Google Workspace email archiving for RIAs

Google Workspace email archiving for an RIA takes one super-admin step: authorizing a vendor’s service account for two read-only scopes in the Admin console. It captures sent and received mail, Trash included. Nothing is installed, you can revoke it at any time, and pattern review covers outbound mail only.

What this means for your firm

• Pick the person first: only a super administrator can add the grant, so if that is outside IT, send them the menu path and the two scopes.
• Authorize narrowly: enter the client ID and exactly the two scopes, and do not accept an archiver that asks for broader ones.
• Suspend a departing person's Google account rather than deleting it: Google says that after 20 days the data is gone and you can't restore it.

Turret reads each mailbox at its own pace and halves that pace if Google signals a rate limit.

Price your own mailbox count: use the archiving cost calculator.

1. 1

   Choose a product

   Email, Marketing or both

2. 2

   Pick your mail platform

   Google Workspace or Microsoft 365

3. 3

   Authorize read-only access

   Your admin approves it once

4. 4

   Verify the connection

   Turret checks it can read one mailbox

5. 5

   Add a card

   Archiving begins after this step

1. 1

   Your mailboxes

   Google Workspace or Microsoft 365, read-only access

2. 2

   Archive

   Sent and received mail, Trash included

3. 3

   Outbound review

   Pattern checks on outbound mail; AI triage on each flagged message

4. 4

   Reviewer queue

   A reviewer works through flagged messages

5. 5

   Audit trail and reports

   Review decisions recorded in an audit trail, plus reports

Received mail is archived but not reviewed. Only outbound mail goes through the review stage.

Who authorizes it

One Google Workspace super administrator, in the Admin console. Google: “You must be signed in as a super administrator for this task.”^[1]

What it can read

Two read-only scopes, gmail.readonly and admin.directory.user.readonly: mail and mail settings, and the list of users. It cannot send, modify, delete or forward email.^[2][3]

What is captured

Sent and received mail, Trash included. Rule 204-2(a)(7) covers communications both received and sent.^[7] Received spam, drafts and chats are not captured; that is Turret’s scope choice, not a rule requirement.

What is reviewed

Outbound mail only. Inbound mail is archived, not pattern-matched. Attachments are archived with their name, type and size, but the text inside them is not scanned.

Retention

Rule 204-2(e)(1) sets a floor of five years from the end of the fiscal year of the last entry, for the records it covers.^[7] Turret’s policy is 7 years, while you subscribe.

An archiver for Google Workspace connects through domain-wide delegation. Your super administrator tells Google that a specific service account may act on your domain’s behalf, limited to the scopes they list. Nobody installs anything, and no user has to sign in or enroll.

Google puts the cost in one sentence:

“With domain-wide delegation, the app has access to the data belonging to all of your users.”

Google Workspace Admin help, “Control API access with domain-wide delegation”^[1]

The grant is domain-wide, not per mailbox. What limits it is the scope list.

The menu path. In the Admin console: “Security” > “Access and data control” > “API controls” > “Manage Domain Wide Delegation”. Click “Add new” and enter the client ID. Then, in Google’s words, “In OAuth Scopes, add each scope that the application can access (should be appropriately narrow).” Turret’s setup wizard walks the admin through this and supplies the scope string, comma-separated.

The two scopes, in Google’s words.

The client ID. Turret uses one shared service account for every firm it serves, not one per firm. Its client ID is 109990955518300423419. It is not a secret: Google’s own flow has the admin type it in. Publishing it lets you check the ID in Turret’s setup wizard against an independent source before you authorize it.

Revoking it. Return to “Manage Domain Wide Delegation”. “Edit” lets you “Add or remove scopes”, though “You can’t edit the client ID.” For “Delete”, Google says: “Applications that depend on the client authorization will immediately stop working.” It also says changes “can take up to 24 hours but typically happen more quickly”, so a new grant may not work yet, and a deleted one may not have stopped, for up to 24 hours.^[1]

Turret archives a mailbox’s sent mail and its received mail, including whatever is in Trash. Received mail is everything except drafts, chats and spam. Sent mail is everything except chats. Turret’s queries start from Gmail’s in:anywhere operator, which Google says will “Find emails across Gmail. This includes emails in Spam and Trash”, and then name what to leave out.^[4] A message a rep filed away, archived out of the inbox or deleted to Trash is still captured.

Turret cannot capture mail that was purged before it read it. Does email archiving capture deleted email? covers that edge.

The rule speaks of both directions. Rule 204-2(a)(7) opens:

(7) Originals of all written communications received and copies of all written communications sent by such investment adviser relating to:

17 CFR 275.204-2(a)(7)^[7]

Four topics follow: recommendations and advice, funds or securities, orders to buy or sell a security, and performance. Paragraph (a)(7)(iv)(A) adds that the adviser is not required to keep “unsolicited market letters and other similar communications of general public distribution not prepared by or for the investment adviser”. Keeping sent and received mail in full, apart from the exclusions above, means no one decides that message by message.

Review is narrower than capture, as the lead says. Pattern matching and AI triage, the steps that put a message in a reviewer’s queue, work the same way on Google and on Microsoft. That is a deliberate product decision, not a limit of Google.

The five-year floor sits in paragraph (e)(1), which lists the record types it excepts:

(e)(1) All books and records required to be made under the provisions of paragraphs (a) to (c)(1)(i), inclusive, and (c)(2) of this section (except for books and records required to be made under the provisions of paragraphs (a)(11), (a)(12)(i), (a)(12)(iii), (a)(13)(ii), (a)(13)(iii), (a)(16), and (a)(17)(i) of this section), shall be maintained and preserved in an easily accessible place for a period of not less than five years from the end of the fiscal year during which the last entry was made on such record, the first two years in an appropriate office of the investment adviser.

17 CFR 275.204-2(e)(1)^[7]

Google’s limits are per user. Its error documentation says a 403 userRateLimitExceeded “occurs when a request reaches the per-user limit”, and states: “You can’t increase per-user limits.”^[5] So the lever left to an archiver is how fast it reads.

Turret paces each mailbox separately, with its own budget for megabytes per hour and for fetches per second. When Turret pulls history, that pace can be slower during the firm’s working hours and faster at night. The hours follow the timezone set in Turret, UTC until the firm sets one. If Google answers a mailbox with a rate-limit or quota error, Turret halves that mailbox’s pace for the run and does not raise it again. It chooses slow over failed.

Authorizing the grant is one step. Pulling history is a separate job. The trial backfills 90 days of mail, and the full-retention backfill starts at the first real charge. How long the backfill takes depends on mailbox size and Turret’s pacing.

Suspend a departing person’s Google account rather than deleting it. Google’s restore window is counted from deletion: “You can restore a user account (including administrator accounts) up to 20 days after deleting it.” And then: “After 20 days, the data is gone and you can’t restore it.”^[6] Anything Turret had not already archived by then cannot be fetched from Google.

When Turret sees a Google mailbox move from active to suspended, it queues one final archive pass over that mailbox’s sent and received mail. If a leaver’s mail matters, check that it is archived before you touch the account, and delete only after. Suspended accounts do not count toward billed mailboxes in Turret.

Google Vault is Google’s retention and legal-hold tool, and your Workspace edition may already include it. Whether it satisfies Rule 204-2 for your firm is its own question: Is Google Vault enough for SEC Rule 204-2?

On storage, Rule 204-2(g)(2)(iii) says the adviser must “Separately store, for the time required for preservation of the original record, a duplicate copy of the record”, and (g)(3)(i) calls for procedures to “reasonably safeguard them from loss, alteration, or destruction”.^[7] Whether a given setup, Vault or an archiver, meets those is a judgment for your CCO and counsel.

If you run a firm on Google Workspace and want an archiver:

1. Pick the person. Only a super administrator can add the grant. If that is an outside IT provider, send them the menu path and the two scopes, and ask for a screenshot of the finished entry.
2. Authorize narrowly. Enter the client ID and exactly the two scopes. Do not accept an archiver that asks for broader ones.
3. Allow for propagation. Google says changes can take up to 24 hours. If the first connection check fails, confirm the client ID and the scope string, then allow for that window before trying again.
4. Confirm the result. “Manage Domain Wide Delegation” should show one client ID and two scopes for this vendor, and every mailbox you expect should appear in the app. When someone leaves later, suspend the account; do not delete it.
5. Know the exit. Revoking is in the same menu. Export and cancellation terms are on the security page.

On Google Workspace, Turret connects through the one grant described above, archives sent and received mail, and puts outbound mail in a reviewer’s queue. Email is $99/mo including 5 monitored mailboxes, then $25 per additional monitored mailbox, with no setup fee, and a 15-day free trial with the card taken at the end of setup. More on /security and /email-compliance. Firms on Microsoft 365 have a separate page.

Sources opened October 17, 2026.

1. Google, “Control API access with domain-wide delegation”
2. Google, Gmail API scopes (gmail.readonly)
3. Google, Admin SDK Directory API, authorizing requests (admin.directory.user.readonly)
4. Google, Gmail search operators (in:anywhere)
5. Google, Gmail API error handling (userRateLimitExceeded)
6. Google, “Restore a recently deleted user”
7. eCFR, 17 CFR 275.204-2, Books and records to be maintained by investment advisers (text as of eCFR 2026-10-15)
8. Google Vault, "How retention works in Vault" (knowledge.workspace.google.com)
9. Google Vault overview (knowledge.workspace.google.com)
10. Google Vault FAQ (knowledge.workspace.google.com)