Customer Data Platform on AWS, Azure and GCP: Reference Architectures

Running a customer data platform (CDP) "on" AWS, Azure or Google Cloud can mean three different things: buying a vendor's SaaS that is hosted there, running the vendor's software in your own cloud account and VPC (often called bring-your-own-cloud, BYOC), or building it from managed services such as streams, object storage, a warehouse and a key service. Control, cost and sovereignty differ sharply between the three.

Who this is for: cloud architects, CISOs and CTOs who need to decide where customer data lives and who operates it. You will get definitions, a service-by-service reference architecture for each cloud, what AWS Marketplace listings really are, cost and operations notes, the sovereignty caveat, and a selection checklist. Part of the guides hub.

What "a CDP in your own cloud account" means

Four terms get mixed up in vendor pages. Define them before you compare.

• VPC (single-tenant) deployment: the software runs in a virtual network dedicated to you. Whose cloud account holds that network is a separate question.
• BYOC (bring your own cloud): the vendor's software runs in your cloud account, and the vendor may or may not operate it. Snowplow's FAQ, for example, distinguishes its CDI Private Managed Cloud from its shared CDI Cloud 14, and RudderStack's founder described in 2020 an enterprise option deployed inside the customer's VPC but managed by the vendor 15.
• Customer-managed keys: you control the encryption key in AWS KMS, Azure Key Vault or Google Cloud KMS. Revoke the key and the data becomes unreadable, for you and for the vendor.
• Private connectivity: AWS PrivateLink, Azure Private Link or Google Private Service Connect keep traffic between your network and a service off the public internet 8910.

Table 1. Four ways to run a customer data platform on a hyperscaler

For on-premise and private cloud variants, see the guide to on-premise, private cloud and self-hosted customer data platforms.

The layers you are mapping

Every design below fills the same slots, described in customer data platform architecture:

1. Ingestion: SDK and API collection plus batch loads.
2. Streaming: a durable log for events.
3. Storage: raw, cleaned and curated zones.
4. Identity and profile: matching records into one customer.
5. Warehouse and analytics: segmentation and reporting.
6. Activation: sending audiences and events to channels.
7. Keys, network and audit: encryption, private connectivity, logging.

Reference architecture on AWS

AWS publishes Guidance for Customer Data Platform on AWS in its Solutions Library; the page was generated on 16 October 2026 1. It is an architecture diagram with Well-Architected notes, not a one-click product. It names Amazon Kinesis Data Streams, SQS and API Gateway for near real-time ingestion; AWS Transfer Family, DMS and AppFlow for batch; Amazon Connect Customer Profiles for real-time profiles; S3 for raw data; Glue and AWS Entity Resolution for matching; S3 Tables for clean and curated zones; Redshift for modelled data; and AWS Clean Rooms for partner collaboration 1. Its security section uses AWS KMS keys for S3 and a VPC endpoint for DynamoDB access 1. AWS also published two Architecture Blog posts on the topic, including a December 2022 overview aimed at software vendors 2.

Table 2. CDP layers mapped to AWS services

A stale reference to watch. When we read AWS's "what is a customer data platform" page, it listed Amazon Pinpoint among building blocks 4. AWS's Pinpoint documentation says support ends on 30 October 2026 and points engagement users to Amazon Connect Customer Profiles and outbound campaigns 5. Pick services with a lifecycle you have checked.

Reference architecture on Azure

Azure has a first-party packaged option: Dynamics 365 Customer Insights - Data, which Microsoft calls its customer data platform, built on Azure and licensed per tenant 6. If you build instead, the usual mapping is below.

Table 3. CDP layers mapped to Azure services

| Keys | Azure Key Vault | Standard tier software-validated to FIPS 140 Level 1; Premium tier HSM-protected keys at FIPS 140-3 Level 3 13 | | Network | Azure Private Link | Private endpoints over the Microsoft backbone; works across Microsoft Entra tenants 9 | | Packaged CDP | Dynamics 365 Customer Insights - Data | Per-tenant licensing 6 |

The Fabric note matters for sovereignty reviews: a SaaS analytics layer shifts operations and administrative access back toward the provider, even though the data sits in Azure.

Reference architecture on Google Cloud

Table 4. CDP layers mapped to Google Cloud services

| Storage | Cloud Storage | Raw and curated zones | | Warehouse | BigQuery | Customer-managed keys in Cloud KMS; you grant BigQuery's service account the encrypter/decrypter role 17 |

| Network | Private Service Connect | Private consumer access to managed services; traffic stays within Google Cloud 10 |

What AWS Marketplace "customer data platform" listings actually are

AWS Marketplace delivers software as AMIs, container products, SaaS, professional services and data products 19. For SaaS products, AWS says you subscribe through Marketplace but use the product in the seller's own environment 20. We opened four listings that AWS's own explainer links to, on 17 October 2026 4:

Deployment patterns for a CDP in your own VPC

Table 5. Patterns and their trade-offs

PrivyCDP is one commercial example of a customer-owned single-tenant deployment in your own AWS, Azure or GCP account; others include Meiro's self-hosted option. See deployment options. Whatever you choose, ask where the control plane runs and how the vendor's own access is logged.

Cost and operations considerations

Cloud bills for a customer data platform come from five places, not one licence line. AWS's guidance suggests identifying data egress points and evaluating PrivateLink and Direct Connect to reduce transfer cost, and provisioned capacity for predictable Kinesis traffic 1.

• Data movement: cross-zone, cross-region and egress charges; replay and backfill spikes.
• Streaming capacity: provisioned versus on-demand, retention length.
• Compute for identity and segmentation: batch jobs scale with profile count and rule complexity.
• Storage and logs: raw history, audit logs and backups all grow.
• People: on-call, upgrades, security patching, disaster recovery drills.

Tag resources per workload so cost can be allocated; AWS's guidance recommends tagging for per-tenant cost measurement 1. For a full model, use the 3-year TCO model and see TCO.

Residency is not sovereignty

Placing data in an EU or other regional data centre gives residency: you know where the bytes are. Sovereignty asks who can compel access. Under 18 U.S.C. § 2713, a provider must preserve and disclose communications and records within its "possession, custody, or control" regardless of whether they are stored inside or outside the United States 22. That is the US CLOUD Act's core provision, and it is why a US-headquartered provider's EU region is a residency control, not by itself a jurisdictional one.

Customer-managed keys help, but they do not settle the question alone. Ask what each key option protects if the provider is compelled, and plan your exit with the cloud exit strategy template.

Selection checklist

Use this with the RFP template.

• We have decided which model applies: SaaS, single-tenant, BYOC, customer-operated or warehouse-native.
• The data location is documented at account, region and sub-processor level.
• Encryption uses customer-managed keys, and we know the outage and recovery effect of revoking them.
• Traffic between our network and any vendor service uses PrivateLink, Private Link or Private Service Connect.
• Vendor access to our account is time-bound, least-privilege and logged to storage the vendor cannot alter.
• Identity resolution, consent state and suppression run inside the boundary we chose.
• Every managed service in the design has a lifecycle we checked (Pinpoint is the cautionary example).
• High availability and disaster recovery targets are written down and tested.
• Egress, replay and backfill costs are modelled, not assumed.
• Sovereignty requirements are stated separately from residency requirements, and legal has reviewed them.
• An exit path exists: export formats, data return and decommissioning.

Checked 17 October 2026 unless stated.