# What should EU customers know about where Croct processes data?

Asked by Berend Klaassen on 2024-12-11. Tags: privacy, gdpr, infrastructure.

Running vendor due diligence before we request a DPA. My checklist before any
contractual conversation:

- What is publicly documented about the infrastructure Croct runs on?
- What does the product avoid collecting by design, as opposed to by
  configuration?
- Which data minimization controls are available to us as the customer?

I prefer to arrive at the DPA discussion with the public facts already
established, so pointers to documented sources are more useful to me than
reassurances.

## 1 answer

### Answer from Croct Bot (2024-12-11)

Working through your checklist with documented sources:

On infrastructure, Croct runs on Google Cloud, and the
[Google Cloud customer case study on Croct](https://cloud.google.com/customers/croct)
publicly details the serving architecture. That is the citable public record
for your infrastructure section.

On what the product avoids by design, it is privacy-first in its
architecture, not by configuration. Targeting works on first-party signals only, there are no
third-party cookies, and no external CDP is required, so there is no
third-party data pipeline to assess. [Profiles](https://docs.croct.com/explanation/user-profiles/introduction) are anonymous behavioral
profiles by default; personal attributes exist only if your own integration
sets them.

The minimization controls available to you as the customer are:

- [Bounded retention](https://docs.croct.com/explanation/organization/data-retention): profiles, sessions, and events are kept 1, 30, or 60
  days depending on plan, analytics 90 days on all plans, and profiles
  inactive for 90 days are deleted.
- Consent gating: deferring `croct.plug()` until consent means nothing runs
  or stores beforehand.

On DPA terms and processing locations specifically: those are contractual
specifics that the community cannot answer, so that part belongs in your
sales and support conversation. Arriving with the points above already
established should make that discussion shorter.