Workspace security

Google Workspace security settings and backup

A significant portion of Workspace's security features are off by default. We reduce the risk of account takeover and data loss with two-step verification, admin roles, sharing rules, and separate backup.

Request a security assessment Email security check

Last updated: 18 September 2026

Is Google Vault a backup tool?

No. Google Vault is a compliance tool that retains email and files for legal retention and eDiscovery purposes. It is not designed to quickly restore a deleted file or mailbox to its state on a particular date. Real backup requires a third-party backup solution that copies Workspace data to a separate environment.

Security layers we set up

Mandatory two-step verification

Two-step verification or a passkey for all users. A security key for administrators.

Admin roles

The number of super administrators is kept to a minimum. Limited roles are defined for tasks such as the help desk.

Third-party app access review

Reviewing which data third-party apps signed in with a Google account can access.

Data loss prevention (DLP)

Rules that prevent sensitive data, such as ID numbers or IBANs, from being shared externally (Enterprise).

Device management

Remote wipe of corporate data on a lost phone and password policies.

Alerts and audit logs

Making sure alerts for suspicious logins, bulk downloads, and admin changes reach the right person.

The difference between Vault and backup

	Google Vault	Third-party backup
Purpose	Legal retention, eDiscovery, audit	Restoring data after loss
Available in which plans	Business Plus and Enterprise	Usable with any plan
Point-in-time restore	Not designed for this	Yes
Where data is kept	Inside Google Workspace	A separate storage environment
Protection against ransomware and accidental deletion	Limited	This is its main purpose

Xen Bilişim

Our services for Workspace security

Xen Bilişim is a managed IT and security services firm. We manage Workspace security with regular checks and a monthly report.

Security assessment

We compare your current settings against Google's recommendations and produce a prioritized fix list.

Backup setup

Automatic, point-in-time restorable backup for Gmail, Drive, and shared drives.

Monthly review

New users, sharing settings, and alerts are reviewed regularly.

SSS

Frequently asked questions

Doesn't Google already back up my data?

Google backs up its own infrastructure, and no data is lost due to a hardware failure. But situations such as a user deleting a file, an account being taken over and data deleted, or a synced ransomware attack are your responsibility. That is why separate backup is recommended.

Isn't restoring from trash enough?

Deleted items stay in trash for a limited period, then are permanently deleted. This period may not be enough for data that goes unnoticed or for an account closed when an employee leaves.

What should I do regarding KVKK?

Technical measures that prevent unauthorized access, such as two-step verification, access logs, and limiting authority, are part of the security measures expected under KVKK. Transfer of data abroad should be assessed together with your legal counsel.

Sources

The information on this page is based on the sources below. Products and regulations change, so check them too.

Google Vault overview
Explains that Vault is not a backup tool; it is built for retention and eDiscovery.
KVKK (Turkish DPA): transfer abroad page
The official framework for technical safeguards and transfers of data abroad.

Email security checkScore your SPF, DKIM, and DMARC records in 10 seconds.Security consultingSecurity assessment and hardening for Workspace and Google Cloud.Workspace pricingCurrent TRY list prices and differences between Business and Enterprise plans.Türkiye region and KVKKThe status of the Türkiye region, the Turkcell partnership, and transfer abroad under KVKK.Managed supportOngoing, contracted support in Turkish for Workspace and Google Cloud.Business emailGmail with your own domain, including MX, SPF, DKIM, and DMARC setup.

Contact

Let's measure your Workspace security

We will review your admin console together and list the risks in order of priority.

Request an assessment Try the email test first