# An Admin's Guide to Google Vault

###### 8 Apr 2025  
###### 11 min read  
###### Swati

Article at a glance  
Google Vault is a powerful eDiscovery and archiving tool but is not designed for data backup:

- Google Vault allows for the retention, search, and export of data but lacks the ability to restore data, leaving organizations vulnerable to data loss.
- Relying on Google Vault as a backup solution is risky due to its export limitations, lack of support for certain apps, and the inability to recover data after deletion.

eDiscovery helps businesses to identify and preserve data that can be used as evidence in litigations. Data retention is used by organizations to prevent data loss due to accidental deletions. This article explores the key features of Google Vault, including how it enables eDiscovery and enforces data retention policies across Google Workspace services.

## Understanding Google Vault

**Google Vault** is a data retention, eDiscovery, and archiving solution built into **Google Workspace**. It allows administrators to **retain**, **search**, **export**, and **place legal holds** on user data across supported Google services like Gmail, Drive, Chat, Meet, and more.

Google Vault serves two main purposes:

- **Data retention & governance:** Helps organizations manage the lifecycle of data through customizable retention policies and holds, ensuring compliance with internal and regulatory standards.
- **eDiscovery:** Enables the identification, preservation, and retrieval of electronically stored information (ESI) for use in legal matters such as audits, investigations, or litigation.

### How can organizations access Google Vault?

To access Google Vault, visit [vault.google.com](https://vault.google.com/) and sign in using your Google Workspace credentials.

**Note:** Only users with the correct permissions and Vault licenses can access and use Google Vault features.

#### Google Vault is available with the following Google Workspace editions:

- Business Plus
- Enterprise (Standard and Plus)
- Education Fundamentals and Education Plus
- Frontline (as an add-on)

If you're using **Business Starter** or **Business Standard**, Vault is **not included by default** and must be purchased as an add-on.

Only **super admins** or users with specific **Vault privileges** (like managing Holds or running eDiscovery searches) can perform actions in Vault. These permissions are managed through the Admin Console.

Only users with appropriate **Vault privileges** can use it to perform actions like searching, applying holds, or managing retention rules. These permissions are typically granted by a **super administrator** through a custom admin role in the Google Admin Console.

For a full list of Vault privileges, see [Google’s support guide](https://support.google.com/vault/answer/2799699?hl=en).

### What is eDiscovery in Google Vault?

Google Vault allows users to search, hold and export data in Google Workspace. A workspace can be created in Google Vault called “Matter” to perform one or more of these actions. Matter can contain:

- Saved search queries  
- Holds  
- Accounts that the matter is shared with  
- Exports  
- Audit log of the Vault user activity in that matter

The workspace i.e., the matter can be shared among other Vault users so that they can collaborate on the same together.

#### How to create a matter in Google Vault?

To create a matter, a user can perform the following steps in Google Vault:

- **Step 1:** Navigate to the Google Vault app through the waffle iron or through [https://vault.google.com/](https://vault.google.com/)
- **Step 2:** Click on “Matters” on the homepage.
- **Step 3**: Click on “ **Create**” to create a new matter.
- **Step 4:** Enter the **“Matter name”** and **“description”** and click on **“Create.”**

#### How to perform a search in Google Vault?

Follow the steps below to search for data within a Matter in Google Vault:

- **Step 1**: Click on a **“Matter”** in which the search needs to be performed.
- **Step 2:** Choose a **“Service”** from Gmail, Drive Groups, and Chat for which the search needs to be performed.
- **Step 3:** Fill in the following details:
  
  **→** Accounts or entities  
  **→** Time zone  
  **→** Date sent  
  **→** Additional terms for search  
  
and then click on **“Search.”**

Google Vault allows us to apply a **“Hold”** on data for specific apps. When a hold is applied to data, the data cannot be purged from the Google systems indefinitely or until the Hold is removed/deleted.

Hold enables data preservation so that no evidence is lost during investigations.

#### How to place content on an eDiscovery hold?

In order to create a hold, you can follow the steps below:

- **Step 1**: Open the Matter where you want to apply the hold.
- **Step 2:** Click on the **Holds** tab.
- **Step 3:** Click on **Create Hold**.
- **Step 4:** Select the Hold name as well as the Service.
- **Step 5:** Select the **“Scope”** of the Hold, which is

**→** User accounts  
  **→** Organizational units [Learn more about Google organizational units](https://blog.syscloud.com/google-organizational-units).
  
- **Step 6:** Select the **“Conditions”** such as
  
  **→** Start date  
  **→** End date  
  **→** Query terms  
  
- **Step 7**: Click on **“Create"** to create a hold.

#### How to delete eDiscovery hold?

To delete a hold, follow the steps below:

- **Step 1**: Select Holds tab for a **“Matter”.**  
- **Step 2:** Click on **“Delete”** for a specific hold.

After a Hold is deleted, data previously protected by it will be subject to deletion based on your organization’s retention rules.

### What is retention in Google Vault?

Google Vault allows you to apply retention rules on data under Gmail, Drive (including Shared Drives), Chat, Meet, Voice, Groups, Calendar (event metadata), and classic Sites. We can choose a specific retention period or retain data indefinitely while applying a rule.

There are two types of retention rules-default and custom. For more information, [click here](https://support.google.com/vault/answer/2990828?hl=en).

Retention rules do not override Holds. If data is on Hold, it will be preserved even after the retention period ends.

#### How to create a custom retention rule?

To create custom retention rule, you can follow the steps below:

- **Step 1:** Go to the **Retention** section and click on **Create** under the **Custom rules** tab.
- **Step 2:** Select the **“Service”** on which Retention rule needs to be applied. You can choose from:
  
  **→** Gmail  
  **→** Drive (including Shared Drives)  
  **→** Groups  
  **→** Chat  
  **→** Meet  
  **→** Sites (Classic)  
  **→** Calendar (event metadata)

- **Step 3:** Select the **“Scope”** of the retention rule.  
- **Step 4:** Select the **“Duration”** as well as **“Action”** for the Retention rule. Then click **“Create”** to apply the rule.

#### How to delete a default/custom retention rule?

- **Step 1**: Select the default retention rule and click on **“Delete”**  
- **Step 2:** Select the custom retention rule tab and click on **“Delete”**

### What is the difference between retention rules and Hold?

| On the basis of   | Retention rules                   | Holds                                                        |
|------------------|-----------------------------------|-------------------------------------------------------------|
| **Use**          | Created to preserve data for operational or compliance purposes | Created in response to litigation, legal matters, or investigations |
| **Purpose**      | Define how long data is retained before deletion           | Prevent deletion of specific data for legal protection     |
| **Services covered** | Retention rules can be applied to preserve data from different apps | Holds can be applied to specific user accounts or to all accounts in an organizational unit. |

## Can data be modified or destructed when placed on an eDiscovery hold or when a retention rule is applied to it?

Data placed on hold cannot be deleted or purged out from Google system. However, in certain cases, data can be deleted or purged such as:

- Hold is deleted by the Google Vault user
- A custodian is removed from the hold
- A user's Google Account is deleted
- A user no longer has a Vault license

When a retention rule expires and the data must be purged, the data is still available to Google Vault for a period of 30 days before being fully purged from the Google systems.

Note: Vault retains deleted data only if it falls within an active Hold or retention policy. Once both are removed or expired, data is subject to permanent deletion.

### Is Google Vault a backup solution?

Google Vault is not a backup tool but an eDiscovery and archiving tool available for Google Workspace users. Due to its ability to place data on hold and apply retention rules, it can be easily mistaken as a data backup solution by many organizations.

Here are some key limitations:

- **No Restore Functionality**:

- Vault does not allow restoring deleted data back to a user account.
  - It’s designed to retain and export, not to recover.

- **Export Limitations**:

- Export limit: 10 GB per ZIP file. Larger exports are split into multiple files.
  - Occasional partial export errors may result in incomplete data exports.
  - Gmail exports are limited to PST or MBOX formats, which aren’t compatible with some review platforms.

- **Service Limitations:**

- Vault does not support Google Keep or Classroom.
  - Retention rules can be set for Calendar (metadata), but not for all content.
  - Meet (chat, recordings, Q&A) and Voice (texts, voicemails) are now supported — update accordingly.

- **Licensing Restrictions:**

- Vault is not included in Business Starter or Business Standard plans.
  - It’s available in Business Plus, Enterprise editions, or as a paid add-on.

Due to these limitations, using a third-party backup solution is essential for complete data protection.

[SysCloud](https://app3.syscloud.com/free-trial) backs up all your Google Workspace apps. It alerts you to ransomware threats in real-time. It fixes compliance gaps. You can use advanced keyword and metadata search to locate emails and files. You can restore data instantly using point-in-time backup snapshots. [Learn more](https://www.syscloud.com/google-apps-backup/) about SysCloud’s Google Workspace backup.