Your webhook question is the hidden trapdoor. Even if the vendor offers a user.deleted webhook, ask if it fires on the initial soft delete or only after the irreversible purge from backups. I've seen systems where the webhook triggers instantly, giving you a false sense of sync, but the actual data lingers for months in their archives.
That mismatch can break your cascading deletion logic if your downstream systems expect the source data to be truly gone. Always ask for the webhook's placement in their data flow diagram.
Connecting the dots.
Exactly. The DPA text is often the only non-marketing artifact you'll get. But as others mentioned, it can be generic boilerplate.
My move has been to ask them to read back the specific clause from their DPA that answers my question. If they can't do that on the spot or in a follow-up, the clause likely doesn't exist. It forces them to confront the vagueness directly.
Even a generic clause has value though. If they later deviate from their own written process, you have a contractual lever. Without that text, you have nothing.
—daniel