GTM Access for Vendors and Developers

For working with vendors who are trusted partners.

Definition:

• Unit: University at Buffalo administrative or academic Unit contracting services (should be cc’d on all correspondence by partner)
  
• Partner: Vendor that has been vetted and approved by UB’s vendor review team

Web based services and software solutions can put sensitive university data at risk. This review will mitigate risk when purchasing third party solutions, whether installed or accessed on-premise or in the cloud.

• Verify your vendor has been vetted and approved.
• If not, all vendors need to be vetted by UB’s vendor review team.
  • This will be an evaluation of coding practices, server security, etc.
  • Be sure to build in time for this process
• Please initiate the review here

DCT Help Team will review tags, triggers and variables before they are published. This applies to all uses of GTM, such as configuring built-in GTM tags and custom HTML tags that contain  any html or scripts within the tag (e.g. <script>your code here</script>, or other HTML).

Timeframe

• Give 3-5 business days notice that changes (or group of changes in the same week) will need be reviewed and published (where ever possible)
  • Allow extra time for complex or non-standard scripts. The DCT Help Team will also publish these changes on your behalf.
• When creating new custom scripts it is recommended that the vendor outreach to DCT Help Desk as soon as possible for a consultation before there is a tight deadline. We will accommodate all reasonable requests.
• Escalation – When there are unanticipated expedited needs we will do our best to accommodate these emergencies. Use the same process to submit, but highlight the deadline in the subject line and elaborate in your additional comments.
  

• When your Partner creates the version to be published in Google Tag Manager, please give a descriptive name  and description field , as well as descriptive names for each trigger, tag or variable submitted. Vendors initials should precede the name of the tag to establish ownership
  • E.g. FM_Spring22_Campaign
• Where ever possible during set up, limit the scope of the action or its duration– the fewer pages it affects or the shorter period of time it impacts the full domain, the less concerning the action is
  • Any scope of action that impacts sites beyond the contracting unit are prohibited without explicit permission from the DCT Help Team. For example, don’t include the Admissions site unless that unit hired the partner. Never include all sites or the UB home page without direct consultation with the DCT Help Team.
• To help us quickly review and respond to your requests you might want to consider the following
  • If something is native to Google Analytics or Google Tag Manager or Google Ad services we are not concerned. 
  • If the scope of action is limited to the sites that have hired the Partner we are not concerned.
  • We are more concerned with identification and explanation of any of the following:
    • Tags
      • Custom or third party tags
      • Custom HTML that uses javascript
    • Triggers 
      • That are large in scope and/or long in duration
    • User-Defined Variables
      • Custom JavaScript or Javascript Variable
        • Especially those with references to  3^rd party products or scripts
      • Cookies
      • Be sure to note whether custom JavaScript, HTML or use of 3rd party products have been reviewed previously, and there have been no changes, as that will speed our review

• Partner must submit proposed changes via a ticket to the DCT Help Team using the form below. UNIT is copied on all communications.
• The form will be reviewed by the DCT Help Team within three business days
  • If no concerns are flagged, the version will be published within that timeframe.
  • Any flagged custom JavaScript, HTML or use of 3rd party products will be sent to our UX or Dev team to review within 5 business days.
  • Any large scope or large duration proposals will require followup communication with the Unit and Vendor and may delay the timeframe as well.
• Any concerns will be shared with Partner (cc Unit) and Partner will be asked to be address in a different way, or explain why it needs to be addressed this way

You must have been vetted by UBit to work with UB's analytics.
> Please initiate the review here.

Please use this form to consult with the DCT Help Team, to request permissions or approval of modifications.