Supported services & data types

Messages are available to Vault as soon as Gmail receives them.

For message filtering in retention rules, holds, and search, Gmail indexes approximately 1 MB total per message. One MB is equivalent to approximately 250 pages of text. If the message text is less than 1 MB and the message has attachments, the attachments are indexed until 1 MB total data is indexed.

Only indexed data is searchable in Vault, but the entire message and all associated items, including hyperlinked Drive files (if selected), are included in a Vault export.

Gmail indexes the following data:

• Message text—Up to approximately 250 pages.
• Text-based files directly attached to a message—Most text-based files, such as PDF, XLSX, and DOCX, that are directly attached to a message, can be indexed. These attachments are covered by retention rules and holds. Text-based file attachments are searchable (if indexed), returned in search results, and included in exports.
• Other files directly attached to or embedded in a message—For video, audio, image, and binary files included in or attached to messages, file metadata such as file name is indexed, but file contents aren't.

Vault supports files directly attached to or embedded in a message. Video, audio, image, and binary files embedded in or attached to messages are covered by retention rules and holds. They're returned in search results and included in exports.

Users can send email messages with some core services besides Gmail. For example:

• Calendar—Outgoing invitations and messages sent with the Email guests option in Calendar
• Drive—Message content sent when users share files in Drive
• Google Docs, Sheets, Slides, and Drawings—Messages sent by the app when users email files as attachments
• Forms—Email messages containing forms or links to forms
• Keep—Email messages sent when users share notes in Keep

When users send messages through core services other than Gmail, outgoing messages aren't stored in users' Gmail sent folders by default. Unless a Google Workspace administrator sets up comprehensive message storage, which saves these messages in users' sent folders, Vault doesn't have access to these messages. Without comprehensive message storage, Vault retention rules and holds don't apply to these messages, and these messages aren't returned in a Vault search.

Note: Comprehensive mail storage applies only to core Google Workspace services. Some additional Google services can send email messages for users. Messages sent by those services might not be stored in the users' sent folder and might be unavailable to Vault.

Dynamic email messages contain markup that displays AMP content within Gmail. Other Google products can send messages that include Accelerated Mobile Pages (AMP) content, and users in your organization might receive dynamic email messages from external senders.

With dynamic email, a Gmail user can, for example:

• Review Google Docs comments as they exist the moment the user opens the notification message in Gmail.
• Reply to and resolve comments without opening the doc.
• Reply to Calendar invitations and respond to surveys.

The original source of a dynamic email message contains 3 types of similar content:

• Plaintext (for email clients that display only plaintext).
• HTML (for email clients that don't display dynamic content).
• AMP markup When a Gmail user opens the message, they get the dynamic and interactive AMP content. The AMP markup can retrieve any updates at the time the message is opened and immediately display them to the user.

Because of the dynamic nature of these messages, the content displayed in Gmail can change over time. For example, a comment notification from an active Google Doc can be different each time the user reopens the same message over several days.

Vault support for dynamic email messages

• Retention and holds—Vault retention rules and holds preserve the HTML, plaintext, and AMP markup included in a dynamic email message. Vault has no way to preserve the dynamic content that may be retrieved and displayed when the user opens a dynamic email message.
• Search—Vault can search plaintext and HTML in a dynamic email message. However, AMP markup and AMP content aren't indexed and can't be searched.
• Preview—When you preview a dynamic email message, Vault displays the HTML version of the message. Click Show Original to view all parts of the message including the AMP markup.
• Export—When you export dynamic email messages, all plaintext, HTML, and AMP markup is included in the export.

Vault can't determine whether Gmail users actually got dynamic content when they opened a message that includes AMP markup. Gmail doesn't display dynamic content in the following scenarios:

• An administrator turns off dynamic email for your organization.
• Users change their Gmail settings to turn off dynamic email.

When dynamic email is turned off, AMP content isn't displayed by Gmail. However, AMP markup is still included in the message source and available in Vault.

Confidential mode messages sent by users in your organization

Confidential mode messages from external senders

Working with confidential mode messages

A user's Gmail data can include 3 types of draft messages:

• Unsent messages in the Drafts folder—These messages are processed like other Gmail messages. They’re subject to holds and retention rules when drafts aren’t excluded. They're also included in search results unless you exclude them.

  Note: Email templates are treated as draft messages. If a retention rule purges draft messages after a set time, templates are also purged.

• Discarded drafts—A discarded draft is a message that a user discards without sending. These messages are immediately removed from the user's view, Gmail applies the ^deleted label, and they're purged 30 days after they’re discarded. These messages aren’t subject to holds or retention rules, but are available for search and export until they’re purged.
• Automatically saved versions of draft messages—As a user composes a message, Gmail automatically saves a version whenever the user pauses for a few seconds. Only the most recent version of a draft message is visible to the user. Earlier versions are available for Vault to search and export, but aren't subject to holds and retention rules.

  Autosaved versions remain available to Vault until they're purged, even after the user sends the message. Versions of draft messages generated by most Google Gmail clients (such as the Gmail web, Gmail for iPad and iPhone, and Gmail Android) are purged 1 day after Gmail saved them. In some cases, such as with third-party IMAP clients, versions of draft messages are purged after 30 days.

If you're interested only in messages that users sent and received, you can exclude drafts from retention rules, holds, search results, and exports. Excluding autosaved versions can make data processing easier because you don't have similar versions of the same message.

Gmail uses system-generated labels to categorize messages and user-visible labels to let users sort messages in their inboxes. Gmail might apply the system-generated finance label to messages that come from a user's bank and the system-generated travel label to messages that include hotel reservations.

Users can create and apply user-visible labels. Sometimes these labels can match system-generated labels. When the 2 types of labels match, Vault applies retention rules, holds, and search queries to the messages with the user-created label and not to messages with the identical system-generated label. If you create a retention rule, hold, or search query based on a label, you might include or exclude more messages than you intend.

Example

Your organization is required to retain all data related to corporate finance for 7 years and the following actions occur:

• Employees are instructed to create a label, finance, and apply it to messages that include corporate financial information.
• Employees have their corporate credit card statements emailed to their work accounts. They don’t apply the user-created finance label, but Gmail applies the system-generated finance label to these messages.

In this scenario, a retention rule that includes messages with label:finance retains only the user-labeled messages and not the messages with the system-generated label that have the employees' corporate credit card statements. Similarly, a search query that includes messages with label:finance returns only the user-labeled messages and not the messages with the system-generated label that have the employees' personal bank statements.

Common system-generated labels

Vault can retain, hold, search, and export the following items stored in Drive:

• Versions of files in Google Docs, Sheets, Slides, Forms, new Sites, Drawings, and Vids

  For more information about versions, go to Search within the revision history of a file.

• Google Meet recordings and any associated chat, transcripts, Q&A, and polls logs, and notes taken by Gemini (Learn more about Meet recordings)
• Jamboard files that have been saved to users' Drives
• Non-Google files that users have uploaded to Drive
• Files in shared drives
• Files encrypted with Google Workspace client-side encryption

Vault ignores:

• Drive folders
• Drive shortcuts
• Scripts from Google App Script and their associated workflows

In some Google Docs editors, users can link a file to another file. For example, in a Google Docs document you can insert a chart that's linked to data in a Google Sheets spreadsheet. Whenever the spreadsheet is updated, the chart in the document is also updated.

Note: The Google Sheets IMAGE function can reference an image by URL, such as "https://example.com/images/logo.jpg". In this case, when you preview or export a spreadsheet in Vault, the image is retrieved in real time from the source. For images uploaded or inserted in the spreadsheet, Vault stores and displays the image available at the time specified in your query. 

Linked files aren't automatically included in retention rules, holds, or search results that apply to the files that link to them. Linked files are included only when they also match the scope and conditions. For example, when you search files in Drive, Vault returns only the files that match your search criteria. If those files are linked to files that don't match your query, the linked files aren't included in your results.

Files created outside your organization and shared with your users aren't subject to your organization’s holds or retention rules.

You can search and export files shared with your users from external sources.

Vault can hold, retain, and search only messages in Google Groups that have conversation history turned on. Group owners can turn conversation history on or off for their groups. If a group owner creates a group with conversation history off, the messages aren't available to Vault through Groups. The messages might be available in user Gmail mailboxes (as received or sent messages).

If a group owner turns conversation history on or off for an existing group, only messages sent when conversation history was on are available to Vault.

Messages are available to Vault as soon as they're posted to a group, unless the group owner chooses to moderate messages. Moderated messages aren't available to Vault until a moderator approves them. After they're approved, they're available for retention, holds, search, and export just like any other message.

For message filtering in retention rules, holds, and search, Groups indexes approximately 1 MB total per message. One MB is equivalent to approximately 250 pages of text. If the message text is less than 1 MB and the message has text-based file attachments, the attachments are indexed until 1 MB total data is indexed.

Groups indexes the following data:

You must turn history on to retain, hold, search, and export direct messages (DMs), group messages, and unthreaded spaces. A Google Workspace administrator can control whether history is on or off, or they can allow users to decide.

You can always retain, hold, and search messages in spaces with threaded replies (conversations) because history can't be turned off.

When a user shares a file stored in Drive, such as a doc, sheet, or PDF, Chat inserts a link rather than attaching a copy of the file to the message. Because the original file is stored in Drive, it isn't retained when you retain chat messages, held when you place Chat data on hold, or returned in a Chat search. You can search by the URL of the file, but Vault doesn't index the title or content of the file.

For other file types directly attached to a Chat message:

• The files are included in Chat retention rules and holds, associated with the message they're attached to.
• Vault indexes the file name and owner for search. Vault also indexes the content of most text-based file types (for example, files with .pdf, .xslx, and .docx extensions).

Your Google Workspace administrator can allow users in your organization to chat with external users. When allowed, an external user and a user in your organization can exchange DMs and external users can participate in group messages and spaces. In these contexts, messages to and from external users are subject to your organization's retention rules and holds

If users in your organization participate in group messages and spaces owned by another organization, those messages aren’t available to your organization through Vault for retention, holds, search, or export.

When a user is invited to a Chat space, they can preview messages in the space before joining. Unless the user joins the space, the messages they previewed aren’t included when you retain, hold, or search that user’s Chat data.

Users can add rich text formatting to Chat messages, such as bold, italics, strikethrough, or underlines. That formatting is not retained in the Vault data export.

Vault supports chats in classic Hangouts and Google Talk. You can retain, search for, and place holds on:

• Classic Hangouts with history turned on. Google Workspace administrators can control whether history is on or off, or they can allow users to decide. For details, see Chat history. Vault can access all chats that occur in Gmail and mobile classic Hangouts apps when history is on.
• Google Talk chats that are on the record. Google Workspace administrators cannot force chats to be on the record. They can, however, turn off chat history for an organization.

• The messages in the Gmail archive will be marked as deleted after January 1, 2023. This means that all messages will be eventually purged after the retention period expires unless they are protected by a Chat retention rule or hold.
• No new messages sent after January 1, 2023 are synced to Gmail from classic Hangouts.
• Admins can continue to use Vault to search for and export Hangouts Classic messages synced to Gmail as long as they have not been purged, even beyond January 1, 2023.

The following details for classic Hangouts chats are available to Vault:

• All users who participated in the chat.
• All messages that were exchanged during the chat, plus links to any attachments.
• Names of group classic Hangouts. (Participants have the option of naming a group Hangout.) Chats between two users cannot be named.
• The time the chat started and ended.

The following data aren't available to Vault:

• Unaccepted invitations to chat. If a user doesn't participate in a chat, messages sent to that user aren't preserved.
• Video calls.
• Chats that occur within Google Docs.
• Images, videos, and audio attachments sent in classic Hangouts.

Vault groups all classic Hangouts messages into a single thread. Messages are continuously added to the thread until:

• Three hours have elapsed since the last chat message was sent.
• The thread has more than 1,000 messages.

When you export a classic Hangouts message, the entire thread is included when you download the export file.

• New Sites only—Only sites created in new Sites are supported in Vault. Sites created in classic Sites aren't stored in Drive and are unavailable to Vault.
• External sites—Sites shared with your users from external organization aren't subject to your organization's retention rules or holds. You can search for external sites shared with your users, but you must search by specific accounts, organizational unit, or shared drives. You can't search for external sites by published URL.

• Embedded content and hyperlinks—A site can consist of many parts: the site itself, a page that's part of the site, text, images, embedded code, embedded files, and hyperlinks to other content.

  Retention rules and holds apply only to the site itself, the site's pages, text on site pages, uploaded images, and embedded code. Embedded files, hyperlinks, and other items not part of the site file aren't covered by retention rules or holds.

  You can preview hyperlinks. You can also preview embedded files if they are preview supported, such as an embedded sheet or doc, and you have access privileges to the file. However, exports don't include the content of hyperlinks and embedded files.

Creation date

The creation date of a site is the date when a user creates a new site. The creation date doesn't change when the user adds new pages.

Last modification date

The last modified date of a site is updated whenever the site itself, a page that's part of the site, text, images, or embedded code are edited, deleted, or created. When users embed Google files and YouTube videos, or other content with a URL, the last modification date updates. However, if the embedded content itself changes, the last modification date of the site doesn't update.