1. Overview
The Granola integration imports meeting notes that have both an AI-generated summary and a transcript. Folders are synchronized as relationship context; the projected source object is the meeting note.
Seedling initially requests up to 365 days of eligible notes and then polls for updates with a bounded overlap. The lookback is a collection horizon, not a retention limit or deletion promise.
2. Connection and scope
Seedling verifies the provider account before storing the connection. A personal connection remains actor-owned; a workspace connection is administered for the selected Seedling workspace. Credentials are never inferred from an email address or silently promoted between scopes.
- Personal API key
- Imports eligible notes visible to the connecting member. Raw content remains owner-only in Seedling human-facing surfaces.
- Workspace API key
- Imports eligible public and API-enabled-space notes visible to that key. Granola does not expose complete per-note ACLs, so raw workspace-key content remains system-only.
3. Granola data Seedling accesses
Seedling uses synchronized information for source-backed search, operating context, verification, and customer-approved workflows. Availability depends on the connected account, selected resources, provider plan, and native permissions.
- Meeting notes
- Stable note identity, title, participants and speakers when available, dates, summary, transcript, and update state.
- Folder context
- Folder identity and hierarchy used as relationship context; folders are not treated as authoritative access-control lists.
- Eligibility state
- Only notes with both a generated summary and transcript are returned by the current API population. Processing or unsummarized notes remain outside it.
4. Read-only permission contract
Granola API keys do not return a granular scope list. Access is determined by key ownership, plan availability, note eligibility, and the population visible to that key.
- Personal key — eligible notes visible to the key owner.
- Workspace key — eligible notes in public and API-enabled spaces visible to the workspace key.
- Seedling makes read requests only and does not create, edit, share, trash, or permanently delete Granola notes.
5. Security and access
- Provider credentials and other connection secrets are encrypted in the workspace tenant data plane, never returned to the browser, and excluded from logs and queue payloads.
- Every source, synchronization, secret lookup, audience contribution, disconnect, and purge remains bound to the exact connection that created it.
- Personal-connection raw content remains visible only to the connecting member in human-facing Seedling surfaces.
- Workspace-key records have no raw human audience because Granola does not expose authoritative per-note ACLs. Eligible content may inform trusted exploration, but member-facing DeepWiki content requires deterministic sanitization and explicit steward publication.
- Generated output cannot bypass Seedling's human review, verification, and approval gates.
6. Retention and deletion
- Connected data
- Synchronized Granola records remain while the connection is active and are removed through a durable integration purge after disconnect.
- Credentials
- Stored Granola credentials or connection secrets and connection-owned synchronization state are deleted from active Seedling systems as part of the purge.
- Backups
- Deleted information may remain in encrypted, access-restricted backups until expiry, ordinarily within 35 days after active-system deletion.