1. Overview
The Google Workspace integration brings authorized Directory, Gmail, Calendar, Drive, Sheets, and Meet information into one Seedling workspace for source-backed search, operational context, verification, and customer-approved workflows.
A current Seedling workspace administrator must establish the connection. Seedling supports a customer-managed service account and an administrator-installed Marketplace connection when available. Both modes use the same tenant-scoped ingestion, entitlement, synchronization, and deletion controls after authorization.
2. Installation options
The customer-managed option remains available when Marketplace installation is enabled. Seedling never silently changes credential ownership.
- Seedling Marketplace app
- When Marketplace installation is available, a Google Workspace administrator installs Seedling for the entire organization. Organizational-unit and group installations are not supported in version 1 and fail before the connection is activated.
- Customer-managed service account
- Your organization creates and controls a Google Cloud service account, configures domain-wide delegation, and supplies its credential through Seedling's encrypted connection form.
3. Google Workspace data Seedling accesses
Seedling does not request Google write scopes and does not use Google Workspace data for advertising, sale, unrelated profiling, or shared or third-party model training.
Seedling's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- Directory
- Users, primary email addresses, aliases, groups, memberships, organization-unit paths, account status, and immutable Google customer and user identifiers.
- Gmail
- Authorized messages, threads, labels, metadata, and history needed for incremental synchronization.
- Google Calendar
- Authorized calendars, events, attendees, metadata, and synchronization state.
- Google Drive
- Authorized files, content, permissions, comments, replies, shared-drive context, and change state. Files visible through multiple users are represented once by immutable Google file ID with merged provenance.
- Google Sheets
- Authorized spreadsheet metadata, sheet structure, bounded displayed values and formulas, Drive relationships, permissions, and change state. Workspace spreadsheets use immutable Drive file IDs and are not duplicated as Drive CSV content.
- Google Meet
- Conference timing, attendance sessions, recording metadata, and structured transcript entries when available. Recording bytes are not downloaded, and Google retains structured transcript entries for only 30 days after a conference ends.
- Installation operations
- Marketplace licensing state, approved scopes, immutable customer routing, synchronization state, and non-sensitive lifecycle audit records.
4. Exact read-only scope contract
Marketplace licensing uses appsmarketplace.license through Seedling's operational licensing client. Google identity sign-in uses only openid, email, and profile. Neither channel is added to delegated Workspace data tokens.
- admin.directory.user.readonly — enumerate users and read user metadata.
- admin.directory.group.readonly — enumerate Directory groups.
- admin.directory.group.member.readonly — enumerate direct group membership.
- calendar.readonly — read calendars and events.
- gmail.readonly — read Gmail messages, threads, labels, and history.
- drive.readonly — read Drive files, content, permissions, comments, and changes.
- meetings.space.readonly — read conference records, participants, attendance sessions, artifact metadata, and structured transcript entries visible to the delegated user.
5. Security and access
- The Seedling workspace is the tenant boundary; Google content and synchronization state stay in that workspace's tenant data plane.
- Marketplace tokens are minted only when needed through keyless Google Cloud IAM signing. Seedling stores no Marketplace private key.
- Every delegated token is short-lived, bound to one subject, and limited to the exact scopes required by the adapter.
- Connected content follows Seedling roles, source entitlements, and restricted-by-default source access.
- Tokens, assertions, credentials, raw Gmail, Drive, Sheets, or Meet content, Calendar descriptions, and Google error bodies are excluded from application logs.
6. Retention and removal
Synchronized data remains while the connection is active. Disconnect, customer-wide Marketplace unlicensing, or verified removal invokes Seedling's integration purge for Directory, Gmail, Calendar, Drive, Sheets, and Meet data and derived content.
Deleted information may remain in encrypted, access-restricted backups until expiry, ordinarily within 35 days. Bounded lifecycle audit records may remain without Google credentials or raw customer content.