Compliance · Cross-Framework Map

Customer data platform (CDP) compliance: scope, controls and evidence

This customer data platform (CDP) compliance index helps technical and privacy reviewers find framework-specific questions. Start with applicability and system scope, then collect evidence for the controls and agreements your deployment needs.

Request an architecture reviewReview Enterprise TCO Model →
SOC 2 · GDPR · HIPAA · CCPA / CPRA · PCI-DSS · FedRAMP · ISO 27001 · PIPEDA
Framework Index8 frames

Service Organization Reporting

European Union

United States — Health

California, USA

Finance & Payments

US Federal

International

Canada

Eight regulatory frames mapped to one control architecture
Designed for
Financial servicesInsuranceTelecommunicationsHealthcareGamingCommerce

Section 01 · Architectural Principles

Four Principles That Carry Across Every Framework

The same architectural choices satisfy regulators in finance, healthcare, public sector, and consumer markets. The control design is structural, not contractual.

01PRINCIPLE

The customer holds the boundary

Every framework above is satisfied by controls running inside the customer environment. The vendor does not sit in the customer data path — and therefore does not expand the regulator-facing interface.

02PRINCIPLE

Evidence is generated, not requested

Append-only audit ledgers produce examination-grade evidence on demand. Customer auditors and supervisory authorities read from customer infrastructure, not from a vendor's reporting window.

03PRINCIPLE

Verify key custody and support access

Confirm key custody, decryption permissions, support access and emergency procedures in the actual configuration. Customer-managed keys alone do not establish that every access path is restricted.

04PRINCIPLE

Egress is enumerated, not assumed

Outbound flows to AdTech, MarTech, and shared analytics clouds are blocked by default. Activation routes are explicitly enumerated by the customer per consent state.

Section 02 · Framework Map

Frameworks Mapped to the Same Control Path

Each frame below resolves to a deployment design inside the customer environment. Frames marked with an arrow have a dedicated trust-architecture page.

SOC 2 (TSC 2017 / 2022)

Service Organization Reporting
Open framework page
Scope

Security · Availability · Confidentiality · Processing Integrity · Privacy.

Control Path

Customer-owned deployment · customer-held keys · append-only audit ledger.

GDPR (EU 2016/679)

European Union
Open framework page
Scope

Lawful basis · subject rights · processing records · international transfers.

Control Path

EU residency by default · DPIA-ready evidence · no cross-Atlantic processor transfer.

HIPAA (45 CFR 164)

United States — Health
Open framework page
Scope

Administrative · Physical · Technical safeguards · Breach notification.

Control Path

BAA-aligned deployment · Review PHI replication paths · per-record access ledger.

CCPA / CPRA (Cal. 1798)

California, USA
Open framework page
Scope

Right to know · delete · correct · opt-out of sale and sharing.

Control Path

GPC honored at the data layer · no sale by default · atomic subject rights.

PCI-DSS v4

Finance & Payments
Scope

Cardholder data scope containment · tokenization · segmentation.

Control Path

Cardholder scope contained inside customer VPC · tokenized at ingest.

FedRAMP / NIST 800-53

US Federal
Scope

AC · AU · IA · SC · SI control families · continuous monitoring.

Control Path

Deployable inside FedRAMP-authorized cloud or air-gapped enclave.

ISO/IEC 27001:2022

International
Scope

ISMS · Annex A controls · risk-treatment evidence.

Control Path

Control catalog mapped against the customer-owned deployment.

PIPEDA

Canada
Scope

Consent · limited collection · safeguards · individual access.

Control Path

Region-pinned deployment · customer-held consent ledger.

Cross-Reference · Companion Reading

Security & control architectureCustomer-owned deployment topologyPer-industry regulatory framing

Discuss your deployment with engineers.

Bring your data flow, operating owners and evaluation questions.

Request an architecture reviewReview Enterprise TCO Model →Request permissioned references and release-specific evidence during evaluation.

Frequently asked questions

Can one customer data platform satisfy every framework?

Framework scope and obligations differ. Start with applicable data and services, then assign control owners and collect the evidence each review requires. Primary source

Does private hosting establish HIPAA compliance?

No. Review the PHI workflow, safeguards and agreements, including any hosting or support parties involved. Primary source

Does GDPR require every record to stay in the EU?

There is no blanket EU-hosting rule. Review processing scope and international transfers under the regulation. Primary source

What does PCI DSS cover?

PCI DSS sets requirements for environments that store, process or transmit payment account data. Scope the payment data flow with qualified reviewers. Primary source

Does FedRAMP-ready mean authorized?

Do not treat a readiness label as an authorization. Confirm the applicable government service boundary and current authorization evidence. Primary source

Can we use a compliance badge as acceptance evidence?

Request the underlying report, assessment or authorization and verify its scope. A badge alone does not establish the status of your deployment. Primary source

Further reading

Published: · Updated:

Editorial dates describe content changes. Confirm current sources before making legal, security or purchasing decisions.