Security · Governance · Trust
Security and data ownership in a private customer data platform (CDP)
Review how your customer data platform (CDP) protects data and records access. Check who holds the keys and who can change settings. Ask for evidence for your chosen release. This page does not establish certification.
Single-tenant · isolated · customer-controlled
First-Party Data
Profiles, events, consent
AI Inference (Private)
Customer-managed models
Audit Log
Immutable, customer-owned
Access Control
RBAC · SSO · scoped tokens
Trust Architecture
Four invariants every PrivyCDP deployment preserves
Use these topics to scope the security review. Test the controls in your chosen setup and request the supporting records.
Customer-Owned Infrastructure
Run PrivyCDP in your cloud account or datacenter. Your team owns the servers, storage, network and access rules. Confirm any hosting or support work in a separate agreement.
No Shared SaaS Environment
The setup serves one customer in their own environment. Map where events and AI requests go. Check the network paths before using real data.
Segmented Architecture Support
Plan private network links and separate zones where needed. Give each part of the system only the access it needs. Test the rules with your security team.
Customer-Controlled Data Residency
Choose where to store profiles, model data and audit logs. Set rules for copies, retention and deletion. Check that the running setup follows those rules.
Compliance Framework
Compliance is delivered through customer-owned environment plus PrivyCDP control documentation
The customer owns the compliance assessment. Request the control documents and audit records for your release. Review them with your security and legal teams; software alone does not prove compliance.
Each framework above is satisfied through the combination of (a) the customer's own infrastructure controls and attestations, and (b) PrivyCDP's control documentation, audit log schema, RBAC model, encryption design, and update entitlement records. Anonymized control matrices are available during enterprise evaluation under NDA.
Governance Support
Operational controls for regulated decisioning
Evaluate these governance controls in the proposed configuration, with named owners and retained evidence. Availability depends on the selected release and operating scope.
Audit Trail (immutable)
Every profile mutation, segment definition, decision output, and AI inference call is written to an append-only audit ledger inside the customer boundary. Schema is documented, queryable, and exportable for regulator review.
Role-Based Access Control
Scoped roles for ingestion operators, segment authors, AI reviewers, activation operators, and auditors. Integrates with customer SSO and IdP. Token scopes are bounded by environment, dataset, and action class.
Explainable AI Decisioning
Every AI-assisted decision (segment suggestion, next-action recommendation, anomaly flag) ships with the inputs, model version, and reasoning trace required to reproduce and review the output. No opaque autonomous actions.
Isolation Boundary
What stays inside — and what is structurally blocked
The boundary is not a policy promise. It is the shape of the deployment. There is no path from the inference layer or activation layer to a third-party AdTech, MarTech, or public analytics cloud.
Customer VPC · customer-controlled keys · no vendor egress
Ingestion Plane
Internal sources only
Identity Resolution
Deterministic + probabilistic
AI Inference (Private)
Customer-managed models
Decision Layer
Reviewable outputs
Audit Ledger
Append-only
Activation
Owned channels only
NDA & Reference Handling
How customer references are protected
PrivyCDP operates a strict NDA discipline across pre-sales, evaluation, and post-deployment reference activity.
"Client names are protected under strict NDA. Anonymized deployment references are available during enterprise evaluation."
Reference architectures, deployment shapes, and operational outcomes can be shared in anonymized form against signed mutual NDA. Direct customer introductions are arranged only after the referenced customer has confirmed scope, format, and audience.
Update Entitlement
Updates and security maintenance
Security patches, version compatibility, and continued releases are delivered under a defined entitlement model — not as a managed SaaS dependency. The perpetual license remains valid indefinitely.
Security patches & releases
Versioned releases, CVE-tracked patches, and compatibility updates delivered through controlled artifact channels into the customer environment.
Annual term
Coverage is delivered on an annual term, renewable. The Update Entitlement is decoupled from the perpetual license itself.
No SaaS dependency
No update path requires the customer to call out to a vendor-managed runtime. Updates are pulled into the customer's own deployment plane.
Related engineering context: Privacy-first martech and operating controls. Use it with the page-specific evaluation questions above.
Discuss your deployment with engineers.
Bring your data flow, operating owners and evaluation questions.
Further reading
- Audit ledger (immutable audit log)
- Explainable AI for Marketing
- Customer data regulation guides
- HIPAA-Compliant CDP: What It Takes
- DORA and Your Marketing Stack: Register
Published: · Updated:
Editorial dates describe content changes. Confirm current sources before making legal, security or purchasing decisions.