Composable vs Packaged vs Private Customer Data Platform (CDP): An Honest Comparison

A composable customer data platform (CDP) builds and activates customer profiles on data that stays in your own warehouse. A traditional, packaged CDP keeps profiles in a vendor-run database. Composable gives you one copy of the data and more engineering ownership; packaged gives you faster setup and stronger real-time features. Private deployment is a separate choice: it decides who runs the software, in whose infrastructure, whichever architecture you pick.

Who this is for: architects, data leaders, CISOs and marketing operations leads. You will get definitions, a three-way comparison, the real-time and consent trade-offs, and a decision guide. More explainers: the Learn hub.

What each term means

Packaged (traditional) customer data platform

Composable (warehouse-native) customer data platform

In the composable model, customer profiles are built in the company's enterprise data warehouse instead of a separate CDP database, using tools that often come from different vendors and work directly against the warehouse 2. Hightouch describes its composable CDP as a layer that lets you use any data in your organisation without storing it 3. The CDP Institute treats composable as a deployment model, not a fifth CDP type 1. The usual components:

• Storage and compute: Snowflake, Google BigQuery, Databricks, PostgreSQL or another warehouse or lakehouse as the source 4.
• Modelling and identity: SQL models plus identity-stitching rules, for example RudderStack Profiles, which compiles declared identity rules into warehouse-native SQL 11, or Hightouch Identity Resolution 12.
• Audiences: a marketer-facing builder over warehouse tables, such as Hightouch Customer Studio 4 or the Audience Hub in Fivetran Activations 7.
• Activation: reverse ETL syncs to ad platforms, email, CRM and support tools 34.
• Events: separate collection, such as Hightouch Events 12.

Embedded variants exist: Databricks markets CustomerLake as an agentic CDP built in Databricks 5; Zeotap offers a Composable CDP as a Snowflake Native App 6; Fivetran acquired Census and sells it as Fivetran Activations 7.

Private (customer-owned) deployment

This is a different axis, and its terms overlap, so define them:

• On-premise: the software runs on hardware in your own data centre.
• Private cloud: a dedicated single-tenant environment, either in your own cloud account (a VPC) or operated for you by the vendor.
• Self-hosted: you, not the vendor, install and operate the software.
• Customer-owned: you hold the licence, the keys and the infrastructure, and can run without vendor access.
• Sovereign: operated under a chosen jurisdiction's law, with residency, operator and legal control met together; air-gapped is the strictest form.

A private deployment can be packaged (one product, its own database) or composable (your warehouse plus your tools, all run by you).

The three-way comparison

For the layers underneath this table, see customer data platform architecture.

Where composable shines

• You already run a governed warehouse or lakehouse and a data-engineering team. The CDP Institute lists the advantages as no new copy of customer data, reuse of existing warehouse resources and more control 2.
• Analytical audiences and batch activation. Hourly or daily audiences built on history such as revenue, product usage and billing that never pass through an event stream.
• Pricing leverage. Hightouch's pricing page describes usage-based pricing for its Composable CDP and says there are no MTU limits 12.
• Analyst validation. Gartner's 2026 assessment of Hightouch, as reported by CX Today, credits composable architecture leadership and says the approach removes replication latency and cost 17.

Where composable struggles

Real-time

The CDP Institute says real-time updates and access are poorly supported by most data warehouse technology and may require copying warehouse data into separate structures, which recreates a CDP database 2. Warehouse vendors are closing the gap: Snowflake quotes Snowpipe Streaming ingest-to-query latency as low as 5 seconds 13, and dynamic tables have a 60-second minimum target lag 14. Add a sync interval and the end-to-end path is seconds to minutes (our inference), not the tens of milliseconds a page render needs. Hightouch lists Events and Real-time Personalization as separate products 12, consistent with real-time needing a serving layer beside the warehouse. See real-time decisioning for budgets by channel.

Consent enforcement

In a packaged platform, consent is usually a profile attribute checked by one engine. In a composable stack it is data in a table that every model and every sync must respect. A sync engine that by default compares each run with the previous one and sends only new, changed and removed rows 4 delivers a withdrawal at the next successful run, not before. The legal limits are outer bounds:

• GDPR requires withdrawing consent to be as easy as giving it, and personal data must stop being processed for direct marketing after an objection 23.
• The FTC requires CAN-SPAM opt-outs to be honoured within 10 business days 24.
• California requires a response to an opt-out of sale or sharing no later than 15 business days after the request 25.

Treat those as ceilings. Make consent a mandatory upstream filter in every audience model, suppress again at send time, monitor sync lag as a compliance metric and audit what was sent under which consent (consent withdrawal across channels).

Streaming state, identity and staffing

Rolling counters, sessionisation and late-arriving events are stream-processing problems, not batch-SQL ones. Identity resolution becomes your code to test, including merge and unmerge logic (identity resolution explained). The CDP Institute notes composable needs more engineering effort to assemble and maintain, while packaged CDPs deploy faster and are easier for business teams to run 2.

The 2026 market signal

• Analyst recognition. CX Today reported on 9 February 2026 that Gartner's 2026 Magic Quadrant for CDPs names Salesforce, Oracle, Uniphore and Hightouch as Leaders; Tealium and Treasure Data moved from Leader to Challenger; Twilio is a Niche Player; ActionIQ, Redpoint, mParticle and Zeta were dropped under updated inclusion criteria 17.
• Capital. Hightouch raised $150M in a Series D at a $2.75B valuation in spring 2026; sources differ on March versus April 18.
• Convergence. Packaged vendors have unbundled parts of their systems to work on warehouses 2, while warehouse platforms now sell CDP-shaped products 567.

Read the signal with care: a Magic Quadrant applies inclusion criteria, so no single ranking settles your choice.

Why private deployment is the third axis most comparisons miss

Most "composable vs traditional" articles stop at where profiles are stored. Regulated buyers also ask whose infrastructure runs the stack and under which jurisdiction. The vendors' own documentation shows the gap:

• Snowflake states you cannot install and run it on-premises or on private cloud infrastructure, hosted or not 9. A Snowflake Native App runs in the customer's account 22, which is still Snowflake's service.
• Databricks keeps its control plane in Databricks' account; classic compute runs in your cloud account, while serverless compute runs in Databricks' account 10.
• Hightouch says workspaces can be deployed in a supported region on AWS, GCP or Azure, that it does not keep long-lived copies of primary customer tables, and that it persists operational data in a bucket that is Hightouch-managed by default or your own. Its security overview describes no self-hosted option 8.

So "your data stays in your warehouse" can still describe a fully vendor-operated stack. For a bank, DORA's register-of-information rules apply to ICT third-party arrangements however the data model is drawn 26 (see DORA and your marketing stack). For health data the issue is a business associate agreement; for public bodies, jurisdiction.

Decision guide

Ten questions to ask any vendor

1. Where are profiles stored, and when is a second copy created (caches, buckets, logs)?
2. Which components run in my environment and which in yours (control plane, identity, sync engine)?
3. What is p95 latency from event to activation in my configuration?
4. How does a consent withdrawal reach every destination, how fast, and where is the proof?
5. Where does identity resolution run, and can I export the graph and merge history?
6. What is metered (MTU, profile, row, credit, sync) and what does year three cost at my volume?
7. Can I keep operating if your service is unreachable?
8. Which subprocessors touch my data, and what goes in my DORA register or BAA?
9. How do I exit: data, configuration and contractual assistance?
10. What staff do I need, and what do you operate for me?