Home›Guides›Microsoft 365 and Google Workspace

Microsoft 365 and Google Workspace

Backing up business Gmail

Business Gmail is backed up by copying every mailbox in the domain to external storage, at least once a day, with the ability to restore a message or a folder to a chosen date. Forwarding emails to another mailbox, or relying on the bin, does not give you that history.

Updated in October 20263 min read5 sources cited

Key points

  • Copy messages, attachments and labels, for individual users and group mailboxes alike.
  • Without a backup, a deleted message disappears after 30 days in the bin + 25 days of administrator restore.
  • Google Chat is not email: a “Gmail” tool does not necessarily cover it.
  • On the day of a compromise: revoke sessions and purge filters before restoring.

What to copy

  • Messages, threads, attachments, labels. Labels are how many teams actually organise their work: losing them makes a mailbox unreadable.
  • Individual mailboxes and group mailboxes (facturation@, bonjour@).
  • Calendar and contacts if the business depends on them. They are not strictly “in Gmail”, but users experience them as one.
  • Drafts only if they have value. That is generally not the case.

Google Chat conversations and spaces are not emails. A “Gmail” tool does not necessarily cover them. If these exchanges have evidential value for you, raise the question separately.

Settings

At least daily frequency. Choose it by asking what the loss of a day, a week or a month of data would cost; CERT-MU also recommends an off-site copy and regular restore tests. Retention of 30 to 90 days for operational needs. Restricted access for the tool, with the administrator protected by a second factor. A copy that cannot be erased during the window in which an attacker could also target the backup console. A failure log that someone actually reads.

First export: long, because it takes in the full history. After that, only new messages. Keep an eye on attachment volume: a few mailboxes full of plans or photos weigh more than a hundred text mailboxes.

Setup checklist:

  1. List of individual and group mailboxes.
  2. Tool access approved, admin account under two-factor authentication.
  3. Frequency and retention written down.
  4. First export completed and checked.
  5. First test restore to a control mailbox, with labels.

What Google allows without a backup, and where it stops

  • Bin. A deleted message stays in the user’s bin for 30 days.
  • Administrator restore. After those 30 days, the administrator has 25 more days to restore messages from the console. After that, they are permanently deleted.
  • Deleted account. The administrator can restore a user up to 20 days after deletion. After that, Google states that the data is gone.
  • Vault. If your edition includes it and a rule was set before the need arose, it retains messages for search. Its FAQ states that it is not designed to be a backup or archiving tool.

None of these mechanisms is a library of versions managed by you, outside the domain, and tested every six months.

The day a mailbox is wiped

Revoke sessions, check filters and forwarding rules (attackers often add some), choose a copy dated before the wipe, restore to a control mailbox, then reconnect the user. If the deletion is recent (in the bin, or purged less than 25 days ago), Google’s administrator restore can also bring the messages back: check this quickly. The step-by-step procedure is in A mailbox has been wiped or hacked.

At WeDoBack

Business Gmail falls within the Google Workspace scope of email, calendars and contacts. One agent is counted per address. Storage follows the actual volume, with SMART (49.99 € excl. VAT per TB per month) or INTEGRAL (from 100 € down to 65 € excl. VAT per TB per month depending on volume), not an “unlimited mailbox” flat rate. Messages leave encrypted, with the key held by the customer, to backup servers separate from the Google domain. The frequency chosen in the console is your RPO. No restore time figure is published: it depends on the size of the mailbox and is measured through a test.

Request a quoteSee offers and prices

Frequently asked questions

Is automatically forwarding emails to another mailbox a backup?

No. Forwarding only copies new messages, without labels or a history of dates. It also duplicates personal data into a mailbox that is often less well protected. And it does not let you return a mailbox to its state before an incident.

Can an administrator recover an email deleted two months ago?

Not with Google’s tools alone. A message stays in the bin for 30 days, then the administrator has 25 more days to restore it. Beyond that, you need a backup, or a Vault rule set before the deletion, which serves search rather than recovery.

How often should Gmail be backed up?

At least once a day. More often if email is your ordering channel. The interval between two copies corresponds to the volume of messages you would be prepared to lose.

Further reading

Microsoft 365 and Google WorkspaceShould you back up Google Workspace?IT backupHow do you back up Google Workspace?Microsoft 365 and Google WorkspaceDoes Google Workspace really include a backup?What to do if…A mailbox has been wiped or hacked

Sources

Documents consulted in October 2026.

  1. Restore a user’s permanently deleted email — Google Workspace Admin Help
  2. Restore a recently deleted user — Google Workspace Admin Help
  3. Google Vault FAQ — Google Vault Help
  4. Guideline on Ransomware Removal — CERT-MU
  5. Offers and prices — WeDoBack

Planning a backup, DRP or BCP project?

More than 20 years of experience protecting business data.

Request a quote+33 9 72 50 78 28

Protect your data with WeDoBack

Encrypted offsite backup, immutable storage, DRP and BCP: tell us about your servers and we will recommend the right combination.

Request a quoteSee offers and prices