Back up your Gmail and Google Workspace mailboxes

What Google keeps, and for how long

A deleted email sits in the trash for thirty days. On Workspace, an administrator can then recover it from the admin console for another twenty-five days. After that it is permanently erased and Google cannot get it back.

That is fine for a mistake someone notices the next day. It is not enough when you need an email at year end, during a dispute, or after an employee who cleaned out their mailbox has left.

• Thirty days in the trash, then twenty-five days of admin recovery on Workspace.
• When an account is deleted, its mailbox goes too, after a short grace period.
• Google Vault is an archiving tool: it keeps and searches email, but it does not put a mailbox back the way it was.

The settings

Google requires an app password, separate from your account password, and you need two-step verification turned on before you can create one. It is only used for this connection, so revoking it does not affect anything else.

The admin setting that can stop the connection

On Google Workspace, the administrator turns IMAP on or off for each organisational unit, and can also limit access to apps that sign in with OAuth. When that limit is on, an app password is not accepted and istorel cannot connect.

Check this before you add the mailboxes for a Workspace domain. If IMAP is enabled and app passwords are allowed, everything works. If not, the setting needs changing in the admin console, or you will have to wait until istorel supports OAuth. That is planned but not available yet.

Questions

Is an app password risky?

Less so than your account password. It lets an app connect to your mail, it cannot be used to sign in to Google on the web, and you can revoke it in one click without touching the account. On our side, we encrypt it as soon as it is saved, with a key that never leaves our environment, and it is never shown again.

What if my administrator enforces OAuth?

Then istorel cannot connect for now. OAuth support is planned.

Is Google Vault not enough?

Vault is built for compliance and litigation: it keeps email and lets you search it. It does not restore a mailbox to how it was, and it only comes with some Workspace editions. They meet different needs, and one does not replace the other.

Do you back up Google Drive?

Not yet. Drive backup is in development, starting with kDrive over WebDAV.