1. Overview
The ClickUp integration scans the authorized hierarchy and reads paged tasks, comments, custom fields, assignees, watchers, and relationships from selected workspaces, spaces, or lists.
The current customer-managed path uses a personal API token from a dedicated account; a future OAuth path is not represented as available today.
2. Connection and scope
Seedling verifies the provider account before storing the workspace connection. A current Seedling workspace administrator controls installation and disconnect; account identity is never inferred from an email address or display name.
- ClickUp personal API token
- The token inherits the dedicated ClickUp user's native access. Optional workspace, space, and list IDs narrow synchronization.
- Connection ownership
- This connector is workspace-only. A current Seedling workspace administrator controls installation, credential replacement, disconnect, and purge for the exact connection.
3. ClickUp data Seedling accesses
Seedling uses synchronized information for source-backed search, operating context, verification, and customer-approved workflows. Availability depends on the connected account, selected resources, provider plan, and native permissions.
- Work hierarchy
- Workspaces, spaces, folders, lists, statuses, and custom-field definitions.
- Tasks
- Tasks, subtasks, assignees, watchers, priorities, dates, dependencies, and configured values.
- Collaboration
- Comments, users, activity context, and list/task relationships returned to the token.
4. Read-only permission contract
Personal API tokens inherit user access. Seedling documents the equivalent read-only OAuth ceiling for a future managed app without claiming that OAuth is released.
- Current token — read only the workspaces and private resources visible to the dedicated token owner.
- Future OAuth: task:read, team:read, user:read, and webhook:read only.
- Optional workspace, space, and list allowlists narrow ingestion independently of provider permissions.
- No task, comment, list, space, member, webhook, or workspace write is exposed.
5. Security and access
- Provider credentials and other connection secrets are encrypted in the workspace tenant data plane, never returned to the browser, and excluded from logs and queue payloads.
- Every source, synchronization, secret lookup, audience contribution, disconnect, and purge remains bound to the exact connection that created it.
- The provider does not expose enough complete object-level audience evidence for Seedling to reproduce native permissions safely. Workspace content therefore uses the connection's restricted-by-default workspace-or-no-human-access policy; administrator and steward status grant no raw-content bypass.
- Generated output cannot bypass Seedling's human review, verification, and approval gates.
6. Retention and deletion
- Connected data
- Synchronized ClickUp records remain while the connection is active and are removed through a durable integration purge after disconnect.
- Credentials
- Stored ClickUp credentials or connection secrets and connection-owned synchronization state are deleted from active Seedling systems as part of the purge.
- Backups
- Deleted information may remain in encrypted, access-restricted backups until expiry, ordinarily within 35 days after active-system deletion.