Gmail integration

2. Connection and scope

Seedling verifies the provider account before storing the connection. A personal connection remains actor-owned; a workspace connection is administered for the selected Seedling workspace. Credentials are never inferred from an email address or silently promoted between scopes.

Google OAuth grant

An access token and refresh token for the intended Google user, issued with openid, email, profile, and https://www.googleapis.com/auth/gmail.readonly. Organization-wide sources instead inherit the verified Google Workspace parent authorization.

Connection ownership

Seedling supports actor-owned personal access and administrator-managed workspace access for this connector. The selected scope and exact connection remain fixed through synchronization, rotation, disconnect, and purge.

3. Gmail data Seedling accesses

Seedling uses synchronized information for source-backed search, operating context, verification, and customer-approved workflows. Availability depends on the connected account, selected resources, provider plan, and native permissions.

Mail

Authorized messages, bodies, headers, sender and recipient context, attachments, and immutable message identity.

Conversation structure

Threads, replies, labels, dates, history identifiers, and relationships needed for incremental synchronization.

Permission evidence

Mailbox ownership and provider-returned participant or sharing context used by the Gmail audience projector.

4. Read-only permission contract

The connector requests Google identity scopes plus one Gmail read scope. It does not request compose, send, modify, settings, or mailbox administration access.

• openid, email, and profile — verify the Google identity that owns the authorization.
• gmail.readonly — read messages, threads, labels, attachments, and mailbox history without modifying or sending mail.
• offline access — obtain a refresh token for recurring synchronization; it does not expand Gmail permissions.

5. Security and access

• Provider credentials and other connection secrets are encrypted in the workspace tenant data plane, never returned to the browser, and excluded from logs and queue payloads.
• Every source, synchronization, secret lookup, audience contribution, disconnect, and purge remains bound to the exact connection that created it.
• Workspace connections use provider-returned object permissions and stable principals for human audience projection. Missing, stale, ambiguous, or unmappable ACL evidence contributes no human audience, and no Seedling administrator or steward may broaden it.
• For a personal connection, raw content remains visible only to the connecting member in human-facing Seedling surfaces. Personal content may contribute to trusted system exploration under workspace policy, but that authority never transfers to another member.
• An organization-wide Google Workspace grant does not create a steward read bypass. Gmail audience projection still follows stable provider principals and fails closed when evidence cannot be mapped.
• Generated output cannot bypass Seedling's human review, verification, and approval gates.

6. Retention and deletion

Connected data

Synchronized Gmail records remain while the connection is active and are removed through a durable integration purge after disconnect.

Credentials

Stored Gmail credentials or connection secrets and connection-owned synchronization state are deleted from active Seedling systems as part of the purge.

Backups

Deleted information may remain in encrypted, access-restricted backups until expiry, ordinarily within 35 days after active-system deletion.

7. Installation, help, and removal