Supported data types

Vault supports the following G Suite services:

Service Manage retention Hold Search and export
Mail and
classic Hangouts (with history on)
checkmark checkmark checkmark
Drive (supported file types) checkmark checkmark checkmark
Groups checkmark checkmark checkmark
Hangouts Chat (with history on) checkmark checkmark checkmark

Hangouts Meet

checkmark Covered by
holds on Drive
Use Drive
search and export

Note: Drive Enterprise customers can perform eDiscovery tasks only on files in Drive. Learn more.

Email and Groups messages

Vault is fully integrated with Gmail and Google Groups. Thus when you’re searching for mail with Vault, you're actually searching your organization’s message archive. This means:

  • Messages are available in Vault as soon as they're received by Gmail or posted to a Group.
  • You can use the same familiar search operators you use with Gmail.
  • Vault indexes approximately the first 250 pages of text in a message. 

More about message indexing and search

Gmail messages with content from other sources

Gmail messages with content from other Google products

When someone uses Gmail to share Google Docs, Sheets, Slides, or Forms, Gmail inserts a link rather than attaching a copy of the file to the message. Because the original file is stored in Drive, it isn't included when you retain, hold, search, or export mail messages.

Gmail users can share links to content stored in other Google products like YouTube and Google Photos. Vault doesn't support additional Google services, so you can't retain, hold, search, or export their content.

Gmail messages with AMP content

Dynamic email messages contain markup that displays AMP content within Gmail. Other Google products can send messages that include AMP content, and users in your organization might receive dynamic mail messages from external senders.

With dynamic mail, a Gmail user can, for example:

  • View Google Docs comments as they exist the moment the user opens the notification message in Gmail.
  • Quickly post replies and resolve comments without opening the doc.
  • Perform additional web-based tasks within the message, like replying to invitations and responding to surveys.

If you look at the original source of a dynamic mail message, you'll see 3 types of similar content:

  • Plaintext (for mail clients that display only plaintext).
  • HTML (for mail clients that don't display dynamic content).
  • AMP markup. When a Gmail user opens the message, they see dynamic and interactive AMP content. The AMP markup can retrieve any updates at the time the message is opened and immediately display them to the user.

Because of the dynamic nature of these messages, the content displayed in Gmail may change as time passes. For example, a comment notification from an active Google Doc could be different each time the user reopens the same message over the course of several days.

Vault support for dynamic email messages

  • When you preview a dynamic message, Vault displays the HTML version of the message. Click Show Original to view all parts of the message, including the AMP markup.
  • When you export dynamic mail messages, all plaintext, HTML, and AMP markup is included in the export.
  • Vault preserves all HTML, plaintext, and AMP markup included in a dynamic message. Vault has no way to preserve the dynamic content that may be retrieved and displayed when the user opens a mail message.
  • Vault can search plaintext and HTML in a dynamic mail message. However, AMP markup and AMP content aren't indexed and can't be searched.

Vault can't determine whether Gmail users actually viewed dynamic content when they opened a message that includes AMP markup. Gmail won't display dynamic content when:

  • a G Suite admin disables dynamic mail for your organization.
  • users change their Gmail settings to disable dynamic mail.

In either case, AMP content is not displayed by Gmail. However, AMP markup is still included in the message source and available in Vault.

What types of content are processed for indexing?

Gmail indexes most text-based file types that are directly attached to a message. This includes files types with extensions like .pdf, .xslx, and .docx.These attachments are included when you search and export mail messages, and they are covered by mail retention rules and holds.

Video, audio, image, and binary files included in or attached to messages aren't indexed.

Do search results displayed in Vault contain only the first megabyte of data?

No. Although approximately the first megabyte is indexed and searched, if there's a match, the entire email and any attachments display in Vault.

Does Vault retain, hold, and search all Groups messages?

Vault can hold, retain, and search messages in groups that have archiving is turned on. However, group owners can turn archiving on or off for their groups. If a group owner turns archiving off, the messages from that group are still available in user mailboxes.

How does Vault handle draft email messages?

When you search and export mail messages, your results may include draft messages. A user's Gmail data can include three types of draft messages:

  • Unsent messages in the Drafts folder—these messages are subject to holds and retention rules. 
  • Discarded drafts—a message that a user deletes without sending is immediately expunged regardless of any holds or retention rules.
  • Automatically saved versions of draft messages—as a user composes a message, Gmail automatically saves a version whenever the user pauses for a few seconds. Only the most recent version of a draft message is visible to the user. However, earlier versions are available for Vault to search and export. These versions remain available to Vault even after the user sends the message. Each version of a draft message is expunged 30 days after Gmail saved it. Versions aren't subject to holds and retention rules.

You can check the Exclude drafts box on new or existing retention rules to remove unsent messages in users' draft folders from retention coverage.

You can also remove draft messages from search results and exports:

  • Check the Exclude drafts box before you search.
    • Previews will include automatically saved versions of draft messages. However, other types of drafts are excluded.
    • All types of draft messages are excluded when you export.
  • Add -(label:^deleted AND label:drafts) to your search terms:
    • Previews will include unsent messages in your Drafts folder and automatically saved versions of draft messages. However, discarded drafts are excluded.
    • All automatically saved draft messages and discarded draft messages are excluded when you export. Unsent messages in the Drafts folder are included with the export.
How does Vault handle Gmail confidential mode messages?

Gmail confidential mode lets users restrict recipients' access to sensitive email content. This feature is available to all personal Gmail accounts and to G Suite domains that have enabled the feature.

When a user sends a confidential message, Gmail replaces the message body and attachments with a link. Only the subject and body containing the link are sent via SMTP. Learn more about how to send messages with Gmail confidential mode.

Confidential mode messages sent by users in your domain

If your organization enables Gmail confidential mode, Vault can hold, retain, search, and export all confidential mode messages sent by users in your organization.

Confidential messages sent after November 30, 2018 are visible to Vault in the mailboxes of all internal senders and recipients. Messages are always available to Vault, even when the sender sets an expiration date or revokes recipients' access to confidential mode messages.

Confidential mode messages received from outside your domain 

Even if your domain declines to enable Gmail confidential mode, your users might receive confidential mode messages from other G Suite customers and from personal Gmail accounts.

Confidential mode messages sent from external parties are owned by their senders and are hidden from Vault. You can hold, retain, search and export message headers and subjects of external confidential messages. However, you can't search or export message content or attachments from external confidential messages

Note: G Suite administrators can create a compliance rule that blocks incoming confidential mode messages from being delivered to your domain.

Working with confidential mode messages

Vault supports confidential mode messages as follows:

  • Vault returns internal confidential messages that match your search query. You have the option to hide confidential message content when you preview and to exclude confidential message content when you print or export messages.
  • You can use label:confidentialmode to search for confidential messages. You can also use this label to apply holds and custom retention rules specifically to confidential messages.

Classic Hangouts and Google Talk

Important: Beginning in October 2019, classic Hangouts will be retired for all G Suite customers. Vault admins must take action to prepare for this transition.

Vault fully supports chats that occur within classic Hangouts and Google Talk. You can retain, search for, and place holds on:

  • Classic Hangouts with history turned on. G Suite administrators can control whether history is on or off, or they can allow users to decide. For details, see Chat history. Vault archives all chats that occur in Gmail, Google+, and mobile apps when history is on.
  • Google Talk chats that are on the record. G Suite administrators cannot force chats to be on the record. They can, however, disable chat history for a domain.
Note: Vault fully supports Hangouts that occur after this feature was launched. For Hangouts that took place before April 8, 2015, only on-the-record chats can be searched, exported, and placed on hold.

Classic Hangouts information available to Vault includes:

  • All users who participated in the chat.
  • All messages that were exchanged during the chat, plus links to any attachments.
  • Names of group Hangouts. (Participants have the option of naming a group Hangout.) Chats between two users cannot be named.
  • The time the chat started and ended.

The following aren't available to Vault:

  • Unaccepted invitations to chat. If a user does not participate in a chat, messages sent to that user are not preserved.
  • Video calls.
  • Chats that occur within Google Docs.
  • Images sent through classic Hangouts.

How classic Hangouts are archived

Vault groups all classic Hangouts messages into a single thread. Messages are continuously added to the thread until:

  • three hours have elapsed since the last chat message was sent.
  • the thread exceeds 1,000 messages.

When you export a classic Hangouts message, the entire thread is included when you download the export file.

Enable support for classic Hangouts

For full support of history-on Hangouts:

  • Turn on classic Hangouts for your domain.
  • Verify Gmail is enabled for all classic Hangouts users. Classic Hangouts messages are stored in the same system that stores email messages for Gmail. Vault can't hold or retain classic Hangouts messages sent or received by accounts that have Gmail disabled. Classic Hangouts messages sent before Gmail is enabled can't be recovered.

Drive

You can use Vault to retain, hold, and search for files in your organization's Drives and Team Drives. Vault supports Google file types and non-Google file types such, as PDF, DOCX, and JPG.

Important information about Drive and retention

File types included in Vault support for Drive
Vault can hold, retain, search, and export the following files stored in Drive:
  • Google Docs, Sheets, Slides, Forms, and Drawings
  • Hangouts Meet recordings
  • Jamboard files that have been saved to users' Drives
  • Non-Google files that users have uploaded to Drive 

Retention coverage varies depending on the type of rule

Retention rules apply to files owned by and directly shared with users in the organizational unit to which the policy applies. This includes files in a Team Drive that are directly shared with a user, regardless of whether that user is a member of that Team Drive.

If Include Team Drives is checked, retention rules also apply to Team Drives that include members of the covered organizational unit.

When retention coverage expires, only files owned by those users are expunged

Retention rules retain all applicable files in a user’s Drive (including Team Drive files, if the rule was set up to include them). This includes files owned by or shared with users in the applicable organizational unit. However, when the retention coverage period expires, Vault expunges only the files owned by users of that organizational unit. Files shared from outside the organizational unit are never expunged.

Team Drives and retention

When you apply a custom retention rule to Team Drives:

  • A custom rule that covers All Team Drives affects retention coverage for all Team Drives in your domain.
  • A custom rule that covers specific Team Drives affects retention coverage only in the selected Team Drives.

Team Drive files can only be expunged by Team Drive-specific retention rules:

  • Retention rules retain all applicable files in a user’s Drive (including Team Drive files, if the rule was setup to include them). However, as Team Drive files are owned by the team and not by any specific user, only retention rules specific to Team Drive can expunge files in a Team Drive.
  • Rules that apply to users and have include Team Drives checked can only extend the lifecycle of Team Drive files.
The implementation of retention rules and the expiration of files in Drive can be subject to delays
  • When you create or update a retention rule, it can take up to three hours for the rule to propagate. Files deleted by users during this propagation period are not retained and cannot be retrieved.
  • When a retention coverage period expires, it can take up to 15 days for affected files to be removed from Drive.
Retention rules and holds apply only to files created by users in your domain

Files created outside your domain and shared with your users are not subject to your organization’s holds or retention policies.

Vault won’t let you create Drive retention rules with identical retention criteria

Each custom retention rule you create for files in Drive must: 

  • Have a unique last-modified or created date.
    OR
  • Apply to a unique set of users.

As an example, a conflict could occur if you have a rule that applies to an organizational unit, then you try to add a rule that applies to a Team Drive that all members of the organizational unit have access to. Vault rejects the new rule if it has the same created/last-modified date.

Additionally, you can use the Include Team Drives setting to make a retention rule unique. There’s no conflict for two rules with identical retention criteria if one rule includes Team Drives, and the other does not.

Files subject to multiple retention rules are always preserved according to the rule with the longest retention period.​

Manage retention for apps that store data in Drive

Some Google Apps store their data in Drive. Because these apps can be adversely affected by unexpected data deletion, they may be excluded from Drive retention rules. Vault supports the following apps:

Product Retention  Notes
Jamboard Covered by Drive rules

Vault only retains jams that have been saved to users' Drives. Unsaved jams are discarded when the Jamboard session ends and are unavailable to Vault.

Hangouts Meet Excluded by default You can enable retention for Hangouts Meet.
Retention rules and files in trash

You can set custom retention rules that expunge files a set number of days after users move them to trash. Only files moved to trash on or after August 1, 2016 are subject to moved-to-trash rules:

  • A moved-to-trash rule applies to both files that are in a user's trash and to files that were deleted when the user emptied trash.
  • A moved-to-trash rule only expunges files owned by the user or Team Drive to which it applies.
  • If a file in trash is subject to multiple retention rules, a moved-to-trash rule supersedes all other retention rules. If multiple moved-to-trash rules apply to a file, the file is retained according to the rule with the longest duration. Holds still take precedence over all retention rules.
  • Team Drive files that aren't subject to a hold or retention rule are permanently deleted from all Google systems approximately 30 days after they're moved to trash.
Retention rules don't extend coverage to files that are embedded in documents and presentations

Users can link a Google file  to another Google file. For example, someone writing in a Google Doc can create a chart that's linked to data contained in a Google Sheet. Whenever the spreadsheet is updated, the chart in the document is also updated.

In the example above, if a retention rule preserves the document, and no retention rules or holds preserve the spreadsheet, the spreadsheet could be expunged even though the document is retained.

Important information about Drive and holds

Coverage varies depending on how you configure the hold
  • A hold on Drive applies to files owned by and directly shared with the users or organizations covered by the hold. This includes files in a Team Drive that are directly shared with a user, regardless of whether the user is a member of that Team Drive.
  • If you apply a hold to Team Drives, it also applies to Team Drives where held users are members.
  • You can't place a Team Drive on hold. Instead you must place its members on hold and check the Include Team Drives box.
How does Team Drive affect a hold?
Files in a Team Drive aren't preserved by a hold if:
  • a Team Drive member:
    • moves a file out of a Team Drive, and that member isn't on hold.
    • removes a member that's currently on hold from the Team Drive, and there are no other Team Drive members on hold.
  • no Team Drive member is on hold.

 

Important information about Drive and search

How does Vault search for files in Drive?

Vault searches Drive for all files owned by and directly shared with the users specified in your search entry. This includes files in a Team Drive that are directly shared with a user, regardless of whether the user is a member of that Team Drive.

Vault also searches:

  • All files owned by and directly shared with the users specified in your search query.
  • Team Drives in your organization that have been shared directly with users in your query.
  • Files in Team Drives that have been shared directly with users in your query.
  • Files in external Team Drives that have been shared directly with users in your query. Note that Vault can't search an externally owned Team Drive that has been shared with users in your organization, even if it includes files that are shared directly with those users.
Can I search Team Drives?

Yes, when you search for files in Drive, you have two options:

  • When you're searching for files belonging to specific users or organizational units, you can check a box to include results from their associated Team Drives in your search.
  • You can use Vault to find Team Drives. You can then search selected Team Drives for files.
Which part of files in Drive are searchable?

You can search for words and phrases that occur in file names and in the contents of files. Vault indexes the first 100 pages of text files and the first 10 pages of text in image PDFs.

You can search text within the following file types:

Note: G Suite for Government customers cannot search the contents of files. However, they can search file names and other file properties.

Vault doesn't index video, audio, image, or binary files.

What file types can I preview with Vault for Drive?

You can preview these files:

  • Google files such as Docs, Sheets, Slides, and Drawings
  • User-uploaded files such as .docx, .pdf, and .xlsx
Linked files may not be included when you search and export files in Drive

Users can link a Google file  to another Google file. For example, someone writing in a Google Doc can create a chart that's linked to data contained in a Google Sheet. Whenever the spreadsheet is updated, the chart in the document is also updated.

When you search files in Drive, Vault returns only the files that match your search criteria. If those files include linked files that fall outside of your query, the linked files aren't included in your results.

Can I search within the revision history of a document?

No. Currently you can search only the most recent version of a file. However, you can enter a version date during search. This retrieves a snapshot of each file that shows changes made as of the end of the day on the given date. Versioning is supported only in Google Docs, Sheets, and Slides, and Drawings.
A file's version history doesn't include changes to:

  • the title
  • who it was shared with
  • comments (only the most recent version of unresolved comments is included)
Can Vault search Google Drive for my entire domain?

Vault can search up to 5,000 users (individual users or members of organizational units).

Hangouts Chat

You can use Vault to retain, hold, and search messages sent using Hangouts Chat. 

Important information about Hangouts Chat and retention

Retention rules and holds apply to DMs only when history is on

Retention rules and holds always apply to rooms. However, they apply to DMs only when history is turned on. A G Suite admin can control whether history is on or off, or they can allow users to decide.

Retention coverage varies depending on the type of rule
  • The default retention rule applies to all DMs and all rooms.
  • A custom retention rule applied to an organizational unit only covers DMs. Rooms aren't covered.
  • A custom retention rule applied to all rooms only covers rooms. DMs aren't covered.
Direct messages and conversations in rooms are owned by all participants
A DM is owned by both participants in a chat.  A conversation in a room is owned by all participants in the conversation. When participants are covered by different retention policies, Vault retains messages based on the rule with the longest duration.

When a retention period expires, Vault expunges all covered Hangouts Chats

A retention rule that removes messages will expunge all messages when the retention period expires. There is no option to set retention rules that only expunge messages deleted by users.

Important information about Hangouts Chat and holds

Retention rules and holds apply to DMs only when history is on

Retention rules and holds always apply to rooms. However, they apply to DMs only when history is turned on. A G Suite admin can control whether history is on or off, or they can allow users to decide.

A hold preserves conversations in rooms only if a held user sent a message

A hold applied to a user covers only conversations in which that user sent at least one message. Conversations in a room where the user wasn't an active participant aren't included in the hold, even though that user may have viewed messages.
Direct messages (DMs) sent to a user on hold are included in the hold even if the user doesn't reply.

You can't place an entire room on hold

Rooms in Hangouts Chat can't be restricted to an individual organizational unit, meaning anyone in your domain can be invited to any room. Vault won't hold messages sent by room participants who aren't covered by a hold. 
Messages on hold are visible to users

When you create a hold, messages covered by the hold will remain visible to the user, even if a retention rule should have removed the messages from that user's view.

Important information about Hangouts Chat and search

Files shared with Hangouts Chat users may be stored in Drive

When someone uses Hangouts Chat to share Google Docs, Sheets, Slides, or Forms, Hangouts Chat inserts a link rather than attaching a copy of the file to the message. Because the original file is stored in Drive, it isn't included when you retain, hold, search, or export chat messages.

For non-Google files that are directly attached to a chat message, Vault indexes most text-based file types (for example, files with .pdf, .xslx, and .docx extensions). These attachments are included when you search and export chat messages, and they are covered by chat retention rules and holds.

Vault can preview a maximum of 1000 messages per conversation

While Vault can export as many messages as your search will yield, previews are limited to 1000 messages. If you want to preview a large number of messages, use search terms and other criteria to reduce the results to smaller groups of messages.

Vault retrieves a conversation only if a searched participant sends at least one message
Vault returns only DMs and conversations where a participant has sent at least one message. Conversations where a participant may have viewed messages but didn't respond aren't included in search results.
Held data searches don't include rooms unless a user on hold sends a message
When you search held data in a matter, Vault returns a conversation from a room only if a user on hold sent at least one message.
Only conversations in rooms and DMs sent with history on are searchable

Conversations in rooms are always searchable in Vault. However, Vault can search only DMs that were sent with history tuned on. A G Suite admin can control whether history is on or off, or they can allow users to decide.

Was this article helpful?
How can we improve it?