Google Vault retention rules and holds
Google Vault is Workspace's built-in tool for keeping, preserving and exporting data. Set up well, it is how a Workspace organization meets a records schedule and answers a litigation hold. Set up badly, it quietly deletes data you were supposed to keep.
Reviewed by the ITRS security team · Last updated
What Vault covers
Vault applies retention rules and holds to data in supported Workspace services, including Gmail, Google Drive (including shared drives), Google Chat, Google Meet recordings, Google Groups, Google Sites and, more recently, the Gemini app. Coverage depends on your Workspace edition; Vault is included in some editions and available as an add-on in others. Google's Vault Help Center lists the current services and what is retained for each.
Vault is a retention and eDiscovery tool, not a backup. It preserves items so they can be searched and exported; it does not restore a user's mailbox or Drive to an earlier state.
Default and custom retention rules
A default retention rule applies to a whole service for the entire organization, for example "keep all Gmail for 7 years". A custom retention rule targets an organizational unit, a shared drive, or content matching search terms, for example "keep the Finance OU's Drive files for 10 years".
Google states that custom rules take precedence over default rules, even when the default rule would keep data longer. That surprises people: a short custom rule for one OU can cause data to be deleted earlier than the organization-wide default. Map rules to your retention schedule on paper first, then configure.
| Item | Default rule | Custom rule |
|---|---|---|
Scope | Whole service, whole organization | An OU, a shared drive, or a search query |
Use | Organization-wide minimum retention | Longer or shorter periods for specific teams or record types |
Precedence | Applies when no custom rule does | Overrides the default for matching data |
End of period | Keep indefinitely or purge after the period | Same choice per rule |
Holds for litigation and investigations
A hold preserves data for specific accounts, OUs or search terms indefinitely, until you release it. Google is explicit that holds take precedence over retention rules: data under a hold is not purged by a rule, and once the hold is removed, the data becomes subject to retention rules again, which can mean immediate deletion if the rule period has passed.
Holds are created inside a matter. A matter groups the holds, searches and exports for one case or investigation, and gives you a record of who did what. The Sedona Canada Principles expect parties to take reasonable steps to preserve relevant electronically stored information once litigation is reasonably anticipated; a documented Vault hold is one of those steps.
Create a matter
Name it for the case or investigation; restrict access to the people who need it.
Identify custodians
List accounts, shared drives and groups likely to hold relevant data.
Place holds per service
Gmail, Drive, Chat and others each need their own hold.
Confirm and document
Record the date, scope and person who placed each hold.
Review periodically
Add new custodians as the matter develops; release holds only on counsel's instruction.
Search and export
Searches in a matter can be filtered by account, date and terms, and exported for review. Exports include metadata that helps with authentication later. Keep the export files and the export reports together, and record any hash values or checksums supplied with the export (or generate your own on receipt), so you can show the export was not altered.
For contentious matters, consider having the collection done by someone who can later explain it in an affidavit or as a witness. How data was collected matters as much as what was collected.
Departing users and Vault
This is where most Workspace organizations lose data. Vault protects data only while it remains associated with an account that has Vault coverage. Google's guidance is that if a former employee's account keeps a Vault licence, or is moved to an Archived User licence that includes Vault, their data stays protected by retention rules and holds.
Before deleting any departing user, check for holds, confirm what your retention rules require, and either archive the account with a suitable licence or export the data you must keep. Transferring Drive ownership to a manager is useful for continuity but is not the same as preservation.
Pitfalls
- A short custom rule overriding a longer default rule without anyone noticing.
- Releasing a hold and having data purged immediately by an expired rule.
- Deleting leavers' accounts to save licences, removing their data from Vault.
- Too many people with Vault admin rights; Vault access lets someone read everyone's mail. Limit it and review the Vault audit log.
- No written link between Vault settings and the records retention schedule.
- Confirm legal preservation obligations for your matter with counsel; this page describes the tool, not your duties.
Questions we hear
No. It preserves and exports data under rules and holds. If you need point-in-time restores of mailboxes or Drive, you need a separate backup product.
They can delete it from their view, but Vault keeps it and it remains searchable in the matter until the hold is released.
As few people as possible, usually a records or legal lead and one IT administrator, with Vault's own audit log reviewed.
Related reading.
- PracticeLegal TechnologyeDiscovery and forensic collection for counsel, expert-ready reports and legal-tech advisory for firms.
- ServiceLitigation holds and preservationPreservation comes before collection. We help counsel and clients scope a hold, apply it technically in Microsoft 365 and Google Workspace, notify custodians, and avoid…
- ServiceeDiscovery and defensible collectionProportionate, documented collection of email, chat, files and phone data for small and mid-sized matters, done so that how it was gathered never becomes the argument.
- GuideBuilding a records retention scheduleKeeping everything forever feels safe until a breach exposes ten years of client files, or a litigation hold has to search all of it.
- ServiceGoogle Workspace management and securityNot every business runs on Microsoft. For organizations that live in Gmail, Drive and Meet, we provide the same managed administration and security we deliver for…
Acting on a matter that turns on electronic evidence?
Tell us who you act for and what is at issue. We are staffed 24/7. Active incident? Call (289) 582-9930, 24/7.