Google Workspace as SaaS: editions, admin controls and security explained
What Google runs, what the admin controls and what each edition includes, plus a short hardening checklist for small companies on Workspace.
You were made the Google Workspace admin of a 15-person company last week, and nobody told you what you are now responsible for. The short answer: Google runs the service, you run the company’s use of it, and the second job is larger than it looks. This guide shows the split, what each edition costs for your 15 users, and the ten settings to check first.
Google Workspace is the textbook case of software as a service: Gmail, Drive, Docs, Meet and Calendar run on Google’s servers, you use them in a browser, and you pay per user per month. If that model is new to you, What is SaaS? explains it with the same product as one of its examples.
The admin role in plain terms
Think of a serviced office. The landlord keeps the building standing: power, lifts, locks on the front door, cleaning at night. You decide who gets a key, which rooms are shared, what happens to a desk when someone leaves, and whether the meeting room is visible from the street. If a visitor walks out with a folder, the landlord’s locks were fine; the problem was who you gave the key to.
That is the Workspace admin role. Google is the landlord. The Admin console is your key cabinet. Almost every Workspace incident in a small company is a key problem, not a building problem: a file shared with “anyone with the link”, a leaver whose account was never closed, an admin password with no second factor.
What each edition includes, and what 15 users cost
Google sells three Business editions for organizations of up to 300 users, and Enterprise editions above that or for extra controls. The prices below are Google’s US list prices per user per month for the Annual/Fixed-Term Plan and the Flexible Plan, from Google’s billing help page, checked October 2026. The pricing page may show a time-limited introductory discount for new customers; the list prices are what applies afterward. Storage, participants and Vault from Google’s Business editions help page.
| Edition | Annual plan | Flexible plan | What you get |
|---|---|---|---|
| Business Starter | $7 | $8.40 | 30 GB pooled storage per user, Meet for up to 100 participants, Gemini app |
| Business Standard | $14 | $16.80 | 2 TB pooled storage per user, Meet for up to 150 participants, Gemini in Gmail, Docs and Meet |
| Business Plus | $22 | $26.40 | 5 TB pooled storage per user, Meet for up to 500 participants, Vault for retention and eDiscovery |
| Enterprise | Contact sales | Contact sales | Larger storage, more participants, more security and compliance controls |
Example: 15 users, Annual/Fixed-Term Plan, list price, taxes excluded.
- Business Starter: 15 x $7 = $105 a month, or $1,260 a year.
- Business Standard: 15 x $14 = $210 a month, or $2,520 a year.
- Business Plus: 15 x $22 = $330 a month, or $3,960 a year.
On the Flexible Plan the same three numbers are $126, $252 and $396 a month, which is 20% more, in exchange for adding and removing users at any time without a yearly commitment. For a 15-person company the step that matters most is Starter to Standard: $105 more a month buys 2 TB per user instead of 30 GB and larger meetings. The step to Plus is mostly about Vault, which lets you keep and search a leaver’s email and files for legal or compliance reasons.
Who is responsible for what
The table splits seven areas three ways: Google, you as admin, and the individual user. It is built from Google’s Admin Help pages linked below and from the general SaaS responsibility split in What is SaaS?.
| Area | You, the admin | The user | |
|---|---|---|---|
| Hosting and uptime | Runs the service; commits to 99.9% monthly uptime in its SLA | Nothing | Nothing |
| Updates | Ships them to everyone | Reads release notes; turns new features on or off per organizational unit | Nothing |
| Backups | Keeps the platform recoverable | Exports or transfers data before deleting a user; sets retention in Vault (Plus and above) | Restores own files from Drive trash within 30 days |
| Retention after someone leaves | Keeps a deleted user’s data for 20 days, then deletes it permanently | Transfers Drive and Calendar ownership before deletion, or suspends instead of deleting | Nothing |
| Sharing | Provides the controls | Sets the default link access and whether files can leave the organization | Chooses who to share each file with, within your limits |
| Identity | Provides sign-in, 2-Step Verification, passkeys | Enforces 2-Step Verification; assigns admin roles; removes leavers | Enrolls a second factor; keeps recovery info current |
| Devices | Provides endpoint management | Decides which devices can access company data and whether to wipe lost ones | Keeps the device locked and updated |
Three facts in that table come straight from Google’s documentation. Files in Drive trash “are deleted forever after 30 days” (Drive Help). A deleted user account can be restored “for up to 20 days”, and data owned solely by that user that was not transferred first “is permanently deleted” (Admin Help). And Google itself is enforcing 2-Step Verification for administrator accounts (Admin Help). All three checked October 2026.
Checklist
Ten settings for a company of 10 to 50 people, in the order to do them. Each one is in the Admin console; the paths are from Google’s Admin Help as of October 2026.
- Make two admins, not one, and never share the login. Google’s advice and the 20-day rule both assume an admin is available. A single shared admin account is one lost phone away from a locked company.
- Enforce 2-Step Verification for everyone. Security > Authentication > 2-step verification: allow it, then set Enforcement to On, with a new-user enrollment period (Google allows one day to six months) so new hires can sign in on day one. Google’s page notes that enforcement from a chosen date “will start within 24-48 hours”, so use On if you need a precise start.
- Prefer phone prompts or security keys over text messages. The same page offers “Any except verification codes via text, phone call”. Warn users before you switch it on, or they can be locked out.
- Set the default access for new files to named people only. In Drive’s sharing dialog this level is called “Restricted”; the organization-wide default sits next to the external sharing settings in the Admin console. Users can still open a file up; they should have to decide to.
- Decide whether files can leave the organization. Apps > Google Workspace > Drive and Docs > Sharing settings. Off blocks all external sharing; “allowlisted domains” limits it to partners you name. If you allow it, turn on the external indicator so users see a warning.
- Suspend leavers the day they leave, then transfer and delete within 20 days. Suspension keeps the data and the license; deletion without transfer loses the data after 20 days.
- Turn on Vault if you are on Business Plus or above, and set a retention rule. Without it, a deleted email is gone when the user empties the trash.
- Review third-party apps with access to company data. The Admin console lists them under its security settings (API controls). Every “Sign in with Google” an employee accepted is an app that can read something.
- Set recovery options for every account and check them twice a year. The account you cannot recover is the one you will need on a Friday evening.
- Read the Admin console alerts and the Drive audit log once a month. Google logs external sharing events even when the warning indicator is off; the log is where you find the folder that has been public since March.
What changed recently
A dated note for buyers. SaaSCron updates it when Google announces a change that affects what the editions include or cost.
- January 15, 2025: Google included Gemini and NotebookLM Plus in the Business and Enterprise plans with no add-on, and raised Business Standard from $12 to $14 per user per month. Existing customers moved to the new prices from March 17, 2025, or at renewal for annual plans, whichever came later; very small businesses moved from July 7, 2025 (Google announcement).
- February 15, 2023: Google introduced the Annual Plan as a self-serve option and raised Flexible Plan prices by 20% (Business Starter from $6 to $7.20 at the time), with subscriptions of 10 or fewer users exempt until January 2024 (Google announcement).
Common mistakes
- Assuming Google keeps deleted files forever. Drive trash empties after 30 days; a deleted user’s data is gone after 20. Why it happens: “it’s in Google’s cloud” sounds like a backup. Instead: suspend rather than delete, transfer ownership before deleting, and use Vault or an export if you must keep records for years.
- Leaving “anyone with the link” as the default. It is the most convenient setting and the most common leak. Why it happens: nobody changed the default. Instead: set new files to Restricted and let users widen access on purpose.
- Running the company on one shared admin account. Lose the phone with its second factor and nobody can change anything. Why it happens: the person who set up Workspace was in a hurry. Instead: two named super admins with 2-Step Verification, and the day-to-day work done from a normal account.
- Buying Business Plus for the storage when Vault was the reason. Standard’s 2 TB per user is more than a 15-person company typically fills. Why it happens: the edition table leads with storage. Instead: choose the edition for the control you need (retention and eDiscovery with Vault, or the larger meetings), not for the number of terabytes.
Sources
- Google Admin Help: Compare Flexible and Annual/Fixed-Term payment plans; Business editions; Delete or remove a user from your organization; Deploy 2-Step Verification; Manage external sharing for your organization. All checked October 2026.
- Google Drive Help, Delete and restore files in Google Drive, checked October 2026.
- Google, Google Workspace Service Level Agreement, checked October 2026.
- Google Workspace blog, announcements of January 15, 2025 and February 15, 2023.
In three sentences
Google runs Workspace and promises 99.9% monthly uptime, but who can see a file, who still has an account and whether the admin has a second factor are your decisions. The three Business editions cost $7, $14 and $22 per user per month on an annual plan, so 15 users pay $105, $210 or $330 a month, and the step up is about controls like Vault more than about storage. Do the ten checklist items in the first week, because Drive trash empties after 30 days, a deleted user’s data is gone after 20, and the default sharing setting is the most common leak.
