Customer Data Platforms
128 martech vendors in Customer Data Platforms, part of Data, Analytics & Measurement. Each record carries the date we last verified it, so you can see how current it is before you rely on it.
Last verified:
Procurement-readiness profiles — SOC 2, ISO 27001, GDPR and DPA posture, data residency, AI-training policies — are available when you sign in.
Customer data platform (CDP) software unifies customer records from multiple systems into one profile, used for segmentation, personalization, and cross-channel activation. Data governance and AI governance teams scrutinize CDPs early because they centralize PII by design — data residency, sub-processor lists, and AI training policy carry more procurement weight here than in almost any other category.
Who it is for
- Data governance leads mapping where a unified customer profile will live before a CDP goes into production.
- AI governance reviewers checking whether a CDP trains predictive models on customer data by default.
- IT security teams assessing encryption, access control, and sub-processor exposure for a platform that touches every customer record.
What your No-Committee will ask
- Data governance
- Where does the unified profile live, and is data residency stated explicitly? We record data residency as a structured field, sourced from the vendor's own privacy or legal page.
- AI governance
- Does the CDP use customer data to train its own or third-party models? This is the one control where the negative answer is the desired one, and our audits flag it as a single evidenced claim, not buried in a privacy-policy paragraph.
- Legal / compliance
- Is a sub-processor list published, and does it update with notice? We capture sub-processor disclosure and change-notification language directly from the DPA.
- IT security
- Is customer data encrypted at rest, and is access role-based? Encryption and RBAC claims are recorded per vendor with a link to the source page, not inferred from marketing copy.
- Architecture
- How does the platform integrate with the rest of the stack — API, webhooks, or batch only? We note the vendor's stated integration surface where it's published.
- Risk / finance
- What's the data-export path if the contract ends? Exit-strategy and data-portability claims are captured where the vendor addresses them; where it's silent, we say so.
How we verify
Every field on a CDP profile links back to the exact page it came from — privacy policy, DPA, sub-processor list, or security page — so the reading can be checked in under a minute. The full definitions behind verified, self-attested, and not-found are on our methodology page.
Frequently asked questions
How is a CDP different from a data warehouse or a marketing automation platform?
A CDP is built to unify identity across sources into one customer profile usable by other tools, not just to store data or run campaigns. A data warehouse stores raw data without that identity-resolution layer; marketing automation consumes a profile rather than building one. Some vendors blur these lines in their own marketing.
Why does the AI training question matter so much for this category?
CDPs sit on the full customer record, so if the vendor uses that data to train shared models, it can end up influencing outputs for other customers too. Regulators and internal AI governance reviewers treat this as a distinct question from general data security, which is why we track it separately.
Is a published DPA enough to confirm GDPR posture?
A DPA is a strong signal but not the whole picture — it covers the contractual terms, not the implementation. Our audits record whether a DPA is available and link to it, while flagging that legal review of the actual clauses is still the buyer's job, not something we substitute for.
How common is a fully verified audit in this category today?
Deep, fully verified audits are still early-stage across the whole catalog, not just here — most vendor claims currently show as self-attested rather than independently verified. We say so on every record rather than implying a certainty the evidence doesn't support.