Another lesson learned the hard way is that I will not touch any analytics SDK code unless it is open source. It needs to have an actual clear license attached.
We got bitten with Google Analytics, because it can only report against one ID. That means if a library in the app also uses GA, then you can't have the different parts using different ids. This turned out to be a showstopper and they had no code to examine.
We do actually do our import and custom processing in MongoDB, so that side is covered.