Trello integration

2. Connection and scope

Seedling verifies the provider account before storing the workspace connection. A current Seedling workspace administrator controls installation and disconnect; account identity is never inferred from an email address or display name.

Trello API key and user token

Generate both values from a dedicated account that can read the intended workspaces and private boards.

Connection ownership

This connector is workspace-only. A current Seedling workspace administrator controls installation, credential replacement, disconnect, and purge for the exact connection.

3. Trello data Seedling accesses

Seedling uses synchronized information for source-backed search, operating context, verification, and customer-approved workflows. Availability depends on the connected account, selected resources, provider plan, and native permissions.

Work structure

Workspaces, boards, lists, labels, custom fields, memberships, and board settings.

Cards

Cards, descriptions, dates, members, checklists, attachments, and relationships.

Activity

Comments and other authorized card or board actions returned by Trello.

4. Read-only permission contract

Generate the Trello user token with the narrow released token scopes.

• read — read workspaces, boards, lists, cards, checklists, attachments, members, and actions visible to the token owner.
• account — verify the token owner identity and email only when needed by the setup.
• Optional workspace and board allowlists further narrow the token-visible population.
• No write permission is requested; Seedling does not create, update, move, archive, comment on, or delete Trello records.

5. Security and access

• Provider credentials and other connection secrets are encrypted in the workspace tenant data plane, never returned to the browser, and excluded from logs and queue payloads.
• Every source, synchronization, secret lookup, audience contribution, disconnect, and purge remains bound to the exact connection that created it.
• The provider does not expose enough complete object-level audience evidence for Seedling to reproduce native permissions safely. Workspace content therefore uses the connection's restricted-by-default workspace-or-no-human-access policy; administrator and steward status grant no raw-content bypass.
• Generated output cannot bypass Seedling's human review, verification, and approval gates.

6. Retention and deletion

Connected data

Synchronized Trello records remain while the connection is active and are removed through a durable integration purge after disconnect.

Credentials

Stored Trello credentials or connection secrets and connection-owned synchronization state are deleted from active Seedling systems as part of the purge.

Backups

Deleted information may remain in encrypted, access-restricted backups until expiry, ordinarily within 35 days after active-system deletion.

7. Installation, help, and removal