1. Overview
The implemented Google Sheets source is an organization-level child of Google Workspace and uses the parent's drive.readonly authorization. It does not require or store a separate Sheets credential.
Workspace spreadsheets retain the immutable Drive file ID, Drive permissions, and change state. Seedling reads bounded displayed values and formulas and does not duplicate the same spreadsheet as exported Drive CSV content.
2. Connection and scope
Seedling verifies the provider account before storing the workspace connection. A current Seedling workspace administrator controls installation and disconnect; account identity is never inferred from an email address or display name.
- Google Workspace parent connection
- This source is created beneath a verified organization-wide Google Workspace Marketplace or customer-managed service-account connection. It has no separate child credential or personal connection form.
- Connection ownership
- This connector is workspace-only. A current Seedling workspace administrator controls installation, credential replacement, disconnect, and purge for the exact connection.
3. Google Sheets data Seedling accesses
Seedling uses synchronized information for source-backed search, operating context, verification, and customer-approved workflows. Availability depends on the connected account, selected resources, provider plan, and native permissions.
- Spreadsheet structure
- Spreadsheet and sheet identity, titles, dimensions, ordering, named structure, and Drive relationships.
- Bounded cell content
- Displayed values and formulas within connector-defined bounds; the connector is not an unrestricted database export path.
- Drive permission context
- Owners, permissions, shared-drive context, stable principals, and change state inherited from the exact Drive file.
4. Read-only permission contract
Sheets uses the Google Workspace parent's drive.readonly scope. It requests no spreadsheet write scope and cannot edit cells, formulas, formatting, sharing, or file state.
- drive.readonly — read spreadsheet metadata, authorized content, permissions, and change state through the immutable Drive file.
- No spreadsheets, drive.file, or Drive write scope is requested.
- Directory read scopes on the parent resolve stable principals for projected audiences but do not broaden native spreadsheet sharing.
5. Security and access
- Provider credentials and other connection secrets are encrypted in the workspace tenant data plane, never returned to the browser, and excluded from logs and queue payloads.
- Every source, synchronization, secret lookup, audience contribution, disconnect, and purge remains bound to the exact connection that created it.
- Workspace connections use provider-returned object permissions and stable principals for human audience projection. Missing, stale, ambiguous, or unmappable ACL evidence contributes no human audience, and no Seedling administrator or steward may broaden it.
- Sheets inherits the exact Drive object's projected audience. Missing, stale, ambiguous, or unmappable Drive permission evidence contributes no human audience and cannot be overridden by an administrator or steward.
- Generated output cannot bypass Seedling's human review, verification, and approval gates.
6. Retention and deletion
- Connected data
- Synchronized Google Sheets records remain while the connection is active and are removed through a durable integration purge after disconnect.
- Credentials
- Stored Google Sheets credentials or connection secrets and connection-owned synchronization state are deleted from active Seedling systems as part of the purge.
- Backups
- Deleted information may remain in encrypted, access-restricted backups until expiry, ordinarily within 35 days after active-system deletion.