Firebase Authentication
Start from the agreed user record and stable project identifiers. Provider profiles and application records may require separate mapping.
Firebase DSAR · Pilot mapping
Map the person, not just the Firebase project.
A Firebase access request can cross Authentication, Firestore, Realtime Database, Cloud Storage and your own backend. Trace’s proposed pilot maps those links into one review-ready case—without pretending every project has the same schema.
The Firebase request surface
One user can leave several identifiers.
Firebase Authentication exposes a user account, but application data is usually modelled separately. The pilot begins with a verified identifier map, not a broad project export.
Firestore or Realtime Database
Locate in-scope documents, subcollections or JSON paths using the customer’s actual schema and security model.
Cloud Storage references
Use an agreed object manifest or scoped retrieval path. A database reference does not by itself prove file coverage.
Functions and connected systems
Document where events or exports flow outside Firebase, including billing, support and separate application backends.
Orphaned and anonymous records
Flag records that cannot be reliably linked rather than silently treating the search as complete.
Human decision boundary
Put third-party data, retention, disclosure scope and any proposed action in front of an authorised reviewer.
Proposed pilot workflow
How a Firebase DSAR would run.
- Confirm scope. Record the request, right being exercised, identity state and Firebase projects in scope.
- Build the identifier map. Connect the agreed UID, email and application-specific keys without assuming they are interchangeable.
- Approve source access. Select a controlled export, customer-run retrieval or least-privilege temporary access.
- Retrieve source by source. Keep Authentication, database and object evidence labelled with its origin.
- Flag uncertainty. Record inaccessible collections, ambiguous links, third-party content and retention questions.
- Assemble for review. Prepare the source inventory, evidence package, response draft and event timeline.
Access requests are not deletion scripts. Article 15 describes the right of access. Any erasure action is a separate decision with its own legal and operational analysis.
Official product references: Firebase Authentication users and Firestore and Realtime Database. Legal reference: Article 15 GDPR.
Security boundary
No blanket credentials by default.
Firebase server access can be powerful. The pilot must document exactly what can be read, for how long, by whom and how access is revoked.
Approve the retrieval plan
Projects, collections, identifiers, permissions, output fields and transfer route are agreed before live retrieval.
Revoke and record
Remove temporary access, confirm package delivery and apply the accepted retention and deletion procedure.
Project-specific by design
Firebase pilot questions.
Collection structure and access rules are customer-specific, so readiness is confirmed before a service promise is accepted.
Does Trace have a live one-click Firebase connector?
No. Firebase is currently labelled Pilot mapping. An accepted pilot would map the project, identifiers, collections and access method with the customer. Automated connector coverage is not claimed.
Can a Firebase UID find every record?
Not necessarily. A UID may be the primary key in some collections while email addresses, document references, device identifiers or application-specific IDs appear elsewhere. The source map must reflect the customer’s actual data model.
Will Trace delete Firebase data automatically?
No. Automated deletion is not claimed. A deletion case may require a reviewed action plan across Authentication, databases, files and connected systems, with retention and legal decisions owned by authorised people.
What access does an early pilot require?
The least-privilege method that can produce the agreed evidence. That may be a customer-generated export, customer-run queries or time-limited scoped service access. Broad project access is not the default.
A controlled first request
Bring one Firebase request and the real source map.
Trace will assess whether the proposed pilot can be delivered before access, terms or payment are agreed.