What Google protects, and what it leaves to you
Google's infrastructure stores your data across multiple data centres, so a failed disk at Google is not your problem. What Google does not do is keep a separate, long-running history of your business data that you control. If a user empties their trash, or an admin deletes an account, there is a short window to recover it from the admin console and then it is gone.
Google Vault, included in some Workspace editions, is often mistaken for a backup. Vault is designed for retention and legal discovery: holding and searching email and files. It can help in a pinch, but restoring a whole user's Drive from Vault is slow and awkward, and Vault holds are tied to the same tenancy.
What a Workspace backup should cover
At a minimum: every user's Gmail, every My Drive, every shared drive, Calendar and Contacts. Some services also cover Sites and parts of Chat. Shared drives matter most for many businesses, because they hold the team's working files and are easy to forget when a backup is configured user by user.
Confirm that new accounts and shared drives are added automatically. A setup that requires someone to tick a box each time a person joins will miss someone, usually the busiest new starter. Ask the vendor for a list of everything currently protected and compare it with your user list and shared drive list each quarter. Any difference is a gap worth fixing straight away.
Departing staff and the suspended-account trap
Many small businesses suspend a leaver's account and keep paying for it indefinitely, just to keep their mail and files. Others delete the account and transfer the Drive files to a manager, forgetting that email is not transferred by default. A backup changes this: you can archive the leaver's data in the backup, release the licence, and still restore their mail or files years later if a dispute or client question arises.
Before deleting any account, check the backup has a complete recent copy, then follow a short checklist so the transfer and the backup happen in the right order. The checklist only needs a few lines: confirm the backup date, transfer Drive ownership, set up mail forwarding or a delegate if needed, note the date, then delete. Keep a record of each leaver handled this way.
Admin settings that support the backup
Enforce 2-step verification for everyone and use security keys or an authenticator app for super administrators. An attacker with super admin rights can remove the backup app's access and then delete data. Limit the number of super admins to two or three named people, and keep a break-glass account with a long password stored securely offline.
Review third-party app access in the admin console so only approved apps, including the backup service, can read Workspace data. Turn on alerts for mass deletions and suspicious sign-ins so a problem shows up quickly rather than when a client asks for a missing file. Check these settings again whenever someone new is given admin rights.
Restoring: what to practise
Practise restoring a single email thread, a folder in a shared drive, and an entire user to a new account. Note whether the tool restores file permissions and sharing links, because restoring a folder without its sharing settings can leave staff and clients unable to open things. Note how long a large Drive takes to come back.
Also check whether you can export data in standard formats. If you ever leave the backup provider or move away from Workspace, being able to download mail as standard files and documents in common formats keeps you in control. Ask the vendor about this before signing, because some services make bulk export slow or charge for it, and you do not want to discover that during a migration with a deadline.
Choosing a retention period
Most small businesses keep daily restore points for at least a year and keep leavers' data for as long as client or legal reasons require. If you hold personal information, decide how long you genuinely need it and set the backup to match, because keeping everything forever is not automatically the safe choice.
Write the retention period down and review it each year alongside your other record-keeping decisions. Changes in the business, such as taking on a client in a regulated industry or starting to hold health information, may justify a longer period for some data and a shorter one for the rest. Most backup services let you set different retention for different groups of users.
In short
- Google keeps Workspace available but does not keep a long independent history.
- Vault is for retention and discovery, not quick, full restores.
- Include shared drives and make sure new accounts are added automatically.
- Back up leavers before deleting their accounts so licences can be released.