RevOps Playbook: Two‑Way Sync, De‑Duplication, and Error Handling Between HubSpot and Salesforce

Q: Which fields are safe for two‑way sync?

Low‑risk profile fields such as phone numbers and job titles. Avoid two‑way for lifecycle, ownership, and revenue‑critical fields like stage and amount.

Q: How do we avoid infinite loops?

Make updates idempotent, include a change source flag, and ignore no‑op updates. During backfills, freeze the mirror field and route changes through the integration.

Q: What’s the best merge policy for companies?

Human‑in‑the‑loop with deterministic suggestions. Preserve parent–child hierarchies and legal names; never auto‑merge enterprise entities without review.

Q: Should we purge duplicates automatically?

Only for low‑risk contact duplicates with strong signal (same email). Otherwise, use a steward queue to avoid destructive merges.

Q: How do we measure success?

Collision rate trending down, duplicate creation rate below baseline, SLA adherence on latency, and a shrinking error backlog.

Published by Bles Software, a custom software and AI company based in Yehud-Monoson, Israel, building web apps, AI agents and API integrations for clients in Israel, the US, the UK and the EU.

Two‑way sync is powerful—and risky. It speeds up go‑to‑market by letting users update key fields in either system, but it also creates opportunities for collisions, loops, and silent data drift. This playbook shows how to design safe two‑way sync, build a deduplication strategy that preserves identity across both systems, and operate an error‑handling loop that keeps you within SLAs.

When two‑way sync is justified

Default to one‑way sync. Introduce two‑way only when the field must be edited by users in both systems and a lag would materially slow down the business (e.g., phone number, job title, role). Avoid two‑way for lifecycle, ownership, and revenue‑critical fields unless you have strong conflict controls.

Designing conflict‑safe two‑way sync

Build three lines of defense:

Prevent collisions: optimistic concurrency (reject mid‑air edits with a friendly error and retry advice) and per‑field last‑updated timestamps.
Detect collisions: compare timestamps and actors; if both changed within a window, flag for steward review.
Resolve collisions: deterministic policies (e.g., Salesforce wins for lifecycle; HubSpot wins for consent), steward queues for ambiguous cases, and alerts for high‑impact fields.

Implementation tips

Store last writer and updated_at per field, not just per record.
Use a message hash to detect no‑op updates and cut API noise.
Include a change source attribute (user, integration, automation) for forensic clarity.

De‑duplication strategy

The goal is to stop bad merges while preventing duplicate explosion. Separate prevention from remediation.

Prevention

Contacts: use email + normalized domain; if the email is generic (info@), require name + company domain + country.
Companies: rely on normalized website domain and legal name; suppress ISP/generic domains.
Salesforce: enforce matching rules; HubSpot: enable dedupe on email/domain and verify during imports.

Remediation

Build a steward queue with candidate matches and a “merge reason” (import, form, API).
Preserve survivor IDs and propagate merges back to the other system immediately.
For enterprise accounts, require human review for company merges to protect hierarchies.

Backfills and replays without loops

Backfills are necessary when you ship new fields or fix historical issues. To avoid sync loops:

Freeze the mirror field or route all changes through the integration during the backfill window.
Use idempotent upserts with record version checks.
Run in small batches with sampling to verify effects; monitor queue depth and API limits.

Error handling and observability

Errors happen. What matters is that they are visible, triaged, and resolved within SLAs.

Error taxonomy

Validation errors: picklist mismatch, required field missing, format issues.
Authorization and limits: expired tokens, daily caps, throttling.
Referential integrity: missing owner, territory, or related record.
Transient network/system: timeouts, 5xx; retry with backoff.

Operating model

Triage daily; page on burst thresholds.
Auto‑retry transient classes; quarantine validation failures for stewards.
Publish weekly error reports with root‑cause categories and trend lines.

SLA design

Define SLOs for latency and error budgets. For example, P50 lead sync < 5 minutes, P95 < 30 minutes, and monthly error budget < 0.5% of messages. Alert when burn rate exceeds thresholds and give GTM stakeholders a transparent dashboard.

Safeguarding consent and privacy

Consent is authoritative in HubSpot. Mirror only derived eligibility (e.g., Marketing Eligible) to Salesforce. Enforce regional rules (GDPR, CASL) at the edge before records enter the core. When backfilling or deduping, preserve consent history and avoid promoting invalid contactability states.

Playbook: rolling out two‑way safely

Identify candidate fields; justify two‑way based on business impact.
Add per‑field timestamps and last‑writer attributes.
Implement optimistic concurrency and clear user messaging.
Pilot with a small cohort; measure collisions and user happiness.
Expand coverage incrementally with dashboards and runbooks.

Runbooks

A record is flipping values back and forth

Check for two automations disagreeing across systems. Add a guard: freeze the mirror field and pick one authority; then re‑enable bi‑directional once the policy is clear.

Duplicate contacts after a webinar import

Confirm import settings and matching keys. Queue suspected duplicates for stewards, merge survivors, and propagate merges to the other system immediately to prevent re‑creation.

Validation failures on picklists after a release

Your dictionaries drifted. Roll back the dictionary change or add transforms in the integration layer; then replay quarantined messages.

FAQ

Which fields are safe for two‑way sync?