1. Overview
The Confluence Cloud integration reads spaces, pages, blog posts, comments, attachments, labels, and hierarchy through a site URL and an Atlassian API token.
A classic API token inherits the account's Confluence permissions. A scoped token, the only kind Atlassian service accounts have, is also limited to its read scopes and is sent through the Atlassian API gateway for the site.
2. Connection and scope
Seedling verifies the provider account before storing the connection. A personal connection remains actor-owned; a workspace connection is administered for the selected Seedling workspace. Credentials are never inferred from an email address or silently promoted between scopes.
- Confluence Cloud API token
- Use a classic or scoped API token for a dedicated Atlassian account or service account whose space and page-restriction access matches the intended source population.
- Connection ownership
- Seedling supports actor-owned personal access and administrator-managed workspace access for this connector. The selected scope and exact connection remain fixed through synchronization, rotation, disconnect, and purge.
3. Confluence data Seedling accesses
Seedling uses synchronized information for source-backed search, operating context, verification, and customer-approved workflows. Availability depends on the connected account, selected resources, provider plan, and native permissions.
- Spaces
- Space identity, type, status, description, and available permission context.
- Content
- Pages, blog posts, titles, bodies, versions, labels, authors, timestamps, and hierarchy.
- Collaboration
- Comments, attachments, ancestors, links, space permissions, and page restrictions returned to the account.
4. Read-only permission contract
Provider-side account permissions are the ceiling for every API token. A scoped token is further limited to read scopes, the same ones the future OAuth design uses.
- API token account — Can use Confluence plus view access only to approved spaces and intentionally included page restrictions.
- Scoped token or future OAuth: read:space:confluence, read:page:confluence, read:attachment:confluence, and read:comment:confluence.
- Scoped token or future OAuth access context: read:space.permission:confluence, read:content-details:confluence, read:content.restriction:confluence, and read:user:confluence.
- offline_access is used only for future recurring OAuth renewal.
- No page, blog, comment, attachment, label, permission, or restriction write is exposed.
5. Security and access
- Provider credentials and other connection secrets are encrypted in the workspace tenant data plane, never returned to the browser, and excluded from logs and queue payloads.
- Every source, synchronization, secret lookup, audience contribution, disconnect, and purge remains bound to the exact connection that created it.
- The provider does not expose enough complete object-level audience evidence for Seedling to reproduce native permissions safely. Workspace content therefore uses the connection's restricted-by-default workspace-or-no-human-access policy; administrator and steward status grant no raw-content bypass.
- For a personal connection, raw content remains visible only to the connecting member in human-facing Seedling surfaces. Personal content may contribute to trusted system exploration under workspace policy, but that authority never transfers to another member.
- Generated output cannot bypass Seedling's human review, verification, and approval gates.
6. Retention and deletion
- Connected data
- Synchronized Confluence records remain while the connection is active and are removed through a durable integration purge after disconnect.
- Credentials
- Stored Confluence credentials or connection secrets and connection-owned synchronization state are deleted from active Seedling systems as part of the purge.
- Backups
- Deleted information may remain in encrypted, access-restricted backups until expiry, ordinarily within 35 days after active-system deletion.