What’s an in-place preservation

A preservation consists in protecting your organization’s data from inappropriate alteration or destruction. This task often becomes a requirement in legal acts such as litigations, investigations, or security breaches.

Preserving in-place means that you can preserve data in the applications where it's actually being generated and prevent custodians from editing or deleting data once it’s been preserved.

With Onna’s in-place preservation feature you define your preservation’s criteria once and apply them to all the applications at once, which makes you:

Save time and be more efficient
Prevent errors and make data reliable
Preserve the appropriate data in real time

The in-place preservation feature leverages legal hold capabilities of your applications. It currently works with:

Slack Enterprise
Google Vault

Original limitations from each application’s proprietary feature also apply to Onna. Check them out on Slack’s help center and Google Vault Help.

Requirements

Before using the in-place preservation feature, ensure you meet all these requirements.

Onna requirements

To use this feature you need:

An Onna enterprise account
An admin user account in Onna

Slack requirements

A Slack account with the Enterprise Grid plan
A Slack user with a Compliance Admin system role
The Onna admin user must be authorized to connect to Slack with legal hold permissions

Google Vault requirements

A Google Workspace account with Google Vault
A Google Workspace user for which you must first:
1. Create a service account
2. Delegate domain-wide authority to your service account
3. Give admin privileges to your service account:
  - Users
  - Service Settings
  - Groups (Read only)
  - Reports
4. Also, give the service account Vault privileges:
  - Manage Matters
  - Manage Holds
The onna admin user must be authorized to connect to Google Workspace with Google Vault privileges

For more information, check Google’s Administrator privileges definitions.

Create an in-place preservation

🚀 Don’t feel like reading today? You can watch this short video on how to create in-place preservations.

To create an in-place preservation:

1. Do one of the following:

In the nav bar, select + next to In-place preservation.
Navigate to the In-place preservations section, then select +.

2. In the Create an In-place preservation section, enter the preservation name, a billing number (optional), and select Continue.

3. In the Select connectors section, select the connectors you want to preserve data from, then select Continue.

4. In the Authorize access section, select one credential for each connector, then select Continue.

If you don’t see the right user here, add them, then start this process again.

5. In the Select content sections, select the content you want to preserve for each connector, then select Continue.

5. In the Define preservation section, add the custodians you want to preserve data for.

You can enter their emails manually or upload a CSV file. The CSV file must have one email address per line.

6. Set the preservation period and select Continue.

Leaving the dates empty will preserve all data available and keep preserving it as new data is found.

7. In the custodian validation summary, review the custodians found and select Create.

If there are errors with some custodians you can either go back and fix them or create the preservation without them–you’ll be able to edit the custodians afterwards.

You can download the CSV of the custodians for each app by selecting Download CSV. It’ll save you time when you’re creating a collection to bring this data into Onna, as you won’t have to enter the custodians manually again.

What’s next?

Now that you created the in-place preservation, you will see it as Active.

When you’re ready to bring the data into Onna for further processing, try creating a workspace to host all your in-place preservation data.

Create Slack collection

Using the CSV with the custodians' emails from the in-place preservation validation summary will save you time as you won’t have to manually enter all the custodians again. Here’s the instructions.

Create Google Vault collection

Currently, collecting directly from Google Vault is not supported. However, you can create a separate Google Workspace collection to collect Gmail and Google Drive data from your custodians in real time.

When using this method, consider that the data deleted by custodians before you create the collection can’t be collected.

Release an in-place preservation

When you release an in-place preservation, you’re telling your applications to stop preserving the data. For example, when your legal case is over and you no longer need to preserve the custodian’s data for your investigation.

To release an in-place preservation:

1. From the list of available in-place preservations, select the preservation you want to release.

2. Place your cursor on the Preservation state area, select the ellipses (…), then select Release.

3. On the confirmation dialog, select the arrow (→).

Well done! The in-place preservation is now released and that won’t be preserved anymore.

Edit an in-place preservation

You can edit an in-place preservation to update its custodians. For example, you may want to release the preservation for some of them when they’re no longer relevant to your investigation.

To edit an in-place preservation:

1. From the in-place preservation main screen, select the ellipses (…), then select Edit.

2. In the Edit dialog, make the necessary changes, then select Save changes.

Well done! Your in-place preservation is now updated with your recent changes.

Add an authorized connection

Preserving your organization’s data requires that you connect to your third-party applications as a user with a admin role or some other kind of elevated permissions.

To do so, you must add these user credentials to Onna using the Authorized connections feature. Credentials are securely stored there and you can use them when you’re connecting to your third-party applications.

You must have an admin user role in Onna to add or use any authorized connection. If you don’t have the credentials, ask your admin to add them for you and then share them with you.

Add a Slack legal holds authorized connection

To grant access to Slack for legal hold purposes using an authorized connection, you must give it extra permissions than a standard Slack authorized connection.

To add a Slack authorized connection for legal holds:

1. Once you are an Onna admin, click your avatar, then select Authorized connections.

2. Expand the Enterprise sources section, then select Add Admin credentials.

3. On the Add Admin credentials dialog, select Slack Enterprise.

4. Enable the Grant Access to Slack Legal Holds option, then select Connect.

5. On the following screen, review the permissions and select Allow.

That’s it! The credentials are now added as an authorized connection and you can use them when creating an in-place preservation for Slack.

Add a Google Vault authorized connection

If you want to grant access to Google Vault using an authorized connection, you must give it extra permissions than a standard Google Workspace authorized connection.

To add a Google Vault authorized connection:

1. Once you are an Onna admin, click your avatar, then select Authorized connections.

2. Expand the Enterprise sources section, then select Add Admin credentials.

3. On the Add Admin credentials dialog, select Google Workspace.

4. Enable the Grant Access to Google Vault option, then select Connect.

5. In the following dialog, enter your Google Workspace account information, then select Connect.

a. In the Domain field, enter the Google Workspace domain you’re connecting to.

b. In the Admin email field, enter the email of the Google Workspace admin you’re storing the credentials for.

c. In the Certificate field, enter the private key obtained when creating a service account.

That’s it! You added the authorized connection and are ready to use it when creating an in-place preservation for Google Vault.

In-place preservation FAQs

In this section you can find answers to common questions about the in-place preservation.

Can I delete my in-place preservations?

Currently, deleting an in-place preservation is not supported. We’re working on adding that functionality as soon as possible.

My in-place preservation status shows an error, what can I do?

Errors may be shown for various reasons. Here’s some common ones:

Lack of permissions for the user creating the preservation

The user you used to connect to the application may not have the right permissions to preserve data. We recommend checking that you meet all the requirements or contacting your IT manager.

Connection issues with applications

When there’s a connection issue with one of the applications, we recommend to try again later. If the issue persists, contact us.

Errors with the preservation’s custodians

There was an error while trying to connect to your third-party application to preserve a specific custodian’s data. You can review and fix some errors by going to the Review custodians section.

Errors are returned on a per-custodian basis.

Here’s a list of possible errors:

When	Application	Error	Description
Creating a preservation	Google Vault / Slack Enterprise	We couldn’t find custodians with these emails:	No custodians matching the emails listed were found in your application. Ensure that their email address is correct
Releasing an entire preservation	Google Vault	Matter deleted in Google Vault	The matter was manually deleted in Google Vault
Releasing a custodian	Google Vault	Matter deleted in Google Vault	The matter was manually deleted in Google Vault
Releasing a custodian	Google Vault	Can't release these custodians, Google Vault gave a generic error:	The custodians listed can't be released because of a generic error we received when trying to connect to Google Vault
Creating a preservation	Google Vault	No Google Vault license for some custodians:	The custodians listed don't have an active Google Vault license. Delete them from the preservation or assign a license to them
Creating a preservation	Google Vault	Can't create the preservation, Google Vault gave a generic error	Data can't be preserved for some custodians because of a generic error we received when trying to communicate with Google Vault
Releasing an entire preservation	Slack Enterprise	Legal hold deleted in Slack	The legal hold was manually deleted in Slack
Releasing a custodian	Slack Enterprise	Legal hold deleted in Slack	The legal hold was manually deleted in Slack
Creating a preservation	Slack Enterprise	admin@acmecorp.com lacks permissions to create legal holds	The user credentials used to create the preservation lack permissions to create legal holds in Slack
Releasing a custodian	Slack Enterprise	Can't release these custodians, Slack gave a generic error:	The user credentials used to create the preservation lack permissions to create legal holds in Slack