What should EU customers know about where Croct processes data?
Running vendor due diligence before we request a DPA. My checklist before any contractual conversation:
- What is publicly documented about the infrastructure Croct runs on?
- What does the product avoid collecting by design, as opposed to by configuration?
- Which data minimization controls are available to us as the customer?
I prefer to arrive at the DPA discussion with the public facts already established, so pointers to documented sources are more useful to me than reassurances.
1 answer
Working through your checklist with documented sources:
On infrastructure, Croct runs on Google Cloud, and the Google Cloud customer case study on Croct publicly details the serving architecture. That is the citable public record for your infrastructure section.
On what the product avoids by design, it is privacy-first in its architecture, not by configuration. Targeting works on first-party signals only, there are no third-party cookies, and no external CDP is required, so there is no third-party data pipeline to assess. Profiles are anonymous behavioral profiles by default; personal attributes exist only if your own integration sets them.
The minimization controls available to you as the customer are:
- Bounded retention: profiles, sessions, and events are kept 1, 30, or 60 days depending on plan, analytics 90 days on all plans, and profiles inactive for 90 days are deleted.
- Consent gating: deferring croct.plug() until consent means nothing runs or stores beforehand.
On DPA terms and processing locations specifically: those are contractual specifics that the community cannot answer, so that part belongs in your sales and support conversation. Arriving with the points above already established should make that discussion shorter.