Third-Party and SaaS Integration Questions

I would design this as a policy-driven event pipeline so the rules are enforced once, not reimplemented in each destination.

Flow
Website event -> ingestion API -> consent and policy service -> transform/mask layer -> routing to analytics, CRM, and ad platforms.

Key ideas

• Consent means the user has allowed a specific use, such as marketing.
• Masking means replacing sensitive values with partial or tokenized data.
• Retention means deleting or expiring data after a defined time.
• Access rules mean only approved services and roles can read certain fields.

How it works
Each event carries a user ID, region, consent flags, and a policy version. The policy service decides what can be stored and where it can go. Analytics may receive pseudonymous events, CRM may receive only contact data for opted-in users, and ad platforms get nothing unless marketing consent is true. Regional rules are checked before export, so a field allowed in one country can still be blocked in another.

Worked example
If a user in France submits email, city, and campaign click data, but has not accepted marketing, the system can keep the click for product analytics, mask the email for internal logs, skip CRM and ads, and schedule deletion after the retention period.

Trade-offs
Centralized policy adds some latency and complexity, but it is the right choice because it prevents inconsistent handling across destinations and makes audits much easier.

Approach
I would make the consumer idempotent. Idempotent means the same event can be processed twice without creating two results. The core pattern is: persist the raw webhook first, dedupe by a stable event key, then process asynchronously.

Design

• Require an event_id from the sender, or derive a fingerprint from source system, object id, and version.
• Store each event in an inbox table with a unique constraint on that key.
• Ack the webhook only after the raw event is durably stored.
• Use upserts in downstream tools keyed by the business entity, such as lead_email or external_lead_id.
• Track event version or updated_at so older events do not overwrite newer state.

Example
If lead 123 arrives twice at 10:01 with the same event_id, the first insert succeeds and the second is ignored by the unique constraint. If a newer update at 10:03 changes the phone number, the processor applies that one because its version is later.

Failure handling
I would add retries with backoff, a dead-letter queue for poison messages, and periodic reconciliation so partial failures do not silently drift.

Signals to check
I would look at three layers: producer, pipeline, and vendor. Producer signals include send rate, retry rate, and publish latency. Pipeline signals include queue depth, age of oldest message, consumer lag, and dead-letter growth. Vendor signals include 429 responses, timeout rate, and response latency.

How I would interpret it
If the queue grows while the producer rate is flat and vendor 429s rise, the bottleneck is likely the vendor. If queue depth rises but the vendor looks healthy, the consumer or transformation layer may be slow. If the producer rate spikes unexpectedly, the issue may be upstream demand.

Controls

• Apply backpressure, so producers slow down when the queue age crosses a threshold
• Use rate limits and bounded concurrency per destination
• Prioritize fresh or user-facing updates over low-value backlog
• Pause or batch noncritical sends when the vendor is throttling
• Use retries with jitter and a dead-letter queue for repeated failures

Example
If oldest-message age jumps from 2 minutes to 18 minutes and the vendor starts returning many 429s, I would cap concurrency, lower request rate, and alert on freshness rather than just queue size, because old messages are often more harmful than a larger queue.

Decision factors
I would compare three options against four needs: speed to launch, complexity, maintainability, and latency. A native connector is simplest when the CRM and marketing tool already support the fields and schedule you need. An integration platform is good when you want faster setup, monitoring, and moderate customization. A custom API integration fits when rules are unique, scale is high, or data freshness matters.

Example
If the team only needs a nightly sync of name, email, and campaign status, a native connector is usually enough. If they later need updates within 5 minutes when a lead converts, I would move toward an API-based or event-driven design, because batch sync may be too slow.

My rule
Start with the least complex option that still meets the business need. If near-real-time updates become required, I would favor a design with webhooks or APIs plus retries and monitoring, because it gives better control over freshness and failure handling than a purely batch connector.

Approach
I would resolve identities with a layered matching strategy. Identity resolution means deciding which records refer to the same person. I would use deterministic rules first, then probabilistic rules when the evidence is weaker.

Trust and merge rules

• Treat login-linked identifiers such as verified email or account ID as high trust.
• Treat anonymous cookies as temporary and link them only after a login or strong correlation.
• Prefer source systems that own the data, for example the billing system for account status.
• Keep conflicting attributes as separate fields with lineage when the source is uncertain.

Example
A browser cookie c123 later logs in as jane@example.com and maps to account A77. I would merge those into one person profile because the login creates a strong bridge. If another record also uses jane@example.com but has a different customer since 2021, I would not auto-merge until I verify whether it is a shared inbox or a duplicate account.

Decision rule
Merge when confidence is high and the identifiers form a clear chain. Keep separate when the match could create a false positive, because over-merging is harder to undo than under-merging.