrawal: Withdrawing consent is as frictionless as giving consent.
5. Immutable Audit Trails: Every consent event (grant, withdrawal, renewal) is tamper-proof, timestamped, and cryptographically hashed (SHA-256 hash chaining).

---

2. Choosing Your Consent Flow Architecture

SecureCMS supports two primary consent acquisition architectures:

+---------------------------------------------------------------------------------------------+
|                                    CONSENT FLOW ARCHITECTURES                               |
+---------------------------------------------------------------------------------------------+
|                                                                                             |
|   1. EMBEDDED FLOW (Client-Managed Journey)                                                 |
|                                                                                             |
|   [User] ----> [Fiduciary App / Web UI]  (Renders custom branded consent UI)                |
|                       |                                                                     |
|                       v                                                                     |
|               [Fiduciary Backend]                                                           |
|                       |  POST /public/apps/{appId}/consent (x-api-key)                       |
|                       v                                                                     |
|               [SecureCMS Engine] -------> [Immutable SHA-256 Ledger & Webhook dispatch]     |
|                                                                                             |
|---------------------------------------------------------------------------------------------|
|                                                                                             |
|   2. REDIRECT FLOW (Consent-Manager-Managed Journey with Verification)                      |
|                                                                                             |
|   [User] ----> [Fiduciary App]                                                              |
|                       | 1. POST /public/apps/{appId}/consent/redirect/request               |
|                       v                                                                     |
|               [SecureCMS Engine] -------> Returns hosted redirect_url                       |
|                       |                                                                     |
|                       | 2. Redirect User                                                    |
|                       v                                                                     |
|               [Hosted Verification Page (OTP: SMS / Email / WhatsApp)]                      |
|                       |                                                                     |
|                       | 3. User verifies OTP & Grants Consent                               |
|                       v                                                                     |
|               [SecureCMS Engine] -------> 4. Redirects user back & Fires Webhook event      |
|                                                                                             |
+---------------------------------------------------------------------------------------------+

Flow Comparison

Feature	Embedded Consent Flow	Redirect Consent Flow
Journey Ownership	Client / Fiduciary manages UI & UX.	SecureCMS hosts interactive verification UI.
User Identity Verification	Client verifies user before passing consent.	SecureCMS verifies user via OTP (SMS/Email/WhatsApp).
Best Used For	Mobile apps, onboarding funnels, seamless in-app checkouts, modern web apps.	Banking portals, loan aggregators, third-party apps, high-compliance workflows.
Minor & Guardian Support	Optional payload submission.	Built-in guardian nomination and age verification.
Integration Complexity	Frontend UI + Simple REST API call.	Redirect URL generation + Callback/Webhook handling.

---

3. Step-by-Step Fiduciary Onboarding Journey

Step 1: Create Account & Sign In

1. Navigate to the Fiduciary Admin Portal: https://cms-app.securedapp.io.
2. Sign in using Google OAuth (Single Sign-On).
3. If logging in for the first time, complete your organization profile (Tenant Name, Legal Entity Name, Contact Email).

Step 2: Create and Configure Applications

A single fiduciary tenant can manage multiple web and mobile applications under one organization.

1. In the sidebar or top navigation, click Create Application.
2. Provide:
   • App Name: e.g., Fintech Web Portal or Mobile Customer App.
   • Consent Flow: Choose embedded or redirect.
   • Callback / Return URL: (For redirect flows) The destination URL where users will be redirected upon completion.
3. Use the application selector dropdown in the header to switch between active apps.

Step 3: Configure Privacy Policy Versions

Under the DPDP Act, consent must strictly link to a specific version of your privacy notice.

1. Navigate to Policy Versions in the app menu.
2. Click New Policy Version:
   • Version String: e.g., v1.0.0 or v2026-Q1.
   • Policy Title & Description.
   • Policy Text / URL: Full privacy notice content.
   • Effective From: Date/time the policy becomes legally effective.
3. Toggle the policy to Active. Any consent recorded will automatically bind to this active policy version.

Step 4: Define Consent Purposes & Data Elements

Purposes define why you process data and what specific data points are collected.

1. Navigate to Purposes.
2. Click Create Purpose:
   • Purpose Name: e.g., KYC Verification & Fraud Detection, Monthly Marketing Updates.
   • Description: Plain-language explanation for the Data Principal.
   • Data Identifiers (Data Catalog): Select the exact personal data attributes collected:
     • Examples: FULL_NAME, MOBILE_NUMBER, EMAIL, PAN_NUMBER, AADHAAR_NUMBER, CURRENT_ADDRESS.
   • Validity Duration: Set validity in days (e.g., 365 days for annual consent, or custom intervals).
   • Mandatory vs. Optional: Mark if the purpose is strictly required for the service or optional.

Step 5: Configure Webhooks

Webhooks notify your backend systems immediately when a consent event occurs.

1. Navigate to Webhooks in the Fiduciary Dashboard.
2. Click Add Webhook Endpoint:
   • Destination URL: e.g., https://api.yourcompany.com/webhooks/consent.
   • Subscribed Events:
     • consent.updated — Fired when consent is granted or withdrawn.
     • dsr.created — Fired when a Data Subject Request (DSR) is initiated.
     • dsr.completed — Fired when a DSR request reaches completion.
   • Secret Key: Copy your signing secret to verify payload authenticity.
3. Delivery Guarantee: SecureCMS utilizes BullMQ with exponential backoff (retries at 1m, 2m, 4m, 8m, 16m) for robust delivery.

Step 6: Generate API Keys

API keys authorize your backend services to communicate with SecureCMS.

1. Go to Settings > API Keys.
2. Click Generate New API Key.
3. Assign a label (e.g., Production Backend Key).
4. Copy the key immediately: The raw key is displayed once upon creation and hashed securely in the database.
5. In all API requests, pass this key in the header:

   x-api-key: your_generated_api_key_here

---

4. Technical Integration Guide (Backend & APIs)

Base URL: https://api-cms.securedapp.io (or your dedicated CMS backend instance)
Authentication: Pass x-api-key: <YOUR_API_KEY> in request headers.

A. Embedded Consent Flow Integration

In the embedded flow, your application captures user consent directly in your app UI and transmits the event to SecureCMS.

1. Fetch Active Policy and Purposes (For Banner / Form Display)

GET /public/apps/{appId}/policy
x-api-key: <YOUR_API_KEY>

GET /public/purposes
x-api-key: <YOUR_API_KEY>

2. Record Consent Grant

When the user clicks "Accept" or selects individual purposes:

POST /public/apps/{appId}/consent
Content-Type: application/json
x-api-key: <YOUR_API_KEY>

{
  "email": "user@example.com",
  "phoneNumber": "+919876543210",
  "purposeIds": ["purp_kyc_001", "purp_marketing_002"],
  "policyVersionId": "pol_ver_12345"
}

Response (201 Created):

{
  "success": true,
  "consent_id": "cns_89f02931bc",
  "status": "granted",
  "event_hash": "a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e",
  "timestamp": "2026-10-11T14:30:00.000Z"
}

3. Record Consent Withdrawal

When the user turns off consent in your application settings:

DELETE /public/apps/{appId}/consent
Content-Type: application/json
x-api-key: <YOUR_API_KEY>

{
  "email": "user@example.com",
  "phoneNumber": "+919876543210",
  "purposeIds": ["purp_marketing_002"]
}

---

B. Redirect Consent Flow Integration

In the redirect flow, SecureCMS hosts the consent verification experience, verifies the user through OTP, and records the consent.

1. Initiate Redirect Session

Your backend creates a redirect verification session:

POST /public/apps/{appId}/consent/redirect/request
Content-Type: application/json
x-api-key: <YOUR_API_KEY>

{
  "email": "user@example.com",
  "phoneNumber": "+919876543210",
  "purposeIds": ["purp_kyc_001"],
  "policyVersionId": "pol_ver_12345"
}

Response (201 Created):

{
  "request_id": "req_847192",
  "redirect_url": "https://api-cms.securedapp.io/public/consent/redirect/e39f82d1c674a2b904...",
  "expires_at": "2026-10-11T15:00:00.000Z",
  "preferred_language": "en"
}

2. Redirect the Data Principal

Redirect your user's browser or webview to the returned redirect_url:

• SecureCMS renders a clean, DPDP-compliant verification page.
• The user reviews the purposes, validity period, and data attributes.
• The user triggers an OTP verification (sent via SMS, Email, or WhatsApp).
• Upon OTP confirmation, SecureCMS commits the consent event and redirects the user back to your app's return URL.

---

C. Checking Real-Time Consent State

To verify whether a user has active consent before processing personal data:

POST /public/apps/{appId}/consent/state
Content-Type: application/json
x-api-key: <YOUR_API_KEY>

{
  "email": "user@example.com",
  "phoneNumber": "+919876543210"
}

Response (200 OK):

{
  "active": true,
  "consents": [
    {
      "purpose_id": "purp_kyc_001",
      "purpose_name": "KYC Verification",
      "status": "granted",
      "valid_until": "2027-10-11T14:30:00.000Z"
    }
  ]
}

---

D. Webhook Payload Structure

When consent changes, SecureCMS sends an HTTP POST request to your webhook URL:

{
  "event": "consent.updated",
  "tenant_id": "ten_94812",
  "app_id": "app_fintech_01",
  "timestamp": "2026-10-11T14:30:05.120Z",
  "data": {
    "consent_id": "cns_89f02931bc",
    "user_identifier": "hash_sha256_pseudonymized_identity",
    "status": "granted",
    "purposes": ["purp_kyc_001"],
    "policy_version": "v1.0.0",
    "verification_channel": "sms"
  }
}

---

5. End-User (Data Principal) Portal: cms-user.securedapp.io

The DPDP Act guarantees individuals the right to review their consents and file grievances.

Data Principal Experience

1. Users visit the User Consent Portal: https://cms-user.securedapp.io.
2. Users authenticate via OTP using their registered phone number or email address.
3. From their dashboard, users can:
   • View Active & Historic Consents: See all applications and fiduciaries processing their data.
   • Revoke / Withdraw Consent: Instantly withdraw consent with a single click.
   • Submit Data Subject Requests (DSR): Exercise their legal rights (Right to Access, Correction, Erasure, or Portability).
   • Grievance Redressal: File complaints or reach out to the Fiduciary's Data Protection Officer (DPO).

---

6. Compliance & Security Checklist for Fiduciaries

• Data Minimization: Only select data identifiers strictly required for each specific purpose.
• Multi-language Notices: Provide consent notices in languages readily understood by your target users.
• Secure Webhook Verification: Validate webhook requests and handle idempotency in your backend.
• Rotate API Keys: Regularly cycle API keys through the Fiduciary Dashboard.
• Grievance Response Timelines: Monitor DSR requests and resolve Data Principal grievances within the statutory timeline.