"A sales representative who resigned six months ago had supposedly exchanged emails with a client stating 'the scope of delivery ends here.' However, a discrepancy in understanding arose with the client, and when we looked for those emails as evidence, the employee's account had been deleted, leaving nothing behind." We heard this story from the executive of a construction-related business. Cloud email is convenient, but the standard behavior of "deleting an account also deletes its emails" can later strip a company of the evidence needed to protect itself.
The mechanism in Google Workspace designed to reliably preserve data you cannot afford to lose is Google Vault. Rather than simple backup, it is a tool for evidence preservation and records management that lets you establish retention rules and search and export data when required. In this article, we outline how and to what extent SMBs should utilize Vault from the dual perspectives of offboarding and legal compliance.
Backups and "retention" are different
The first point to grasp is that routine backups and the "retention" provided by Vault serve entirely different purposes. Backups exist to restore data lost due to operational accidents. Retention, on the other hand, guarantees that data cannot be deleted or altered for a designated period or until a specific legal inquiry is concluded.
Vault provides two mechanisms to achieve this retention:
- Retention rules: Define how many days data across Gmail, Drive, Chat, and other services must be kept, applied domain-wide or to specific organizational units. For example, if configured to retain emails for three years, messages remain in Vault throughout that duration even if a user empties their trash.
- Holds: Individually freeze data related to specific matters such as litigation or disputes, ensuring that data belonging to designated individuals during specific periods cannot be deleted, regardless of standard retention periods.
Whether through accidental deletion or deliberate evidence destruction, active retention rules and holds ensure target data remains under company governance. This is where it differs decisively from user-managed backups.
Preserving departing employees' emails — The Archived User concept
Vault offers a clear solution to the problem of departing employees' data vanishing, as highlighted in the opening consultation. When a departing user's account is permanently deleted, their data is deleted from Vault as well. To prevent this, assign an Archived User (AU) license to the departing employee.
An Archived User license prevents the user from signing in while keeping their data retained and searchable within Vault. Because it is priced lower than standard paid licenses, it allows you to safeguard data for the required timeframe at a much lower cost than paying full licensing fees for every past employee. Simply adding "evaluate retention needs and switch to an Archived User before deleting accounts" to your offboarding checklist will substantially reduce the risk of losing vital evidence down the road.
Relationship with the Electronic Books Preservation Act — Not a silver bullet
Vault is frequently discussed in connection with compliance with the Electronic Books Preservation Act. Under Japanese law, electronic transaction data exchanged via email—such as invoices and purchase orders—must be preserved for a statutory duration and protected against alteration. Preventing the deletion of such data using Vault's retention rules serves as one means of supporting this requirement.
However, it is vital to remember that configuring Vault does not automatically make you fully compliant with the Electronic Books Preservation Act. The act mandates detailed requirements beyond mere preservation, such as searchability by date, transaction amount, and trading partner, which cannot be satisfied solely through Vault retention. How you organize and store email attachments and receipts in Drive must be evaluated alongside operational workflows, as discussed in our article on structuring Drive for the Electronic Books Preservation Act. Do not fall into the trap of assuming legal compliance is complete simply because Vault is active.
Which plans support it, and how far should you go?
Vault is included in Business Standard and higher editions, as well as Enterprise tiers (it is not included in the lowest Business Starter plan). For companies already subscribed to Standard or above, it is a feature you can begin using at no additional cost. Even so, retaining all data indefinitely from day one is ill-advised.
| Decision point | What to evaluate |
|---|---|
| What to retain | Limit retention to what is genuinely necessary for legal and dispute compliance (transaction emails, contracts) rather than all data |
| How long to retain | Align with statutory preservation periods and internal regulations; indefinite retention burdens storage and management |
| Who can access | Restrict Vault search and export privileges to designated administrators; periodic audits are required due to the scope of these permissions |
Assuming that "longer is safer" and setting indefinite retention company-wide creates excessive noise when searching, making it harder to reach necessary evidence while driving up administrative overhead. Narrowing down what needs protection ensures it functions effectively when emergencies arise. Because Vault search and export privileges are potent, periodically reviewing permission holders against our security configuration checklist offers peace of mind.
Decide first which data you cannot afford to lose
At a company GleamHub assisted, rather than rolling Vault out company-wide immediately, we started by identifying with leadership which data would truly harm the business if lost. Consequently, we narrowed the scope from all emails to "communications regarding partner contracts and deliveries" and "accounting evidence emails," establishing retention rules only for those specific organizational units. Simultaneously, we incorporated an Archived User evaluation step into their offboarding workflow. Avoiding an all-encompassing retention scheme kept operations simple and manageable for the team.
Discovering lost employee emails or missing dispute evidence after the fact is irreversible. If you are wondering whether Vault is supported on your plan, what data to keep and for how long, how to integrate it into offboarding, or how to align it with the Electronic Books Preservation Act, feel free to contact GleamHub via our free IT and Google Workspace consultation. We will help you design a sustainable retention policy, starting by defining the critical data your business must protect.
