Google Vault for eDiscovery: Legal Holds, Retention, and Matter Exports

Legal teams managing discovery across Google Workspace frequently discover that Google Vault handles only the first leg of the Electronic Discovery Reference Model. It preserves data in place and produces raw matter exports, but it does not tag, redact, Bates stamp, or host documents for legal review, leaving litigation support staff with gigabytes of raw ZIP archives that must be organized, verified, and delivered to outside counsel under strict court deadlines.

Google Vault is an information governance and eDiscovery tool for Google Workspace that allows administrators and legal teams to retain, hold, search, and export data from Gmail, Google Drive, Chat, and Meet. Built directly into the Google Cloud infrastructure, Vault operates as a policy engine layered on top of Google Workspace storage services. Rather than copying data into a separate repository during daily business operations, Vault indexes messages and documents in place, enforcing retention schedules and litigation holds without altering the end-user experience.

Supported Google Workspace Services

Vault captures electronically stored information across core collaboration tools:

• Gmail: User mailboxes, attachments, draft messages, sent mail, and items in the trash.
• Google Drive: Native Google Docs, Sheets, Slides, Drawings, Forms, Sites, and Vids, along with binary files uploaded to user drives and Shared Drives.
• Google Chat: Direct messages, group conversations, and spaces, provided chat history is enabled.
• Google Meet: Recorded video calls, chat logs, and attendance reports stored in the host organizer's Google Drive.
• Google Groups: Message archives across organizational distribution lists.
• Google Voice: SMS text messages, voicemails, and call logs.

Licensing and the Deprovisioning Trap

Google includes Vault in Google Workspace Business Plus, Enterprise Standard, and Enterprise Plus editions. Organizations using Business Starter or Business Standard plans must purchase standalone Google Vault add-on licenses for each user account requiring retention or hold enforcement.

A frequent operational pitfall in legal discovery involves employee departures. Google Vault ties data preservation directly to the existence of the user account. If an IT administrator deletes a former employee account in the Google Workspace Admin console, Google permanently purges all associated Vault data, including emails and Drive files currently marked under a legal hold. To prevent spoliation of evidence, organizations must assign an Archived User (AU) license to the departed custodian before deprovisioning active services. Archived User licenses preserve Vault retention and holds indefinitely at a fraction of the cost of an active Google Workspace seat.

Scope within the EDRM Framework

Within the Electronic Discovery Reference Model (EDRM), Google Vault covers the initial stages: Information Governance, Identification, Preservation, and Collection. It identifies custodian data pools and collects targeted records into downloadable archives. Vault does not perform processing, document review, or production. It contains no tools for redaction, no document-level coding, no privilege review workflows, and no Bates numbering engine. Treating Vault as an end-to-end eDiscovery platform leads to operational stalls during litigation, as teams must bridge the gap between Vault's raw exports and the production requirements of opposing counsel.

• Microsoft 365 eDiscovery: Purview Workflows, Holds, and Export GuideMicrosoft 365 eDiscovery (part of Microsoft Purview) is a cloud compliance toolset that allows organizations to...
• Legal Vendor Management Software: Managing ALSPs, eDiscovery, and Expert WitnessesLegal vendor management software helps in-house legal departments and law firms centralize procurement, contract terms,...
• DISCO eDiscovery Pricing: Ingestion Costs, Hosting Fees, and Review EconomicsDISCO eDiscovery pricing combines monthly gigabyte hosting fees, processed data measurements, and all-inclusive AI...
• eDiscovery Data Processing: Architecture, Workflows, and Load File StagingeDiscovery data processing transforms unorganized electronic files into structured, searchable evidence for litigation...
• Modern eDiscovery Tools: Technical Evaluation and Workflow GuideEvaluating modern eDiscovery tools requires understanding how software categories map across the Electronic Discovery...
• Electronic Discovery Software: Modern Guide for Legal TeamsElectronic discovery software manages electronically stored information across the litigation lifecycle, from legal...

More on this subject: Legal Teams (197 guides)

Understanding the distinction between retention rules and legal holds is fundamental to managing defensible discovery in Google Workspace. While both mechanisms preserve data from destruction, they serve opposite operational purposes and operate under different priority rules.

Retention Rules: Scheduled Lifecycle Management

A retention rule establishes how long Google Workspace keeps data under ordinary business operations before automatically deleting it. Retention rules help organizations comply with industry recordkeeping obligations while reducing discovery exposure by disposing of obsolete files.

Vault provides two types of retention rules:

1. Default Retention Rules: Domain-wide rules applied to an entire service, such as retaining all Gmail messages for 730 days. Default rules govern any account that is not subject to a custom rule or a legal hold.
2. Custom Retention Rules: Scoped policies applied to specific organizational units (OUs), date ranges, or search terms. For example, a financial services firm might apply a seven-year custom retention rule to the accounting OU while keeping a two-year rule for general staff.

When an organization configures no retention rules in Vault, Google Workspace defaults to keeping all user data indefinitely until an end user manually deletes an item and empties the trash. Once a retention rule expires, Vault initiates a disposition cycle, permanently purging matching records that have passed their expiration threshold.

Legal Holds: Preservation for Litigation

A legal hold preserves data indefinitely for a pending investigation, audit, or lawsuit. Unlike retention rules, which enforce automated lifecycle disposal, a legal hold freezes matching records against all deletion mechanisms.

The fundamental operational principle of Google Vault is that legal holds strictly override retention rules. Even if a retention rule mandates purging data after thirty days, or an employee actively deletes an email and empties their trash, an active legal hold keeps the file intact. The item disappears from the user's view in Gmail or Google Drive, but Google Vault retains the underlying record in a protected repository accessible only to authorized administrators.

Custodian Holds Versus Organizational Unit Scope

When placing holds in Google Vault, administrators can target specific custodian accounts or entire organizational units. Targeting entire organizational units frequently causes discovery scope creep. An OU-level hold freezes data for every user assigned to that department, preserving gigabytes of irrelevant routine correspondence and dramatically inflating downstream export volumes.

Defensible discovery requires placing holds on specific custodian email addresses. Custodian-targeted holds restrict preservation to relevant actors identified in litigation hold notices. Administrators can also narrow holds by date ranges and keyword terms for Gmail and Google Groups, though keyword-filtered holds require careful drafting to avoid excluding relevant evidence.

Executing defensible eDiscovery in Google Vault follows a structured progression from matter creation to query execution. Treating each legal request as a formal matter container keeps search queries, holds, and audit trails remain isolated and auditable.

Step 1: Create a Matter and Assign Collaborators

Matters are the foundational workspaces in Google Vault. Every hold, search query, and export bundle belongs to a specific matter.

1. Sign in to the Google Vault console at vault.google.com.
2. Click Matters in the left navigation menu, then click Create.
3. Enter a descriptive matter name, such as Smith v. Acme Corp - 2026-CV-0142, along with an internal matter description.
4. Open the created matter and select the Collaborators tab.
5. Add internal legal team members or discovery specialists, assigning granular role permissions: View, Edit, Manage Holds, Manage Searches, and Manage Exports. Scoping permissions prevents unauthorized search modifications or accidental hold releases.

Step 2: Establish Custodian Legal Holds

Once the matter is active, identify relevant custodians and place their accounts on hold before executing searches.

1. Inside the matter, click the Holds tab, then click Create.
2. Select the service to preserve: Gmail, Drive, Chat, or Groups. Note that Vault requires separate hold configurations for each service.
3. For Gmail, select Specific accounts and enter the custodian email addresses.
4. Define a date range if the preservation scope specifies a clear temporal boundary. Leaving dates blank preserves all historical and future messages generated by the custodian.
5. Enter search terms only if court orders or preservation agreements explicitly permit keyword-filtered holds. Otherwise, preserve the custodian's entire mailbox.
6. Click Save to activate the hold. Vault applies the hold within minutes across Google systems.

Step 3: Construct Targeted Search Queries

With holds active, legal teams use the Searches tab to query and identify relevant documents. Vault provides distinct search fields for each Google Workspace service.

Google Vault supports a specific query syntax that differs in critical ways from consumer Google search. Understanding these syntax operators prevents query syntax errors and missing evidence:

• Boolean Operators: Use AND, OR, and NOT in all capital letters. Lowercase operators are treated as search words rather than logic gates.
• Exact Phrase Matching: Enclose phrases in quotation marks, such as "confidential patent agreement".
• Field Restrictions: Target specific email metadata fields using from:, to:, cc:, bcc:, and subject:. For example: from:john.doe@example.com AND subject:"quarterly forecast".
• Attachment Filters: Use has:attachment to locate messages containing files, or filter by file extension using filename:pdf or filename:xlsx.
• Temporal Operators: Restrict searches by date using after:YYYY-MM-DD and before:YYYY-MM-DD, or sent:YYYY-MM-DD for specific message delivery dates.
• Drive Metadata: Query Drive items using type:spreadsheet, type:document, title:"merger terms", or owner:cfo@example.com.

Wildcard and Proximity Constraints

A major operational constraint in Google Vault is its limited wildcard support. Vault supports trailing prefix wildcards, such as investig* to return matches for investigate, investigation, and investigator. However, Vault does not support leading wildcards (such as *agreement), middle wildcards, or fuzzy matching.

Furthermore, Google Vault does not support proximity operators like NEAR or W/5. If counsel requests communications where two executive names appear within five words of each other, Vault cannot execute that restriction. The query must rely on standard AND Boolean logic, requiring litigation teams to filter proximity downstream in an external review workspace.

Validating Query Counts Before Export

Before committing to an export, click the Count button in the search panel. Vault scans the target custodian accounts and calculates two metrics: the total number of query matches and the total volume of data.

Reviewing query counts prevents common discovery mistakes. If a search query returns an unmanageable volume of messages across an entire mailbox, the query is likely overbroad. Legal teams can refine search terms, adjust date ranges, or exclude automated system notifications before running export pipelines that take hours to generate and days to download.

After refining search queries and verifying document counts, the final stage within Google Vault is generating export packages. While initiating an export takes only a few clicks, managing the output reveals the primary operational bottlenecks of Google's native eDiscovery tooling.

Initiating the Export

To export search results, click Export at the bottom of the completed search panel. Vault prompts for export configuration options depending on the data source:

1. Email and Chat Formats: Administrators choose between PST and MBOX formats. MBOX files are standard UNIX mailbox archives that process quickly and load into most modern discovery platforms. PST files are proprietary Microsoft Outlook archives preferred by traditional litigation support vendors.
2. Drive File Formats: Google Docs, Sheets, and Slides export as Microsoft Word (.docx), Excel (.xlsx), and PowerPoint (.pptx) documents. Google Drawings and Sites export as PDF files. Google Forms export as compressed ZIP files containing HTML forms and CSV response data. Uploaded binary files (such as external PDFs, audio files, and video recordings) export in their native formats.
3. Linked Drive Files: When exporting Gmail or Google Chat, select the option to export linked Drive files. Google Workspace users frequently share files by inserting Google Drive links rather than attaching static copies. Enabling this setting creates a supplementary export containing the linked Drive assets referenced in custodian messages.

Multi-Party Administrative Approvals

In organizations handling sensitive matters, Google Workspace allows administrators to enforce multi-party approval for Vault exports. When enabled, creating an export generates a pending approval request. A second administrator with export privileges must log in and authorize the task before Vault begins compiling the archive. If the secondary administrator does not approve the request within 15 days, Google Vault automatically cancels the export task.

The 15-Day Download Expiration Window

Once Vault finishes processing, the export status displays a green checkmark on the Exports tab. At this point, a strict countdown begins: export files are available for 15 days after you start the export. After 15 days, they are deleted, and you must re-create the export if you need to access the data.

This 15-day expiration window creates immediate operational pressure on litigation support teams. For complex matters spanning dozens of custodians and high volumes of data, downloading, verifying, and transferring multi-part archives before Google deletes the files requires dedicated infrastructure and immediate coordination.

The Operational Bottlenecks of Raw Vault Exports

Competitors and general IT guides frequently treat Google Vault exports as the end of the eDiscovery workflow. In practice, receiving a completed Vault export is where the most labor-intensive litigation problems begin.

• Multi-Part Compressed Archives: Google Vault splits large collections across multiple compressed ZIP files rather than generating a single consolidated container. A large custodian export yields numerous individual ZIP archives. Support staff must download each archive individually, verify cryptographic checksums, unpack nested directories, and reconnect split message threads.
• Non-Standard Metadata Files: Vault provides index data as metadata.xml or metadata.csv files containing MD5 hashes, custodian identities, and file paths. However, Vault does not generate Concordance (.DAT) or Opticon (.OPT) load files required by traditional litigation review platforms. Converting Vault's metadata into standard load files requires custom data manipulation scripts or third-party processing utilities.
• Absence of Review Tooling: Google Vault offers zero document tagging, zero privilege logging, zero redaction, and zero Bates stamping engines. It cannot apply confidential watermarks, hide proprietary trade secrets, or assign sequential trial exhibit numbers.
• External Delivery Friction: Emailing raw ZIP archives or sharing raw Drive folders with outside counsel creates security risks, breaks chain of custody, and provides no audit visibility into when opposing counsel or co-counsel accesses specific exhibits.

Bridge the Gap Between Google Vault Exports and Legal Delivery

Organize raw discovery bundles in structured matter workspaces with granular access controls, structured metadata views, and expiring client shares. Start your 14-day free trial.

Start 14-Day Trial

Bridging the gap between Google Vault's raw data extraction and court-ready legal production requires a dedicated workspace. Once discovery files are extracted from Google's infrastructure, litigation teams need an organized environment to stage collections, extract structured document metadata, review key records, and execute secure deliveries to external counsel.

Structuring Matter Workspaces for Custodian Data

Rather than leaving raw ZIP files scattered across local hard drives or unmanaged cloud folders, legal operations teams establish centralized, organization-owned matter workspaces. Platforms like Fast.io Workspaces provide persistent directory hierarchies structured around the litigation lifecycle:

Matter-2026-0142-Acme/
├── 01_Custodians/
│   ├── Custodian_Doe_John/
│   │   ├── Gmail_MBOX/
│   │   ├── Drive_Native/
│   │   └── Linked_Assets/
│   └── Custodian_Smith_Jane/
├── 02_Processing_Staging/
├── 03_Privilege_Log/
└── 04_Production_Deliverables/

Holding matter data in an organization-owned workspace protects the firm from data loss if a paralegal or litigation specialist leaves the organization. Granular access controls allow practice managers to restrict specific custodian folders to assigned litigation leads while maintaining matter-wide visibility.

Structuring Document Data with Metadata Views

Raw Google Drive exports often contain thousands of files with non-descriptive names like Document (1).docx or Draft Proposal.pdf. Reviewing each file manually to extract basic matter intelligence burns hundreds of billable hours.

Legal operations teams use Fast.io Metadata Views to turn unorganized document directories into live, queryable databases. Rather than configuring complex regular expressions or rigid OCR templates, teams describe the fields they need in plain English: contract title, counterparties, execution date, governing jurisdiction, and document category.

Metadata Views automatically design a typed schema (Text, Date & Time, URL, Boolean, Decimal) and populate a sortable, filterable spreadsheet directly from the workspace files. The extraction engine works across PDFs, Word documents, Excel spreadsheets, scanned exhibits, and handwritten notes. When litigation strategy shifts and counsel needs to identify governing law clauses across hundreds of agreements, teams can add a new column to the Metadata View without re-ingesting or reprocessing the underlying document collection.

Hybrid Search for Early Case Assessment

Before exporting files to high-cost legal review platforms that charge by the gigabyte, litigation teams conduct Early Case Assessment (ECA) to cull irrelevant documents. Fast.io hybrid search combines full-text indexing, semantic understanding, and metadata value filtering across the entire matter workspace.

Litigation teams can search by keyword for specific technical terms while simultaneously querying semantic concepts, such as finding discussions regarding price negotiations or contract termination even if those exact words do not appear in the text. Filtering by custodian metadata and document dates allows legal ops staff to isolate critical exhibits and exclude non-responsive records before incurring external review costs.

Secure Client and Counsel Delivery Workspaces

Delivering completed discovery productions or sharing preliminary custodian records with outside law firms requires strict access governance. Consumer file-sharing links and email attachments lack access control and expose firms to unauthorized disclosure.

Using Fast.io branded shares, litigation teams generate access-controlled portals configured for external exchange:

• Granular Share Modes: Teams select Send shares to deliver finalized productions, Receive shares to collect supplemental discovery files from clients without email attachments, or Exchange shares for two-way collaboration with co-counsel.
• Per-Recipient Access Controls: Discovery links can be scoped to specific recipient email addresses with mandatory authentication passcodes, preventing unauthorized forwarding.
• Download Restrictions and Expiry: For sensitive preliminary reviews, administrators can disable file downloads, allowing outside counsel to inspect documents directly in the secure web viewer while enforcing automatic link expiration dates.
• Detailed activity logging: Fast.io records every share creation, view, file download, and permission update in a detailed activity log. When courts demand proof of delivery or chain-of-custody verification, litigation teams export a detailed activity log documenting exactly which external recipient accessed which file and when.

Defensible Documentation with Collaborative Notes

Maintaining defensible records of custodian collection parameters, search query iterations, and meet-and-confer agreements is critical for surviving discovery challenges under Federal Rule of Civil Procedure 26 or 37.

Litigation teams use real-time Collaborative Notes directly inside the matter workspace to maintain running custodian interview logs, tracking query strings, hit counts, and collection dates. Because Collaborative Notes support simultaneous co-editing between legal operations staff and outside counsel, all stakeholders work from a single, version-controlled source of truth. Every document revision and note update is preserved in per-file version history, keeping the firm's discovery narrative transparent, verifiable, and court-ready.