Business Email & Office Suites
Google Workspace
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Google LLC · workspace.google.com
Compare with Microsoft 365 Business → Compare with Infomaniak kSuite → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Google Workspace at a glance
- Vendor
- Google LLC
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 5 Nov 2026
- Starting price
- “€3.40€6.80**/ user per month 1 user = €3.40 / mo. (EUR)” (vendor’s words) source, captured 5 Nov 2026
- Panel verdict
- The AI panel rates Google Workspace 2.5/5, the mean of 6 judges. Google Workspace is Google LLC's business email and office suite, and the bench scored it strongest where the bundle is thickest: calendar and office sits at 6 throughout (minimum 6, maximum 6), with Gmail, Meet, Chat, Calendar, Drive, Docs, Sheets and Slides on every plan and Office-file interoperability stated throughout, while pricing transparency clusters at 6-7 with euro prices published for all three business tiers. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Google Workspace is Google LLC's business email and office suite, and the bench scored it strongest where the bundle is thickest: calendar and office sits at 6 throughout (minimum 6, maximum 6), with Gmail, Meet, Chat, Calendar, Drive, Docs, Sheets and Slides on every plan and Office-file interoperability stated throughout, while pricing transparency clusters at 6-7 with euro prices published for all three business tiers. The weak edges are migration and portability and sovereignty: the judges found no public information on what the Google Workspace Migrate tool carries over, on export formats, or on data return when a contract ends, and the privacy policy states that servers operate worldwide and data may be processed outside the user's country. Security and compliance spans 5-7 and mail 4-6; the gaps behind the lower scores are certifications with scope, encryption at rest, and SPF, DKIM and DMARC details. The flagged split check flagged none.
Speaks for it
- Every plan bundles Gmail, Meet, Chat, Calendar, Drive, Docs, Sheets and Slides, with Office-file interoperability stated for all plans
- All three business tiers publish euro prices with both the introductory offer (first 20 users, 12 months, new customers only) and the regular figure — €3.40 then €6.80, €6.80 then €13.60, €10.55 then €21.10 per user per month
- Vault to retain, archive and search data with eDiscovery arrives from the Plus plan, and S/MIME encryption from the Enterprise tier
- Custom-domain mail comes with documented IMAP, send-as aliases, delegation within one organisation, and spam protection quoted at blocking more than 99.9% of attacks
- Administrators can select a European Union data region for covered editions and view data regions status reports
Held against it
- Migration and portability scores sit at 4-5: we found no public information on what the Google Workspace Migrate tool moves, on export formats, or on organisation-wide export when a contract ends
- Mail scores span 4-6: we found no public information on SPF, DKIM or DMARC, catch-all, native Outlook connectivity, or send and attachment limits
- We found no public information on certifications published with their scope, encryption at rest, GoBD-compliant archiving, legal hold, or a transparency report on authority requests
- Administration scores span 4-6: we found no public information on single sign-on, directory synchronisation, SCIM provisioning, exportable audit logs or support response times
- The European Union region option covers only listed editions — Business Starter is not among them — and the privacy policy states that servers operate worldwide and that data may be processed outside the user's country
Best for
- You need mail, calendar, documents and video meetings in one bundle for an organisation of up to 300 users, billed monthly in euro per user
- You plan around a known second-year price, since every tier states both the introductory price for the first 20 users over 12 months and the regular per-user price
- Your team works through delegated shared mailboxes, reading, sending and deleting on another account's behalf within the same organisation
- You want a published Cloud Data Processing Addendum and an admin-selectable European Union data region, available on listed editions such as Business Standard and Business Plus
Avoid if
- Your organisation runs on Outlook and Exchange protocols — the documented client path here is IMAP with OAuth 2, and native Outlook connectivity is among the points to verify with the vendor first
- You must keep processing inside a single jurisdiction — the privacy policy itself states that servers operate worldwide and that data may be processed outside the user's country
- You want a European Union region at the Starter price — data regions apply to the listed editions, and Business Starter is not on that list
- You need an audited exit plan for the whole organisation — the captured pages document per-user export of account contents and deletion of the entire account, not an administrator-led organisation-wide return
The scores
| Criterion | Panel median |
|---|---|
| Mail, domains & deliverability | 3 of 5 |
| Calendar, contacts & office apps | 3 of 5 |
| Security, encryption & compliance archiving | 3 of 5 |
| Administration, identity & partner management | 2.5 of 5 |
| Migration, open standards & exit | 2 of 5 |
| European sovereignty | 2.5 of 5 |
| Pricing transparency | 3.5 of 5 |
Mail, domains & deliverability
Show reasoningHide reasoning
How this is scored
How well the mailbox itself works: custom domains and their DNS set-up, aliases, catch-all, shared and functional mailboxes, distribution lists, mailbox and attachment size limits, IMAP, POP3, SMTP and Exchange ActiveSync or MAPI for Outlook, web and mobile apps, spam and malware filtering, SPF, DKIM, DMARC and MTA-STS, out-of-office and server-side rules, send limits, and the delivery reputation of the sending infrastructure. A self-hosted groupware is judged on the mail server it ships; a suite whose mail app is only a client for another server scores at the level of that client.
0 — No mailbox at all; a product that only sends transactional mail or only reads another provider's mail without a server of its own or a documented one to pair it with.
3 — Mailboxes on a custom domain with IMAP and SMTP and a webmail; aliases, shared mailboxes, filtering and DKIM or DMARC are basic or not described.
5 — Several custom domains with a documented DNS set-up, aliases and distribution lists, shared or functional mailboxes, IMAP and SMTP plus mobile apps, spam and malware filtering, SPF and DKIM signing, mailbox size per plan stated, server-side rules and out-of-office replies.
8 — Exchange ActiveSync or native Outlook (MAPI) support, DMARC reporting and MTA-STS or DANE, catch-all and plus addressing, delegated access and send-as, quarantine an admin can review, send and attachment limits stated, and the deliverability of the outbound infrastructure documented.
10 — A mail platform a large organisation runs on: every protocol above with feature parity stated per client, inbound and outbound gateways configurable, journaling, DANE and MTA-STS enforced, delivery monitoring and bounce analysis for admins, and mail flow documented end to end.
The Small Firm Owner
Custom-domain mail is confirmed, with IMAP documented, send-as aliases with per-address signatures, delegation across the organisation (read, send, delete, contacts), server-side rules and forwarding, and phishing and spam protection that blocks more than 99.9% of attacks. Delegation covers our shared kanzlei mailbox style of working. But we found no public information on Outlook connectivity (MAPI or Exchange ActiveSync), on SPF, DKIM, DMARC or catch-all — and my whole staff lives in Outlook. 7 8
The IT Administrator
Mailboxes on the company domain with IMAP, send-as aliases, delegation inside the organisation and server-side filters are documented, spam and phishing protection is quoted at blocking more than 99.9% of attacks, and Postmaster Tools exists for delivery monitoring. For my Outlook population, though, we found no public information here on ActiveSync or MAPI, DKIM/DMARC, catch-all, or send and attachment limits. 7 8
The Public Sector IT Lead
Secure custom business email comes with send-as aliases and per-address signatures, delegation to read, send and delete on another account's behalf, server-side filters with forwarding, documented IMAP, and phishing and spam protection that blocks more than 99.9% of attacks, plus Postmaster Tools for outbound delivery. We found no public information on SPF, DKIM, DMARC or MTA-STS signing policies, on Exchange ActiveSync or Outlook connectivity, on catch-all, an admin-reviewable quarantine, or send and attachment limits — items a district administration would want in writing before migrating. 7 8
The IT Service Provider
Custom-domain business mail with documented IMAP (XOAUTH2), send-as aliases with per-address signatures, delegation within the organisation, server-side filter and forwarding rules, and stated spam and phishing protection blocking more than 99.9% of attacks, plus Postmaster Tools for monitoring outbound delivery. We found no public information on SPF, DKIM or DMARC set-up, MTA-STS, native Outlook connectivity, catch-all addresses or an admin-reviewable quarantine — and that DNS authentication work is precisely what fills our Mondays. 7 8
The Data Protection Officer
The mailbox sits on a custom domain with IMAP sign-in via OAuth 2, server-side filters acting on sender, subject and size, send-as aliases, delegation within the organisation, and spam and phishing protection claimed at more than 99.9 percent of attacks blocked; storage per plan is stated at 30 GB, 2 TB and 5 TB. I found no public information on DNS set-up for domains, SPF, DKIM or DMARC signing, distribution lists, catch-all, out-of-office replies or Outlook protocols on the pages I read, which keeps this below the mid anchor. 7 8
The Skeptic
Custom-domain mail is confirmed, with documented IMAP (XOAUTH2), server-side filters, send-as aliases, in-organisation delegation, and spam protection quoted as blocking "more than 99.9% of attacks", plus Postmaster Tools for sender reputation. We found no public information on native Outlook connectivity via Exchange ActiveSync or MAPI, on SPF, DKIM, DMARC or MTA-STS, on catch-all, or on stated send and attachment limits, so the evidence falls short of the upper anchors. 7 8 10
Calendar, contacts & office apps
Show reasoningHide reasoning
How this is scored
What the office plans and writes with: shared and team calendars, free/busy lookup, meeting invitations across providers, room and resource booking, shared address books and a company directory, CalDAV and CardDAV or ActiveSync for phones, Outlook calendar sync, tasks, online office documents with co-editing, file storage that comes with the suite, video meetings and chat inside the bundle, and the desktop and mobile apps.
0 — Mail only, with no calendar or contacts of any kind.
3 — A personal calendar and address book in the webmail; sharing, resources, sync protocols and office apps are basic or not described.
5 — Shared calendars and address books, meeting invitations with free/busy lookup, CalDAV and CardDAV or ActiveSync sync to phones and desktop clients, a company-wide address book, tasks, and either online office documents or a documented integration with an office suite.
8 — Room and resource booking with approval, delegated calendar access, Outlook calendar and contacts sync documented, co-editing of documents and spreadsheets in the browser, file storage with sharing, video meetings in the bundle, and apps for desktop, iOS and Android.
10 — A full office suite that replaces Microsoft 365 for a whole organisation: every function above with Microsoft file formats edited without loss, scheduling across organisations, resource planning, offline editing, an accessible interface stated against a standard, and feature parity across web, desktop and mobile documented.
The Small Firm Owner
The bundle includes Calendar, Meet, Chat, Drive, Docs, Sheets and Slides with interoperability with Office files on all plans, shared drives per plan, video meetings up to 24 hours, and appointment booking from the Standard plan — that is the core of what a twelve-person office writes and plans with. We found no public information on free/busy lookup, room and resource booking, CalDAV or CardDAV sync to phones, or Outlook calendar sync, which is exactly the shared-calendar-on-every-phone question I need answered. 7 8
The IT Administrator
This is a genuine office bundle — Calendar, Meet, Chat, Drive, Docs, Sheets and Slides are included, interoperability with Office files is stated for all plans, shared drives and video meetings up to 1,000 participants are tiered, and appointment booking starts at Standard. We found no public information on room and resource booking with approval, free/busy across providers, CalDAV or CardDAV, or Outlook calendar sync — the calendar pieces an Exchange shop lives on. 8
The Public Sector IT Lead
The bundle includes Gmail, Meet, Chat, Calendar, Drive, Docs, Sheets, Slides, Forms, Sites and Keep, interoperability with Office files on all plans, shared drives, and video meetings from 100 up to 1,000 participants with recording and a 24-hour maximum length. We found no public information on shared calendars with free/busy lookup, room and resource booking, CalDAV or CardDAV sync, co-editing, or apps for desktop and mobile, so I cannot confirm the functions a whole administration works in daily. 8
The IT Service Provider
Every plan bundles Gmail, Meet, Chat, Calendar, Drive, Docs, Sheets, Slides, Forms, Sites and Keep, with Office-file interoperability, support for over 100 file types, shared drives, appointment booking, e-signatures, and video meetings scaling from 100 to 1,000 participants with recording and attendance tracking. We found no public information on room and resource booking, delegated calendar access, free/busy across providers, CalDAV or CardDAV sync, or the desktop and mobile apps. 8
The Data Protection Officer
Every plan bundles Calendar, Meet, Chat, Drive, Docs, Sheets and Slides, with meetings up to 24 hours and up to 1,000 participants on Enterprise, shared drives, interoperability with Office files, eSignature from the Standard plan and appointment booking — that is well past office documents alone. Free/busy lookup, shared calendars, CalDAV or CardDAV sync, room and resource booking, delegated calendar access and apps per platform are not described on the captured pages, so the top of the range is out of reach on this evidence. 8
The Skeptic
The bundle names Gmail, Meet, Chat, Calendar, Drive, Docs, Sheets, Slides and Forms, with meeting participants scaling from 100 to 1,000, shared drives, appointment booking, eSignature and claimed Office-file interoperability on all plans, and mail delegates can also view and add contacts. We found no public information on free/busy lookup across providers, room and resource booking, CalDAV or CardDAV sync, Outlook calendar sync, or desktop and mobile apps, which keeps this below the level an organisation would migrate onto. 7 8
Security, encryption & compliance archiving
Show reasoningHide reasoning
How this is scored
How mail and documents are protected and kept: TLS enforced in transit, encryption at rest, end-to-end encryption or S/MIME and PGP, who at the provider can read a mailbox, two-factor authentication and passkeys, phishing, malware and account-takeover protection, audit-proof archiving that meets GoBD, retention policies and legal hold, eDiscovery, backups and restore of deleted mail, a transparency report on authority requests, and certifications (ISO 27001, BSI C5, SOC 2) with their scope.
0 — No security information of any kind; no encryption, two-factor sign-in or archiving stated.
3 — Encrypted connections and a password login; encryption at rest, two-factor sign-in, archiving and certifications are basic or not described.
5 — TLS in transit and encryption at rest stated, two-factor authentication, spam, phishing and malware protection, restore of deleted mail for a stated period, archiving offered (built in or as an add-on), and a certification such as ISO 27001 stated for the data centres or the service.
8 — End-to-end encryption, S/MIME or PGP supported, GoBD-compliant archiving documented, retention policies and legal hold, enforced two-factor or passkeys for all users, a transparency report on authority requests, and certifications such as ISO 27001 or BSI C5 published with their scope and auditor.
10 — Security that holds up in an audit of a regulated organisation: zero-access or customer-held keys where the provider cannot read mail, eDiscovery, tamper-proof archive with documented verification, every certification published with its report or attestation available, independent security audits or open-source code reviewed, and incident disclosure documented.
The Small Firm Owner
Two-step verification, encryption in transit, S/MIME at Enterprise, and Vault to retain, archive and search data with eDiscovery from the Plus plan are stated, and the Cloud Data Processing Addendum is incorporated into the agreement — the archive matters most for a tax office. We found no public information on GoBD-compliant archiving, legal hold, a transparency report on authority requests, or certifications such as ISO 27001 with their scope, and encryption at rest is not stated on the captured pages either. 8 9 10
The IT Administrator
Transport encryption and two-step verification are stated, S/MIME arrives with the Enterprise tier, Vault to retain, archive and search data plus eDiscovery come from Plus, and DLP, a security center and access transparency sit on Enterprise. The captured pages give no certifications, no encryption at rest, no GoBD archiving and no transparency report on authority requests — exactly what my compliance officer would demand before signing. 8 9 10
The Public Sector IT Lead
Encryption in transit and two-step verification are stated, Vault to retain, archive and search data comes from the Plus tier, eDiscovery from Plus and S/MIME encryption from Enterprise, with a security center and DLP above that. We found no public information on encryption at rest, on any certification such as ISO 27001 or BSI C5 with its scope and auditor, on GoBD-compliant archiving, retention and legal hold, or on restoring deleted mail — for a public body in Bavaria these are exactly the papers I must show the auditor. 8 10
The IT Service Provider
Encryption in transit and two-step verification are stated, the plans add Vault for retaining, archiving and searching data with eDiscovery from the Plus tier, S/MIME on Enterprise, plus DLP, security center, context-aware access and access transparency on the Enterprise tiers, and company data is stated not to be used to train Gemini models. We found no public information on encryption at rest, GoBD-compliant archiving, retention policies and legal hold, a transparency report on authority requests, or certifications such as ISO 27001 or BSI C5 with their scope — the questions my clients' auditors ask first. 8 10
The Data Protection Officer
Encryption in transit, two-step verification and spam protection are stated, S/MIME arrives only with the Enterprise plan — the encryption our referral letters to outside doctors would need — and Vault for retention, archiving and search plus eDiscovery start at the Plus plan, with data loss prevention and access transparency higher up. The privacy policy itself records that servers are operated worldwide, that data may be processed outside the user's country, and that the domain administrator and reseller can access the account; I found no public information on encryption at rest, GoBD-compliant archiving, legal hold, restore periods for deleted mail, certifications, or a transparency report on authority requests — for patient correspondence that weighs heavily. 8 10
The Skeptic
Encryption in transit, two-step verification and Safe Browsing are stated, S/MIME arrives only at the Enterprise tier, and Vault to "retain, archive, and search data" with eDiscovery comes from the Plus tier. We found no public information on encryption at rest, GoBD-compliant archiving, retention policies and legal hold, a transparency report on authority requests, restore of deleted mail, or any certification published with its scope — for a tax audit or a regulated buyer, that is the part I cannot verify from these pages. 6 8 10
Administration, identity & partner management
Show reasoningHide reasoning
How this is scored
How an IT team or an IT service provider runs it: an admin console for users, groups, mailboxes and domains, admin roles, single sign-on (SAML or OpenID Connect), sync with Active Directory, Entra ID or LDAP, SCIM provisioning, mobile device policies and remote wipe, audit logs of admin and user actions, usage reports, a documented API for provisioning, multi-tenant or reseller accounts for partners managing several customers, and the support channels and response times per plan.
0 — No administration; one login per mailbox and nothing managed centrally.
3 — A web console to add mailboxes and aliases; roles, single sign-on, directory sync and audit logs are basic or not described.
5 — An admin console for users, groups, mailboxes and domains, admin roles, two-factor sign-in enforceable by the admin, password policies, a documented API or command line for provisioning, an activity or audit log, and business support by phone or ticket stated per plan.
8 — Single sign-on (SAML or OpenID Connect), Active Directory, Entra ID or LDAP sync, SCIM provisioning, mobile device policies with remote wipe, audit logs exportable, delegated administration, partner or reseller accounts that manage several customer organisations, and support response times stated.
10 — Administration that scales across many organisations: every setting reachable by API with parity stated, granular role scopes, policies by group, logs streamed to a SIEM, white-label partner offerings with separate billing, and an SLA with service credits published.
The Small Firm Owner
An admin console is documented — administrators apply data region policies by organisational unit and can view status reports — and endpoint management is listed per plan, with Secure LDAP, security center, context-aware access and access transparency at Enterprise, plus Standard, Enhanced and Premium support tiers. We found no public information on single sign-on as such, SCIM provisioning, exportable audit logs, reseller accounts for managing several customers, or stated support response times. 6 7 8 10
The IT Administrator
An admin side is evidenced — administrators manage data regions and view status reports, endpoint management is tiered, and Secure LDAP plus Cloud Identity Premium sit on Enterprise — and a RESTful Gmail API is documented, though it covers mailbox access and sending rather than provisioning. We found no public information on Active Directory or Entra sync, SAML or OpenID Connect single sign-on, SCIM provisioning, remote wipe, audit logs or support response times, which is precisely how I run three hundred accounts from our AD. 6 7 8 10
The Public Sector IT Lead
Administrators can set data region policies and view status reports, endpoint management runs in Fundamental, Advanced and Enterprise levels, Secure LDAP, context-aware access, DLP and a security center sit at Enterprise, a documented RESTful Gmail API covers mailbox access, sending, push notifications and organisation-wide signature standardisation, and the privacy policy states that domain administrators and resellers manage accounts. We found no public information on single sign-on via SAML or OpenID Connect, directory synchronisation with Active Directory or Entra ID, SCIM provisioning, exportable audit logs, or support response times per plan. 6 7 8 10
The IT Service Provider
Administrators set data-region policies and view status reports, endpoint management runs from Fundamental through Enterprise with Secure LDAP and Cloud Identity Premium on the top tiers, and the privacy policy confirms domain administrators and resellers manage customer accounts, with support upgrades named Standard, Enhanced and Premium. We found no public information on a partner console for managing several customer organisations, single sign-on, SCIM provisioning, remote wipe, exportable audit logs, or support response times — the things a six-person shop like mine needs before it can promise a client an answer within the hour. 6 8 10
The Data Protection Officer
Administrators manage data regions from the Google Admin console with status reports, endpoint management scales from Fundamental to Enterprise, and Secure LDAP, context-aware access, the security center and data loss prevention sit at the Enterprise tier, with reseller access to accounts confirmed in the privacy policy and support named as Standard, Enhanced and Premium. I found no public information on single sign-on, directory synchronisation, SCIM provisioning, remote wipe, exportable audit logs, delegated administration or support response times, and the documented API addresses mailboxes rather than provisioning. 6 8 10
The Skeptic
An administrative layer is evidenced by admin-managed data regions with status reports, tiered endpoint management, context-aware access, DLP, a security center, "Secure LDAP" and Cloud Identity Premium at Enterprise, and the privacy policy states that domain administrators and resellers manage accounts. We found no public information on single sign-on via SAML or OpenID Connect, Active Directory or LDAP synchronisation, SCIM provisioning, admin roles, exportable audit logs, or support response times; support appears only as named paid upgrade tiers. 6 8 10
Migration, open standards & exit
Show reasoningHide reasoning
How this is scored
How the organisation gets in and out: migration from Exchange, Microsoft 365, Google Workspace or another IMAP provider with a documented tool or service, mail, calendars and contacts carried over, coexistence during a move, standard protocols (IMAP, CalDAV, CardDAV, JMAP, open document formats) rather than proprietary ones, export of a mailbox and of the whole organisation in standard formats (mbox, EML, PST, ICS, vCard), open-source code or a self-hosted edition, what happens to data when the contract ends, and how domains and DNS are handed back.
0 — No way to bring mail in or take it out; a proprietary store with no IMAP access or export.
3 — IMAP access to mail; a migration path, calendar and contacts export and the end-of-contract handling are basic or not described.
5 — A documented migration from Exchange, Microsoft 365 or Google (a tool, an import or a service), mail, calendars and contacts imported, IMAP, CalDAV and CardDAV or ActiveSync access, export of mail, calendars and contacts in standard formats, and the deletion of data after the contract ends stated.
8 — A migration service or tool that moves whole organisations with calendars and permissions, coexistence with free/busy during the move, open document formats supported natively, export of the whole organisation by the admin, an open-source code base or a self-hosted edition, and a data return period after cancellation stated.
10 — An exit that costs nothing but time: every record exportable in open formats with the method documented, a self-hosted open-source edition with feature parity stated, migration in and out documented with the same tools, and a contractual data return and deletion with confirmation.
The Small Firm Owner
A Google Workspace Migrate tool for data migration is available from the Standard plan, IMAP is documented, email account migration is an explicit API use case, and users can export a copy of their contents and delete their whole account — a real door in and out for our client correspondence. We found no public information on whether the tool moves whole organisations with calendars, contacts and permissions from Exchange or Microsoft 365, on coexistence during the move, on CalDAV and CardDAV access, or on a stated data-return period after cancellation. 7 8 10
The IT Administrator
A Google Workspace Migrate tool is listed from the Standard tier and the API names email account migration as a use case, IMAP is documented, and users can export a copy of their content or delete the entire account. The pages do not say what the migration tool moves — calendars, contacts, mailbox permissions — nor anything about coexistence with free/busy, admin-level export of the whole organisation, or a data-return period after cancellation. 7 8 10
The Public Sector IT Lead
A Google Workspace Migrate tool is listed from the Standard tier, IMAP access is documented, the Gmail API names email account migration and read-only extraction, indexing and backup among its uses, users can export a copy of their contents for use with another service, and an entire account can be deleted. The captured pages do not show what the migrate tool moves, export in standard formats, organisation-wide export by an administrator, coexistence during a move, or a stated data-return period after cancellation — my council asked for the exit plan before signing, and I cannot see one here. 7 8 10
The IT Service Provider
A Google Workspace Migrate tool is listed from the Standard plan upward, IMAP with XOAUTH2 is documented for read-only extraction and account migration, and account holders can export a copy of their content, auto-delete activity data or delete the entire account. We found no public information on what the migrate tool actually carries over, CalDAV or CardDAV access, an organisation-wide export performed by the administrator, or the handling of data when the contract ends. 7 8 10
The Data Protection Officer
A Google Workspace Migrate tool is documented from the Standard plan, the Gmail API lists account migration and read-only extraction and backup as use cases, and a user can export a copy of their Google account contents and delete the entire account. IMAP access is documented; export of calendars and contacts in standard formats, CalDAV or CardDAV, coexistence during a move and what happens to the data when the contract ends are not described on the pages I read, so the way in and out is sketched but not proven for a whole organisation. 7 8 10
The Skeptic
IMAP is documented, the Gmail API lists "Email account migration" among its use cases, a Google Workspace Migrate tool is included from the Standard tier, and users can export a copy of their contents, delete their account, and configure automatic deletion. We found no public information on which source systems the migrate tool covers, on export formats such as mbox, EML, PST or ICS, on calendar and contacts export, or on how a whole organisation's data is returned when the contract ends — ten years of mail deserves more than a personal account export. 7 8 10
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where mailboxes, calendars, contacts, documents and backups are stored and processed, who at the provider or its subprocessors can access them, and who the subprocessors are (data centres, spam filtering, support, payment, AI features). Independently sourced by the sovereignty pipeline. An EU data region offered by a non-EU parent is part of the chain, not the whole of it. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (spam filtering, support, backups, AI features) run through non-EU providers or a non-EU parent without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5) stated — or a self-hosted edition documented that keeps every mailbox on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Small Firm Owner
Google Ireland Limited is named as controller for users in the European Economic Area, the Cloud Data Processing Addendum is published, and administrators can choose a European Union data region — but only on covered editions (Business Standard and Plus, not the Starter plan), while the privacy policy states plainly that Google operates servers worldwide and data may be processed outside one's own country. The parent is Google LLC in California. We found no public information on named hosting infrastructure, subprocessors and their locations, or certifications such as ISO 27001 or BSI C5 on the captured pages. 6 9 10
The IT Administrator
Administrators can pin covered data to a European Union region with the covered editions listed, Google Ireland Limited is the responsible entity for users in the EEA and Switzerland, and a Cloud Data Processing Addendum is published and incorporated into the agreement. Against that stand servers operated worldwide with processing outside the user's country possible, a US parent, uncovered editions and separately managed AppSheet residency, and no named subprocessors or certifications on these pages. 6 9 10
The Public Sector IT Lead
An EU data region is selectable in the admin console for named editions, Google Ireland Limited in Dublin is the responsible controller for users in the European Economic Area and Switzerland, and a current Cloud Data Processing Addendum is published and incorporated into the agreement. Against that stand a United States parent at 1600 Amphitheatre Parkway, Mountain View, the statement that servers operate worldwide and data may be processed outside the user's country, and region caveats such as cross-region messages stored in both regions and AppSheet residency managed separately; we found no public information on named hosting infrastructure or a list of subprocessors with their locations. 6 9 10
The IT Service Provider
Administrators can pin covered data to a European Union region, Google Ireland Limited is the named controller for users in the EEA and Switzerland, and a current Cloud Data Processing Addendum is published; the same pages state servers run worldwide with processing outside the user's country possible, and the region option covers only the listed editions — Business Starter is not on that list. We found no public information on named hosting infrastructure, the subprocessors and their locations, or certifications covering the chain. 6 9 10
The Data Protection Officer
For users in the European Economic Area the privacy policy names Google Ireland Limited in Dublin as controller, the Cloud Data Processing Addendum is published and incorporated into the agreement, and administrators can pin covered data to a European Union region. The same pages say servers run worldwide with processing outside the user's country possible, the parent in Mountain View serves UK users as controller, and the region policy has documented edges — only listed editions are covered, AppSheet residency is managed separately, and direct messages between regions are stored in both. Subprocessors are not listed and I found no public information on certifications for the chain, so as a data protection officer I cannot verify who else touches the mail. 6 9 10
The Skeptic
A European Union data region is selectable for listed editions, Google Ireland Limited is the stated controller for users in the EEA and Switzerland, and a current Cloud Data Processing Addendum is incorporated into the agreement. The same privacy policy states that Google operates servers worldwide and that data may be processed outside the user's country, Google LLC in California is the controller for the United Kingdom, and editions not on the supported list are not covered by data region policies at all; we found no public information on named infrastructure, subprocessor locations, or certifications with their scope. 6 9 10
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or mailbox per tier, storage per user, what shared mailboxes, aliases and extra domains cost, which features (archiving, office apps, SSO, advanced security, more storage) cost extra, the first-year discount and the regular price after it, minimum users and term, monthly versus annual billing, and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price per user exists, but how cost scales with storage, users, add-ons or after the first year is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (archiving, extra storage, shared mailboxes, SSO, the price after the introductory period) is unpriced or "on request".
8 — Every tier priced publicly per user with storage, add-ons priced, the regular price after any introductory discount stated, minimum users and term stated, monthly and annual billing compared, and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of users, storage and add-ons, with every support, migration and archive fee and the cancellation and data-return terms published.
The Small Firm Owner
Every business tier carries a public per-user monthly price with the regular price after the introductory year spelled out — €3.40 then €6.80 for Starter, €6.80 then €13.60 for Standard, €10.55 then €21.10 for Plus, the offer applying to the first 20 users for 12 months for new customers — alongside pooled storage of 30 GB, 2 TB and 5 TB per person, a 16% saving with a one-year commitment, a 300-user cap on business plans, and all plans billed monthly in euro. That second-year number is exactly what I plan around. What the pages do not state is VAT treatment or prices for add-ons such as the Enhanced and Premium support upgrades. 8
The IT Administrator
Prices are public for three tiers with both introductory and regular per-user figures (the introductory price covering the first 20 users for 12 months), storage per tier from 30 GB pooled to 5 TB per user, a 300-user cap on business plans, monthly billing and a stated 16% saving on annual commitment. Not computable from the captured pages: the Enterprise tier's price, support upgrades described only as a paid upgrade, and VAT treatment. 8
The Public Sector IT Lead
Starter, Standard and Plus are priced at €3.40, €6.80 and €10.55 per user per month, with the introductory price available for the first 20 users for 12 months for new customers and the regular prices of €6.80, €13.60 and €21.10 stated, alongside pooled storage of 30 GB, 2 TB and 5 TB per user, a 16% saving with a one-year commitment, and the 300-user cap on business plans. VAT treatment, Enterprise pricing and the cost of the paid support upgrades are not shown, so the full annual cost of a large deployment cannot be computed from these pages alone. 8
The IT Service Provider
All three small-business tiers are priced publicly in EUR per user per month — €3.40 introductory and €6.80 regular on Starter, €6.80 and €13.60 on Standard, €10.55 and €21.10 on Plus — with pooled storage of 30 GB, 2 TB and 5 TB, the introductory offer limited to the first 20 users for 12 months for new customers, a stated 16% saving on annual commitment, and a 300-user ceiling on the business plans. We found no public information on VAT treatment, prices for the Enterprise tier and the support upgrades, or the cost of aliases and extra domains — so my margin calculation for a hotel group quote still has gaps. 8
The Data Protection Officer
All three business plans carry a per-user monthly euro price with both the introductory price for the first 20 users over 12 months and the regular price afterwards stated — €3.40 then €6.80, €6.80 then €13.60, €10.55 then €21.10 — alongside storage of 30 GB, 2 TB and 5 TB, a 300-user cap on business plans, no minimum for Enterprise, and a 16 percent saving stated for annual commitment against monthly billing. I found no public information on VAT treatment, the price of the Enhanced and Premium support upgrades, or Enterprise pricing, which is what keeps the annual cost largely but not fully computable. 8
The Skeptic
Three tiers are priced publicly in euros with both the introductory price (first 20 users, 12 months, new customers only) and the regular price stated — €3.40 then €6.80, €6.80 then €13.60, €10.55 then €21.10 per user per month — plus pooled storage of 30 GB, 2 TB and 5 TB per user, a 300-user cap on business plans, monthly billing and a 16% annual-commitment saving. We found no public information on Enterprise pricing, VAT treatment, or the cost of support upgrades, aliases and extra domains, so the real annual cost of a full deployment is not computable from public pages alone. 8
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Google Workspace
Is Google Workspace European?
No. whats-best.ai classifies Google Workspace as Rest of world.
Where does Google Workspace store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does Google Workspace have a free plan?
Not stated on the vendor’s pages as of 5 Nov 2026.
What are the best alternatives to Google Workspace?
As of 6 Nov 2026, the panel rates grommunio (3.5/5), Infomaniak kSuite (3.5/5) and Nextcloud Hub (Groupware & Office) (3.5/5) highest among the other 14 Business Email & Office Suites products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is grommunio (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Google Workspace alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 162 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 17 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 15 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 14 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (19)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Features page (Gmail) workspace.google.com Checked 5 Nov 2026 Details →
- 2 Features page (Calendar) workspace.google.com Checked 5 Nov 2026 Details →
- 3 Features page (business email) workspace.google.com Checked 5 Nov 2026 Details →
- 4 Features page (migration) workspace.google.com Checked 5 Nov 2026 Details →
- 5 Security / trust page workspace.google.com Checked 5 Nov 2026 Details →
- 6 Documentation (data regions) knowledge.workspace.google.com Checked 5 Nov 2026 Details →
- 7 API documentation developers.google.com Checked 5 Nov 2026 Details →
- 8 Pricing page workspace.google.com Checked 5 Nov 2026 Details →
- 9 Data processing agreement (dpa) cloud.google.com Checked 5 Nov 2026 Details →
- 10 Privacy policy policies.google.com Checked 5 Nov 2026 Details →
- 11 Mail, domains & deliverability — found from sitemap workspace.google.com Checked 5 Nov 2026 Details →
- 12 Mail, domains & deliverability — found from sitemap workspace.google.com Checked 5 Nov 2026 Details →
- 13 Calendar, contacts & office apps — found from sitemap workspace.google.com Checked 5 Nov 2026 Details →
- 14 Calendar, contacts & office apps — found from sitemap workspace.google.com Checked 5 Nov 2026 Details →
- 15 Security, encryption & compliance archiving — found from sitemap workspace.google.com Checked 5 Nov 2026 Details →
- 16 Administration, identity & partner management — found from sitemap workspace.google.com Checked 5 Nov 2026 Details →
- 17 Administration, identity & partner management — found from sitemap workspace.google.com Checked 5 Nov 2026 Details →
- 18 Migration, open standards & exit — found from sitemap workspace.google.com Checked 5 Nov 2026 Details →
- 19 Migration, open standards & exit — found from sitemap workspace.google.com Checked 5 Nov 2026 Details →