32 Vault retention & legal hold

Vault decides how long Gmail, Drive, Chat and Groups data is kept and whether a user can delete it at all. A default rule sets a retention period per service; a custom rule overrides it for an OU or shared drive; a hold on a matter overrides both — including user deletion — for as long as the hold exists. Retention is what makes data survive an attacker or a departing employee trying to destroy it, and Vault privileges are a separate admin role rather than something implicit in super admin.

Documentation: Set up Vault for your organization · How retention works

Caveats

Holds beat retention rules and user deletes, but they do not beat a rule you never wrote — data deleted before the hold existed is gone.
Vault is bundled with Business Plus and higher; other editions, including Business Standard, can still get it via a paid Vault add-on license per user.
Vault privileges are a separate admin role from super admin — granting Vault to an investigator without alerting on Vault searches (№63) is the classic who-watches-the-watchers hole.

Setup steps

Open Retention > Default rules and set a default retention rule per service (Gmail, Drive, Chat, Groups) so data is retained for the records-retention period rather than indefinitely-by-accident.

Vault › Retention › Default rules

Default rule per service

Retain for <N> days from message/file creation

post-retention action

purge (choose purge only already-deleted items, or purge all data including undeleted items) (OU carve-outs, e.g. retain-indefinitely for crown jewels, belong in the next step's custom rules)

A retention rule with an expire action is a data-destruction mechanism — set a duration shorter than the data you already hold and services might immediately and irreversibly purge it. Model the rule against a test OU before applying it at the root.

Retain Gmail messages with Vault
Add a custom rule scoped to the OU (organizational unit) / shared drive holding sensitive material where the default duration is wrong.

open ↗

https://vault.google.com/u/0/retention · captured 2026-07-15

Vault › Retention › Custom rules

Custom rule

scope (OU / shared drive / term) + duration + expire action

Retain Drive files with Vault
Create a matter and place a hold on the accounts/OUs under legal preservation. A hold overrides retention rules and user deletion for as long as it exists.

Vault › Matters › <matter> › Holds

Hold = service (Gmail/Drive/Chat) + accounts or OU; no end date

Get started with holds in Google Vault Create & manage matters
Confirm the Vault privileges are a separately-granted role, not implicit in super-admin day-to-day accounts, and that Vault actions are alerted on (see №63 audit-the-auditors).

Admin console › Account › Admin roles

Vault role granted to named custodians only; since November 1, 2025 each Vault admin must also hold a Vault license — the role alone no longer grants access

Set up Vault privileges

Ongoing maintenance

requires a human On every departure/litigation event: place or release holds per the legal process.

How to verify

In Vault, read the default retention rule and any custom rules against the retention schedule, and list active holds — then search for a message older than the retention window to confirm expiry actually happens.

Further screens

Admin console screen — Google Vault > Matters (legal hold lives inside a matter) — https://vault.google.com/u/0/matters captured 2026-07-15

v0.1.3 Recover edition Business Plus+ policy #18 · #11 (gap G2) ↗