Is Google Vault enough for SEC Rule 204-2?

It can be, for retention, if Vault is licensed and a retention rule covers the mail. That covers only users who hold a Vault license. Google calls Vault "an information governance and eDiscovery tool", with retention, holds, search, export and audit logging, and itself says Vault "isn't designed to be a backup or archive tool". Whether Vault alone meets Rule 204-2, including its separate-copy condition, is a judgment for your CCO and counsel.

What this means for your firm

• Open your Vault retention rules and your license list: a rule should cover every organizational unit that holds mailboxes, and every mailbox's user should hold a license.
• Deleting a departed employee's Google account can purge their mail from Vault. Decide your departure step before someone leaves.
• Write down how your CCO reviews email, how often, and where the evidence lives.

Turret's own copy, described above, sits outside your Google Workspace, and flagged outbound mail is queued for your reviewer.

Six questions about how your firm keeps and reviews email: take the SEC email-readiness self-check. A self-check of your own practices, not legal advice.

Retention floor

Five years from the end of the fiscal year in which the last entry was made on the record, the first two years in an appropriate office of the adviser (Rule 204-2(e)(1))

Editions

Google lists Vault as included in Frontline Standard and Plus, Business Plus, Enterprise Standard and Plus, and all Education editions, and in Enterprise Essentials and Plus only for domain-verified organizations; not in Business Starter or Business Standard (Google, Vault overview)

List price

Business Plus, $22 per user per month, Google's list price as opened October 17, 2026; we found no published add-on price (Google Workspace pricing)

Rule 204-2 is a recordkeeping rule: what to keep, how long, and how electronic copies must be stored. This section asks only whether Vault keeps the right mail, long enough, in a form you can produce.

Paragraph (a)(7) names the mail:

"Originals of all written communications received and copies of all written communications sent by such investment adviser relating to: (i) Any recommendation made or proposed to be made and any advice given or proposed to be given;"

17 CFR 275.204-2(a)(7)(i)

Items (ii) to (iv) add funds and securities, orders and performance. Paragraph (a)(7) reaches written communications on those subjects; Rule 204-2 lists other record types in other paragraphs. Paragraph (e)(1) sets the clock:

"…shall be maintained and preserved in an easily accessible place for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser."

17 CFR 275.204-2(e)(1)

Paragraph (g) governs electronic storage. It allows "Electronic storage media, including any digital storage medium or system that meets the terms of this section" (g)(1)(ii), on these terms:

"(2) General requirements. The investment adviser must: (i) Arrange and index the records in a way that permits easy location, access, and retrieval of any particular record; (ii) Provide promptly any of the following that the Commission (by its examiners or other representatives) may request: (A) A legible, true, and complete copy of the record in the medium and format in which it is stored; (B) A legible, true, and complete printout of the record; and (C) Means to access, view, and print the records; and (iii) Separately store, for the time required for preservation of the original record, a duplicate copy of the record on any medium allowed by this section."

17 CFR 275.204-2(g)(2)

Nothing in (g) uses the word write-once or WORM; the rule sets outcomes, not a product. It does not say whether a single Google-hosted copy satisfies the duplicate-copy requirement in (g)(2)(iii).

Google calls Vault "an information governance and eDiscovery tool", with retention, holds, search, export and audit logging. Asked whether Vault is a backup or archive tool, its FAQ answers: "No. Vault isn't designed to be a backup or archive tool." That is Google describing the tool's design, not a finding about Rule 204-2.

On retention, the configuration is the catch, and Google says so: "Vault doesn't retain data until you set up retention rules." Its retention documentation adds: "The data is kept even if users delete messages and files or empty their trash." Its Gmail article describes a default rule that "keeps all Gmail messages in the selected organizational unit indefinitely", but does not say whether that rule exists before you create it.

Google lists Vault as included in Frontline Standard and Plus, Business Plus, Enterprise Standard and Plus, and all Education editions. It also says Enterprise Essentials and Plus include it only for domain-verified organizations, so the list overlaps on Enterprise Plus. Business Starter and Business Standard do not include it, and Google says: "Organizations on editions without Vault can buy add-on licenses." We found no published add-on price. Business Plus lists at $22 per user per month on Google's pricing page, opened October 17, 2026. That is a list price; billing terms may differ, and promotional discounts are not counted.

Google's FINRA configuration guide cites Rule 17a-4(f)(2), a broker-dealer rule, and names "Enterprise Plus with the Assured Controls and Assured Controls Plus add-ons" as the supported edition. It does not mention the Advisers Act, Rule 204-2 or Vault.

The rule and the clock. Rule 204-2(e)(1) counts five years from the end of the fiscal year in which the last entry was made on the record, not from the date of a message. A time-based Vault rule that counts from the message date ends earlier than (e)(1) does, so it needs a margin. The margin, and the fiscal-year end it assumes, are yours to set and document.

Licenses. Google: "Only users with Vault licenses assigned to them are covered by Vault."

Deleted users. Google says that if you delete a user or a required license, "their data may be irreversibly purged and no longer available to Vault." Its FAQ adds: "You can recover data for 20 days after you delete the user." and "Any retention rules or holds placed on the user's data no longer apply." Google recommends an Archived User license. A departed employee's communications on the (a)(7) subjects are among the records the rule describes. See also Does email archiving capture deleted email?

Exports. Google's FAQ: "Vault exports are prepared for legal discovery purposes, not efficient data processing." Paragraph (g)(2)(ii) asks for prompt production of what examiners request, in the stored format and as a printout.

When someone leaves, suspend their Google account rather than deleting it. Deleting a user can purge their Vault data and means retention rules no longer apply to it; a suspended account is not deleted, though Google bills it the same as an active one. When Turret sees a Google mailbox move from active to suspended, it queues one final archive pass over that mailbox's sent and received mail.

Rule 206(4)-7 is the compliance-program rule. Paragraph (a) asks for written policies and procedures reasonably designed to prevent violations of the Act and the rules by the firm and its supervised persons. Paragraph (b) asks for this:

"Review, no less frequently than annually, the adequacy of the policies and procedures established pursuant to this section and the effectiveness of their implementation"

17 CFR 275.206(4)-7(b)

Whether those policies include reviewing email, and how, is for your firm to set and document. Google's Vault documentation describes no review or flagging workflow; we found none in the pages listed under Sources. Its audit log is "a record of actions performed in the Vault console".

For retention, Vault can be enough when all of these hold:

• Your edition includes Vault, and each mailbox's user holds a license.
• A retention rule covers the mail in scope, counts time with a margin over (e)(1), and can be shown to an examiner.
• Departures are handled in a way that keeps the mail under that rule.
• You have run a test export and can produce a mailbox on request.
• You have decided, and written down, how (g)(2)(iii) applies to a Google-hosted copy.

A firm that meets every condition above should not buy anything because a vendor page says so. Review is a separate question. If your CCO reads or samples outbound mail some other way and keeps dated evidence, that is a process you can document without a vendor; at a very small firm it may be the CCO reading the mail. For the wider question of going without a vendor, see Does a small RIA need email archiving?

1. The rule and the clock. Check that a retention rule covers Gmail in every organizational unit that holds mailboxes, save a dated copy of its settings, and note what it counts from. If it counts from the message date, add a margin for (e)(1).
2. The licenses. Compare active Google users with Vault-licensed users, new users included. Google documents that only licensed users are covered.
3. The departure step. Google says deleting a user removes their data and ends the rules and holds on it. Look up in your Admin console what a suspension or an Archived User license does for retention, then record who did it and when.
4. The export. Export one mailbox for one date range, time it, and open it to see that messages, attachments and dates are what you expect.
5. The review. Write down how the CCO reviews email, how often, and where the evidence lives.

See how long Rule 204-2 records are kept and Google Workspace email archiving.

Turret keeps a second copy of each monitored mailbox's sent and received mail outside your Google Workspace, Trash included; spam, drafts and chats are not captured. Attachments are archived with their name, type and size, but the text inside them is not scanned. Review covers outbound mail only: pattern checks, then AI triage on each flagged message. Each message carries a SHA-256 hash; the archive is tamper-evident, not write-once (architecture). Retention is 7 years, while you subscribe; the FAQ covers cancellation. Email is $99 a month with 5 mailboxes included, then $25 per additional monitored mailbox.

Sources opened October 17, 2026.

1. Rule text: 17 CFR 275.204-2, Cornell Legal Information Institute, cross-checked against eCFR, 17 CFR 275.204-2 (version of November 19, 2024). The eCFR version history shows no amendment to the section since November 19, 2024.
2. Rule text: 17 CFR 275.206(4)-7, Cornell Legal Information Institute
3. Google: Google Vault overview
4. Google: Google Vault FAQ
5. Google: How retention works in Vault
6. Google: Retain Gmail messages with Vault
7. Google: Vault log events
8. Google: Google Workspace configuration guide for FINRA
9. Google: Google Workspace pricing