# 30 Vault retention & legal hold

> v0.1.3 · role: Recover · edition: Business Plus+ · [policy: #18 · #11 (gap G2)](https://docs.google.com/spreadsheets/d/1nOztaPd1Y7eNeRSR_hdovYy-ncpx-bAx/edit?usp=sharing&ouid=115159875779023172526&rtpof=true&sd=true)

Vault decides how long Gmail, Drive, Chat and Groups data is kept and whether a user can delete it at all. A default rule sets a retention period per service; a custom rule overrides it for an OU or shared drive; a hold on a matter overrides both — including user deletion — for as long as the hold exists. Retention is what makes data survive an attacker or a departing employee trying to destroy it, and Vault privileges are a separate admin role rather than something implicit in super admin.

Documentation: [Set up Vault for your organization](https://support.google.com/vault/answer/2584132) · [How retention works](https://support.google.com/vault/answer/2990828)

## Caveats

- A retention rule with an expire action is a data-destruction mechanism — set a duration shorter than the data you already hold and services might immediately and irreversibly purge it. Model the rule against a test OU before applying it at the root.
- Holds beat retention rules and user deletes, but they do not beat a rule you never wrote — data deleted before the hold existed is gone.
- Vault is bundled with Business Plus and higher; other editions, including Business Standard, can still get it via a paid Vault add-on license per user.
- Vault privileges are a separate admin role from super admin — granting Vault to an investigator without alerting on Vault searches (№61) is the classic who-watches-the-watchers hole.

## Setup steps

1. Open Retention > Default rules and set a default retention rule per service (Gmail, Drive, Chat, Groups) so data is retained for the records-retention period rather than indefinitely-by-accident. — `Vault › Retention › Default rules`

   - **Default rule per service** = Retain for <N> days from message/file creation
   - **post-retention action** = purge (choose purge only already-deleted items, or purge all data including undeleted items) (OU carve-outs, e.g. retain-indefinitely for crown jewels, belong in the next step's custom rules)

   docs: [Retain Gmail messages with Vault](https://support.google.com/vault/answer/2535539)

2. Add a custom rule scoped to the OU (organizational unit) / shared drive holding sensitive material where the default duration is wrong. — `Vault › Retention › Custom rules`

   - **Custom rule** = scope (OU / shared drive / term) + duration + expire action

   docs: [Retain Drive files with Vault](https://support.google.com/vault/answer/7657465)

3. Create a matter and place a hold on the accounts/OUs under legal preservation. A hold overrides retention rules and user deletion for as long as it exists. — `Vault › Matters › <matter> › Holds`

   Hold = service (Gmail/Drive/Chat) + accounts or OU; no end date

   docs: [Get started with holds in Google Vault](https://support.google.com/vault/answer/7664657) · [Create & manage matters](https://support.google.com/vault/answer/2462419)

4. Confirm the Vault privileges are a separately-granted role, not implicit in super-admin day-to-day accounts, and that Vault actions are alerted on (see [№61](audit-the-auditors.md) audit-the-auditors). — `Admin console › Account › Admin roles`

   Vault role granted to named custodians only; since November 1, 2025 each Vault admin must also hold a Vault license — the role alone no longer grants access

   docs: [Set up Vault privileges](https://support.google.com/vault/answer/2799699)

## Ongoing maintenance

- **[requires a human]** On every departure/litigation event: place or release holds per the legal process.

## How to verify

1. In Vault, read the default retention rule and any custom rules against the retention schedule, and list active holds — then search for a message older than the retention window to confirm expiry actually happens.

## Settings screens

- Google Vault > Retention
  - console: https://vault.google.com/u/0/retention
  - screenshot: ../screenshots/vault.google.com/u/0/retention.png
- Google Vault > Matters (legal hold lives inside a matter)
  - console: https://vault.google.com/u/0/matters
  - screenshot: ../screenshots/vault.google.com/u/0/matters.png