Google Workspace Backup Guide: Automated Exports, Afi, Syncthing and Restore Tests

MakeUseOf’s Jack Mitchell describes a combination of cloud-to-cloud protection, Google’s native exports, and local storage replicated with Syncthing. That is a useful starting point, provided one distinction stays front and center: creating a backup, transferring it, and recovering from it are three separate jobs.

Managed cloud backups: check recovery and licensing​

Mitchell highlights Afi as a service for protecting Gmail, Google Drive, Calendar, Contacts, and Shared Drives, with individual-item recovery rather than an all-or-nothing account restore. Afi’s own pricing page advertises automated backups three times daily and a user self-service recovery portal. These are vendor-described capabilities, not results from an independent recovery test.

The price also needs more context than “$3 per month.” Afi’s page displays a $3-per-user monthly starting figure alongside monthly/yearly billing options and says subscriptions start from five users. That is not a $3 total subscription for one person. Obtain a quote that establishes the billing term and protected user count before comparing costs.

Afi’s licensing FAQ further says each protected active user requires a license, with storage contributed to a shared domain pool according to the order form. Deleted users become archived: their existing backups remain available, but new backups are not attempted for those accounts.

For an administrator evaluating this approach, the useful questions are practical:

• Can an individual message or document be restored to the required account?
• What happens to permissions, sharing information, and native Google document formats?
• How long are recovery points retained?
• Who can authorize a restore—or delete backup data?
• What storage allowance and additional charges apply?

The decision: Consider managed backup when application-aware recovery and reduced operational work justify the recurring cost. Treat a successful trial restore, not a feature checklist, as the acceptance test.

Google’s native exports can be automated—but eligibility matters​

Google’s administrator Data Export tool creates archives in Google Cloud Storage that can subsequently be downloaded. Its documentation distinguishes that organization-level workflow from Google Takeout, which lets individual users export their own data. They are not interchangeable tools with identical scheduling options.

There is also an important, verifiable development behind the automation claim: Google announced incremental Workspace exports on June 26, 2026, with rollout beginning June 24. The announcement lists Enterprise Plus customers with the Assured Controls or Assured Controls Plus add-on. It describes periodic full exports supplemented by more frequent incremental runs into an organization-owned Cloud Storage bucket.

That makes incremental administrator exports a real option—not a capability every Workspace subscriber should expect to find.

Set up incremental exports on an eligible account​

Google’s current instructions require a super administrator account generally at least 30 days old, enforced two-step verification, appropriate Assured Controls licenses for exported users, and an authorized customer-owned Cloud Storage bucket. Google Cloud must be enabled for the administrator, and the Workspace subscription must remain active for core-service exports.

The documented workflow is:

1. Open Data → Data import & export → Data export in the Admin console.
2. Select Set up new export, name it, and choose Incremental.
3. Select the users and services. Incremental exports support Drive and Docs, Gmail, and Google Chat, not every Workspace service.
4. Under Date range & type, configure full and incremental export frequency.
5. Enter the customer-owned bucket under Destination, then select Start export.

Afterward, inspect the export’s History and use Actions → View Status Report to identify failures or ineligible items. Completion without reviewing errors is not sufficient evidence that everything was captured.

If the option is missing, check licensing and administrator prerequisites first. If background exports stop, verify that the export service account still has the required bucket permissions.

Takeout is a slower archive option​

For individual accounts, Google Takeout offers scheduled archives every two months for one year. That can suit periodic records preservation; it is not a daily backup schedule. Google also warns that an archive may exclude changes made between the request and archive creation.

The basic process is to select products in Takeout, choose Next step, configure delivery and archive settings, and create the export. Google supports delivery to OneDrive as well as other destinations, but a local-server workflow still needs a separate transfer stage. Scheduling archive creation does not automatically complete the local backup pipeline.

A home server provides storage, not automatic Workspace capture​

Mitchell’s reused-laptop approach offers control over where exported data is stored. His proposed arrangement uses an external drive and Syncthing to replicate export folders to another computer.

The sensible architecture is:

Workspace export or backup → completed archive → local storage → additional protected copy.

For a home-server deployment, plan for disk capacity, restricted access, encryption, operating-system maintenance, and availability during transfers. Keep encryption recovery information somewhere separate and accessible. These are operational recommendations, not evidence that a particular reused laptop has been tested or certified for backup duty.

Prefer dated archive folders over repeatedly overwriting one export. That makes generations easier to identify and recovery exercises easier to document. Also keep a copy outside the continuously synchronized folder—for example, on storage disconnected after a verified copy.

The objective is not merely to own the disks. It is to avoid having every recoverable copy depend on the same machine, credentials, or deletion path.

Syncthing moves archives; versioning adds limited protection​

Syncthing’s documentation explicitly cautions against treating synchronization as a complete backup strategy: modifications and deletions propagate between devices. It does not retrieve Gmail messages or initiate Workspace exports.

Its versioning feature helps, but has precise boundaries:

• It is disabled by default.
• It is configured per folder, per device.
• It archives files replaced or deleted because of changes received from another device.
• It does not preserve the previous version of a file changed locally on that same device.

For example, if a server deletes an archive and that deletion reaches a versioning-enabled desktop, Syncthing can retain the desktop’s previous copy under its configured policy. Delete that file directly on the desktop, however, and the desktop’s own Syncthing versioning does not provide the same safeguard.

That is why enabling versioning is worthwhile—but not a substitute for a separate retention-aware backup.

Make recovery the finish line​

Before declaring the system automatic, run a small recovery exercise:

1. Locate a known document or message in a completed backup.
2. Recover it somewhere safe without overwriting production data.
3. Confirm that its contents and attachments are usable.
4. Record the backup date, recovery steps, and elapsed time.
5. Verify that failures in export creation or transfer produce a notification someone will actually see.

Choose the backup frequency according to how much work you can afford to lose. A two-month archive may be adequate for rarely changing historical records; it is a poor operational target for a busy mailbox.

The strongest setup is not necessarily the most elaborate one. It is the simplest arrangement that captures the required services, preserves older recovery points, separates copies from everyday mistakes, and passes a restore test. Automation should remove repetitive work—not automate confidence in an untested copy.