SetLatch

Privacy requests (DSARs) for every site you run: triage, app look-ups, tasks and the audit trail.

View on setlatch.com

Hosted MCP Server

npx add-mcp 'https://setlatch.com/mcp'

Installs into Claude Code, Codex, Cursor and more

Documentation

SetLatch: privacy requests, handled for every client site

SetLatch is how agencies handle data access and deletion requests across all the sites they run: on time under GDPR and US state privacy laws, deleted in the tools your clients actually use, with the proof to show for it.

What SetLatch does

  1. One dashboard for every client site. Each site gets its own request page, team, data map and settings. Your agency sees every site and what is due; a client’s staff see only their own.
  2. Verifies who’s asking. Confirms the requester is real before anything happens, so no one hands a person’s data to an imposter.
  3. Runs the clock under GDPR and US state law. Deadlines for GDPR, UK GDPR, the California CCPA/CPRA and the other US state privacy laws start on their own, with reminders before anything goes overdue. Under the state laws, requesters can appeal a decision from a link, and the appeal gets its own deadline.
  4. Deletes where the data actually lives. Connect Mailchimp, Stripe, Shopify, WooCommerce, HubSpot, Klaviyo, Gmail or Resend, or any system through a signed webhook. SetLatch finds the person, someone on your team approves, and the deletion runs with its reference recorded. Nothing is deleted without a person saying so, and no AI decides what goes.
  5. Keeps the receipts. A tamper-evident record of every request and every step taken. Proof for a regulator, a client, or a client’s customer.

A DPA for every client, drafted for you

SetLatch drafts a data processing agreement between your agency and each client from that site’s data map, connected tools and data region, ready to download for Word or as a PDF. Fill in the blanks and have your own lawyer review it before anyone signs: it is a starting point, not legal advice.

Ready for bigger clients

  • Data stays in the US or the EU. Each site’s records and files are stored in the region picked for it, United States or European Union, and locked to that jurisdiction.
  • A DPA that is already signed. Every account comes with a Data Processing Agreement and a published sub-processor list, so a client’s legal team has something to read on day one.
  • An audit trail that holds up. Every change to a request is appended to a hash-chained log per site. Exports include it.
  • Access that matches who you are. Agency owners and admins hold every site; client staff are invited to one site and see nothing else.

Pricing

One licence per site, no per-request fees, 14-day trial. Prices in US dollars.

  • Agency: $82.50 a month per pack of 5 sites, billed annually as $990 (or $99 billed monthly). Add as many packs as you need on one subscription, with one agency team above every site and a team of their own for each client.
  • Single site: $24.17 a month per site, billed annually as $290 (or $29 billed monthly), for a business running its own site.

Work with SetLatch from an AI assistant

SetLatch has an MCP server at https://setlatch.com/mcp with OAuth sign-in. See SetLatch for AI assistants.

Listed in: Claude Connectors Directory, Official MCP Registry, LobeHub MCP Marketplace.

More