Third-Party and SaaS Integration Questions

Recommendation
For unsubscribes, I would centralize the consent workflow and let other systems react to the resulting event. This is a case where correctness matters more than loose independence, because one missed suppression can create a compliance problem.

How I would decide

• Centralize if there is one business rule for consent, one audit trail, and a hard deadline before the next send.
• Use choreography only when systems are loosely coupled and temporary delay is acceptable.

Failure modes I would watch

• A service misses the unsubscribe event
• A retry causes duplicate updates
• A campaign send races ahead of the suppression update
• One system updates from stale cache while another is current

Example
If a user opts out at 9:10 and a campaign is scheduled for 9:15, the central consent service should record the change immediately, publish an event, and block sends until all critical destinations confirm receipt or until the campaign filter reads from the central source of truth.

Control plane
I would add retries, dead-letter handling, a reconciliation job, and a pre-send suppression check so the system stays safe even if one downstream service is slow.

I would design this as a policy-driven event pipeline so the rules are enforced once, not reimplemented in each destination.

Flow
Website event -> ingestion API -> consent and policy service -> transform/mask layer -> routing to analytics, CRM, and ad platforms.

Key ideas

• Consent means the user has allowed a specific use, such as marketing.
• Masking means replacing sensitive values with partial or tokenized data.
• Retention means deleting or expiring data after a defined time.
• Access rules mean only approved services and roles can read certain fields.

How it works
Each event carries a user ID, region, consent flags, and a policy version. The policy service decides what can be stored and where it can go. Analytics may receive pseudonymous events, CRM may receive only contact data for opted-in users, and ad platforms get nothing unless marketing consent is true. Regional rules are checked before export, so a field allowed in one country can still be blocked in another.

Worked example
If a user in France submits email, city, and campaign click data, but has not accepted marketing, the system can keep the click for product analytics, mask the email for internal logs, skip CRM and ads, and schedule deletion after the retention period.

Trade-offs
Centralized policy adds some latency and complexity, but it is the right choice because it prevents inconsistent handling across destinations and makes audits much easier.

Situation: In a B2B SaaS role, marketing wanted a fast direct sync from our signup form into the CRM so campaigns could launch the same day.

Task: I needed to push back because the shortcut would have sent unvalidated and potentially non-consented data into downstream systems, which created reliability and compliance risk.

Action: I explained the trade-off in plain language: the fast path would save a day or two, but we would inherit bad records, duplicate leads, and possible privacy violations. I proposed a safer design: capture events in an ingestion layer, validate required fields, normalize formats, and only publish approved records. For example, if a user entered a German address, left the marketing checkbox blank, and typed "CA" in a country field, the pipeline would store the event, mark consent as false, mask restricted fields, and block CRM and ad-sync, while still allowing product analytics.

Result: Marketing agreed to a phased rollout. We launched the core sync first, then added the edge cases after validation and consent checks were in place. The outcome was slower by a bit up front, but we avoided rework, reduced bad data in the CRM, and built trust because stakeholders saw the system was reliable and privacy-aware.

Approach
I would resolve identities with a layered matching strategy. Identity resolution means deciding which records refer to the same person. I would use deterministic rules first, then probabilistic rules when the evidence is weaker.

Trust and merge rules

• Treat login-linked identifiers such as verified email or account ID as high trust.
• Treat anonymous cookies as temporary and link them only after a login or strong correlation.
• Prefer source systems that own the data, for example the billing system for account status.
• Keep conflicting attributes as separate fields with lineage when the source is uncertain.

Example
A browser cookie c123 later logs in as jane@example.com and maps to account A77. I would merge those into one person profile because the login creates a strong bridge. If another record also uses jane@example.com but has a different customer since 2021, I would not auto-merge until I verify whether it is a shared inbox or a duplicate account.

Decision rule
Merge when confidence is high and the identifiers form a clear chain. Keep separate when the match could create a false positive, because over-merging is harder to undo than under-merging.

Strategy
I would define a single source of truth per data domain, not one for everything. Source of truth means the system that is allowed to make the final decision for a field. For consent and preferences, I would usually pick one authoritative consent service and make the others read-through or replica systems.

Conflict resolution rules

• Prefer the authoritative system for that field, such as the compliance tool for consent.
• Use timestamps only within the same trust tier, not across all systems blindly.
• If two updates conflict and neither clearly wins, keep the last known safe state and queue manual review.
• Store source, timestamp, and reason so every decision is auditable.

Example
If the website records email opt-out at 10:01 and the CRM sends an older preference snapshot at 10:05, I would still keep the opt-out because the website is the higher-trust source for user actions and the CRM update is likely stale.

Practical rule
For each field, I would document who can write, who can read, and how conflicts resolve. That prevents every team from claiming ownership and makes outages much easier to recover from.