Skip to content
NEW: Martech Stack Builder on your phone →

Quickstart stack

A consent and governance stack: privacy built into the data flow

Consent and personal data are handled as part of the data flow, not as a banner on the website. Consent state reaches the tag manager, the event router and the warehouse, and the warehouse only ever holds tokens for personal data.

Open this stack in Stack Builder → No sign-up. It opens on the canvas, ready to change.

10 tools · 13 connections

OneTrust to Google Tag Manager: Consent modeOneTrust to Twilio Segment: Consent state APIOneTrust to Snowflake: Suppression & DSAR listGoogle Tag Manager to GTM Server-side: Client hitsGTM Server-side to Twilio Segment: Server eventsGTM Server-side to Google Analytics 4: Measurement ProtocolTwilio Segment to Skyflow: PII tokenisationTwilio Segment to Snowflake: Event stream (tokenised)Skyflow to Snowflake: Detokenised viewsSnowflake to Braze: Profile & suppression syncSnowflake to Google Ads: Consented audiences onlySnowflake to Meta Ads: Consented audiences onlyBraze to Twilio Segment: Engagement & unsubscribes OneTrust Consent Management Skyflow PII Vault Braze Customer Engagement Google Tag Manager Tag Management GTM Server-side Server-side Tagging Twilio Segment Event Router Snowflake Data Warehouse Google Ads Advertising Google Analytics 4 Analytics & BI Meta Ads Advertising
Scroll sideways to see the whole stack. Arrows show the direction data moves. Every connection is listed by name below.

What it is for

Regulated businesses (finance, health, anything under strict GDPR scrutiny) need to show where personal data goes and prove that a withdrawn consent stops it. This stack is drawn to make that readable.

Every activation connection is marked with its blast radius (compliance or revenue), so the Security lens shows which connections carry the most risk.

Why each tool is here

  • OneTrust Consent Management

    Consent management, sending to three places: Consent Mode to Tag Manager, consent state to Segment, and the suppression and data subject request list to Snowflake daily.

  • Google Tag Manager Tag Management

    Tag management in the browser, sending hits to the server container.

  • GTM Server-side Server-side Tagging

    Server-side tagging. Forwards events to Segment and GA4 from a server you control.

  • Google Analytics 4 Analytics & BI

    Web analytics, fed by the server container.

  • Skyflow PII Vault

    A data privacy vault. Holds the personal data; everything else holds a token.

  • Twilio Segment Event Router

    Event routing. Sends personal data to Skyflow to be tokenised and the tokenised stream to Snowflake.

  • Snowflake Data Warehouse

    The warehouse, holding tokens rather than personal data. Detokenised views come from Skyflow where a use is allowed.

  • Braze Customer Engagement

    Customer engagement. Receives profiles and the suppression list, and sends engagement and unsubscribes back.

  • Google Ads Advertising

    Paid search. Receives consented audiences only.

  • Meta Ads Advertising

    Paid social. Receives consented audiences only.

How data flows

Tag Manager sends hits to the server container, which forwards them to Segment and GA4. Segment sends personal data to Skyflow on each event and streams tokenised events to Snowflake.

Snowflake sends profiles and suppressions to Braze hourly, and consented audiences to Google Ads and Meta daily. Braze sends engagement and unsubscribes back to Segment, so an opt-out reaches the warehouse and the next audience build.

Every connection

  1. OneTrust to Google Tag Manager Consent mode · Real time, on each event
  2. OneTrust to Twilio Segment Consent state API · Real time, on each event
  3. OneTrust to Snowflake Suppression & DSAR list · Batch, daily
  4. Google Tag Manager to GTM Server-side Client hits · Streaming, continuously
  5. GTM Server-side to Twilio Segment Server events · Streaming, continuously
  6. GTM Server-side to Google Analytics 4 Measurement Protocol · Streaming, on each event
  7. Twilio Segment to Skyflow PII tokenisation · Real time, on each event
  8. Twilio Segment to Snowflake Event stream (tokenised) · Streaming, continuously
  9. Skyflow to Snowflake Detokenised views · Real time, on each event
  10. Snowflake to Braze Profile & suppression sync · Batch, hourly
  11. Snowflake to Google Ads Consented audiences only · Batch, daily
  12. Snowflake to Meta Ads Consented audiences only · Batch, daily
  13. Braze to Twilio Segment Engagement & unsubscribes · Streaming, on each event

When this is the wrong choice

  • You have no regulated data and a small team. A vault adds a hop to every use of personal data; it earns its place when the risk does.
  • You want the simplest working stack. Start from Analytics & BI and add governance when you have something to govern.

Try this: Open it and switch on the Security lens to see the blast radius on each connection.

Other quickstart stacks

Make this stack yours

Open it on the canvas, swap in the tools you use, and connect them. No sign-up until you want to keep it.

Open this stack in Stack Builder → All quickstart stacks

No credit card required. Free plan available.