Archivar el correo electrónico con Google Vault: ¿es una buena idea?

Google Workspace, which was known as Google G-Suite until October 2020, is a communication and collaboration environment that facilitates digital collaboration in many different ways. In many scenarios, however, Google Vault (Workspace’s native data management tool) fails to meet compliance requirements of a professional email archiving system. Therefore, it can make sense for your company to use a third-party archiving solution in combination with Google Workspace.

Why Do Emails Need to Be Archived?

In many companies, emails are the medium of choice when it comes to transmitting business data and information. A company’s email inventory will therefore include large amounts of critical information such as contracts, invoices, personnel data, and purchase orders – all of which need to be properly retained.

Depending on the country and industry sector, different legal requirements can apply when emails are processed and the data they contain stored over long periods of time so that they are permanently available. This applies particularly to heavily regulated sectors such as healthcare and the financial industry, as well as to government institutions and educational establishments in which sensitive personal data are often sent and received by email.

Failure to comply with the laws on email archiving can have serious consequences: for instance, a breach of archiving duties can result in fines and other sanctions and, in certain circumstances, even litigation under civil law. And another example: in the event of litigation where emails are used as evidence, or where data subjects are asserting their rights under the EU’s General Data Protection Regulation (GDPR), your company may need to search through its entire inventory of emails quickly and efficiently. This is much easier with the help of a professionally managed email archive.

Email Archiving and IT Strategy

In light of increasingly severe privacy legislation (e.g. the  CPA in California, HIPAA, and FERPA in the USA) and compliance regulations, together with the enduring popularity of electronic correspondence, every company should be proactive in its approach to email archiving. Professional archiving of business-relevant emails is not just the cornerstone of an overarching email management concept; it should be part-and-parcel of any IT strategy. Ultimately with archiving you can make sure that all your emails, including any file attachments, are retained fully in a tamper-proof manner so that they are available at all times.

Isn’t It enough to Back Up emails?

Email archiving and email backups are important instruments in the context of business continuity, but they are not mutually exclusive. As a rule, backups serve to protect data (ideally, including the email archive itself) in the medium to short term so that this information can be restored as required. They ensure that business-critical systems and data can be accessed even in the event of system failure or a ransomware attack. In contrast, archiving enables emails to be stored for many years in a form that is faithful to the original, easy to find, and permanently available.

How Does Email Archiving With Google Vault Work?

Google Workspace offers its users Google Vault, a software tool for information management and eDiscovery. Therefore, Workspace users with a valid Vault license (see below) can store large amounts of data for any length of time, including not only emails, but also files from other Workspace programs such as Google Drive, Chat, Groups, and Meet.

Who Can Use Google Vault?

Google Vault licenses for every company employee are included in the “Business Plus” and “Essentials” Workspace packages, as well as in the “Enterprise” and “Education” versions. However, if you have opted for the more affordable “Frontline”, “Business Starter” and “Business Standard” plans, you will need to purchase Vault user licenses on a monthly basis for every employee whose emails are to be archived.

With Google Vault, all the data you generate and process within your workspace can be clustered by subject, arranged into hierarchies, and visualized and exported. Administrators with the appropriate authorization can search stored data by user account, organizational unit, date, or according to certain keywords.

Authorized users can use Google Vault to view history logs, assign privileges, and manage user accounts. This can be helpful in the event of investigations, audits, and litigation where you may need to quickly access critical information held in the archive. Our white paper entitled “The Benefits of an Independent Email Archiving Solution for Users of Google Workspace” gives you detailed information on everything you need to look out for, including the role played by “holds”, and the risks that can arise if you omit to define retention rules.

What Are Google Vault’s Limitations in Terms of Email Archiving?

With Google Vault, your company can store emails and file attachments over long periods of time. According to Google, once you consent to the addendum on data processing and accept the standard contractual clauses for Google Workspace and Cloud Identity, you will meet the adequacy and security requirements defined under the EU’s GDPR. And in US geographic locations, once you accept Google’s amendment agreement for business partners, you will be “HIPAA-compliant”.

That being said, it is difficult to generalize as to whether Google Vault can meet your requirements in terms of retention and usability due to the inherent weaknesses and vulnerabilities of the solution. These include, for example, limited export functions and the risk of data loss if users or licenses are deleted. In our white paper we look at what is behind these issues and analyze some of the other vulnerabilities you may encounter.

Conclusion

Email archiving is a key component of a company’s IT strategy and information management policy. Google Vault, Workspace’s native tool for managing data and information, can be a valuable aid in this context. It does, however, come with certain vulnerabilities that can give rise to compliance and legislative issues, and you might be better off choosing independent, third-party software that has email archiving as its specialty.

Should you require comprehensive, detailed information on the drawbacks you can expect to encounter with Google Vault, and in which areas Google Workspace users could benefit from third-party software, we recommend our white paper “The Benefits of an Independent Email Archiving Solution for Users of Google Workspace”. The paper also describes the requirements you should place on your email archiving solution and what you need to consider regarding Google’s standard contractual clauses in the context of the GDPR. The white paper contains a checklist that can help you find a provider that best fits your company’s situation.