# How does this actually work?

- The Ketch Agent Network is what powers the Ketch platform: the orchestration layer underneath every Ketch product, continuously gathering context (regulations, policies, contracts, data repositories, collection points, access controls, Ketch configurations) and acting across the platform. It runs four purpose-built sub-agents: Document Synthesis Agent, Data Discovery Agent, Data Classification Agent, and Ketch Configuration Agent.
- Collects, enforces, and audits consent across devices, brands, and browsers. Delivers banners, modals, and preference centers via the Ketch Smart Tag (lightweight, async JavaScript) and native SDKs (iOS, Android, React). Supports GDPR, CCPA, LGPD, PIPL, and more. Includes 400+ no-code customization options, server-side consent records in Permission Vault, Age Gating, Do Not Sell or Share, Video Consent, Progressive Consent, GPC/GPP/IAB TCF support, and Privacy 360 Analytics.
- Intake, verification, and end-to-end fulfillment of Data Subject Requests (access, deletion, correction, opt-out) with auditable evidence per request. Features customizable intake form, drag-and-drop workflow editor with parallel branches and decision gateways, process automation, task automation, integrated analytics, and fan-out deletion across all connected systems with collected receipts.
- AI-agent-assisted, continuously maintained map of systems, data flows, processing activities, and risk. Generates ROPA reports, DPIA evidence, and audit exports from live data. Features point-and-click data map builder, AI-powered discovery via the Agent Network, real-time ROPA generation, and contract term extraction from DPAs and subprocessor lists.
- Finds and classifies personal and sensitive data inside SaaS applications, internal systems, databases/warehouses, code, and third-party platforms. Classifies 100+ data categories. Data Sentry is the website/frontend scanning sub-product that analyzes live network traffic and real data packets. Transponder classifies data in place without moving it out of the customer environment.
- Continuously compares actual Ketch configurations and system data against regulatory obligations, internal policies, and contracts. Drafts DPIAs, PIAs, TIAs, vendor assessments, and AI risk assessments. Detects contradictions and contract gaps; proposes and can execute remediation. Agent drafts ~80% of assessments from live data.
- Resolves a person's identity across browsers, devices, sessions, and systems; carries consent and rights state with them. Permission Vault is the server-side, cryptographically verifiable record of consent, preferences, identity, and policy signals. Supports cross-device identity graph, server-to-server (Type 2) orchestration into downstream ad platforms, CDPs, and internal systems.
- Intercepts prompts before they reach LLMs, detects PII in real time, blocks or redacts sensitive data at the point of use. Monitors AI data flows including shadow AI. Connects human privacy choices to live AI data flows. MCP (Anthropic Model Context Protocol) compatible. Blocks model use of non-permissioned data at runtime via Permission Vault and Transponder.