Google Workspace editions compared: which one has the email security you need?

Google sells Google Workspace in Business editions for up to 300 users and Enterprise editions above that, and Gmail's protection changes more between them than most admins expect. Everyone gets the same core spam filter, but sandboxing, archiving, data loss prevention and investigation tools arrive at different tiers. This guide compares the editions on email security only, from Google's own edition comparison pages, and says which edition fits common needs. Edition contents are as published at the time of writing (November 2026); Google updates them often, so confirm on the linked pages before you buy.

What email security does every Google Workspace edition include?

Every Google Workspace edition includes Gmail's spam, phishing and malware filtering and the same set of admin protections. Google's Business edition comparison lists these for Business Starter, Standard and Plus alike, and its Enterprise comparison lists them for Enterprise Standard and Plus:

• Junk email filtering and virus blocking, which moves spam to each user's Spam folder and blocks known malware.
• Advanced phishing and malware protection, the Safety settings for attachments, links and spoofing. They're opt-in; our guide to Google Workspace advanced phishing and malware protection explains each one.
• Custom filtering and content policies, such as content compliance rules and routing. See content compliance rules.
• Email and chat retention policies, user-managed denylists, enforced compliance footers, allowed IP addresses and the option to turn off IMAP and POP.
• Alert center and the audit and investigation tool for log events.
• 2-Step Verification with security keys, and password monitoring.

Most of these need a verified domain, which is normal for a business account. Admins on every Business and Enterprise edition can also trace delivery with Email Log Search, which Google says keeps Gmail data for 30 days. Our guide to Email Log Search covers it.

How do the Google Workspace editions compare for email security?

The table lists email and account security features only. "Yes" means Google lists the feature for that edition.

Sources: Google's Business and Enterprise comparisons, and the feature pages linked in the sections below. Google also sells Frontline, Education and Essentials editions, with their own lists; check those pages if you're on one.

What does Business Standard add over Business Starter?

Business Standard adds two Gmail protections that Business Starter doesn't have, and both are off until you turn them on.

Security Sandbox opens attachments in an isolated virtual environment to catch malware that signature scanning misses. Google lists it for "Frontline Plus; Business Standard and Business Plus; Enterprise Standard and Enterprise Plus" and says "the setting is off by default" (Google Workspace Admin Help). Google adds that scanning causes "a slight delay", usually finished "within a few minutes".

Enhanced Safe Browsing for Gmail runs extra checks for harmful content before messages reach recipients. Google lists it for "Business Standard and Business Plus; Enterprise Standard and Enterprise Plus" and says the Enhanced malware and phishing protection setting "is turned off by default" (Google Workspace Admin Help). It can't inspect mail encrypted with client-side encryption.

For a business on Starter, this is the biggest email security reason to move up one tier. If you stay on Starter, block risky attachment types outright with the Safety settings and an attachment compliance rule; see dangerous email attachment types.

What does Business Plus add?

Business Plus adds Google Vault, which Google lists as "Vault for email and IM eDiscovery and archiving". Vault lets you place mailboxes on legal hold, keep mail for a set period even after users delete it, and search across all mailboxes. It matters after an incident: if a user deletes a phishing thread or an attacker cleans up a compromised mailbox, Vault can still hold a copy.

Business Plus also adds stronger device controls, including advanced mobile management, mobile device security policies, admin approval of devices, remote device wipe and Windows device management. These don't filter mail, but most mailbox access now happens on phones. The compromised account recovery guide shows why remote sign-out and wipe matter.

What do the Enterprise editions add?

Enterprise Standard and Enterprise Plus add data protection, access control and investigation features that Business editions don't have.

Data loss prevention and Context-Aware Access

DLP for Gmail scans outgoing mail and attachments for sensitive data, such as card or Social Security numbers, and can block, warn, quarantine or audit. Google lists it for Frontline Standard and Plus, Enterprise Standard and Plus, and Education editions (Google Workspace Admin Help). Google says block, warn and quarantine apply only to outgoing messages.

Context-Aware Access limits who can open Gmail based on conditions such as device security or location. It's the Google equivalent of Microsoft's Conditional Access.

Security dashboard and investigation tools

Both Enterprise editions get the security dashboard, the security health page and the security investigation tool's premium features. Two limits catch admins out:

1. Google's security dashboard page says its email reports, including spam filter, authentication, spoofing and user reports, are "not available with Frontline Standard or Enterprise Standard".
2. Google's guide to investigating malicious emails says "Gmail log events are available only with Frontline Plus, Enterprise Plus, and Education Plus editions." Google's Enterprise comparison is less strict: it lists Gmail log events in the investigation tool for both Enterprise editions, but the Gmail messages data source, which searches mailbox contents, for Enterprise Plus only. If you're on Enterprise Standard, check what your Admin console offers before you rely on it.

So on Enterprise Standard you can investigate many things, but finding and deleting one phishing message from every mailbox in a few clicks needs Enterprise Plus. Our security investigation tool guide shows that cleanup and the alternatives on other editions.

Encryption beyond TLS

Gmail encrypts mail in transit with TLS on every edition when the other server supports it. Message-level encryption is different. Google lists hosted S/MIME for "Frontline Plus; Enterprise Plus; Education Fundamentals, Education Standard, and Education Plus" (Google Workspace Admin Help), and the Enterprise comparison lists client-side encryption for Enterprise Plus. Our Google Workspace email encryption guide explains how S/MIME, confidential mode and client-side encryption differ.

Which Google Workspace edition do I need?

Use these common cases as a starting point:

1. A small team with low risk and no regulated data: Business Starter can work, but turn on every Safety setting and block risky attachment types, because there's no sandbox.
2. A typical small business that receives invoices, contracts and shared files: Business Standard. Security Sandbox and Enhanced Safe Browsing are the protections that catch new malware and malicious links, and Starter doesn't have them.
3. A business that must keep mail for legal or audit reasons, or has had a compromised account: Business Plus, for Vault and remote device wipe.
4. An organization handling health, financial or personal data at scale: an Enterprise edition, for Gmail DLP and Context-Aware Access. Ask your counsel what your regulator expects.
5. An organization with a security team that investigates phishing: Enterprise Plus, for Gmail log events in the investigation tool, the dashboard's email reports, S/MIME and client-side encryption.
6. More than 300 users: an Enterprise edition, because Business editions stop at 300.

Comparing against Microsoft instead? See Google Workspace vs Microsoft 365 email security and the Microsoft 365 business plans comparison.

How do you check your edition and turn on the extra protections?

1. In the Google Admin console, go to Menu > Billing > Subscriptions. You need the Billing management privilege. Your edition and payment plan are listed there (Google Workspace Admin Help).
2. Go to Apps > Google Workspace > Gmail > Safety. Turn on the attachment, link and spoofing protections, and choose an action for each.
3. If your edition includes them, open Spam, Phishing and Malware in Gmail settings and turn on Security Sandbox and Enhanced malware and phishing protection. Apply them to the top-level organizational unit unless you're testing.
4. On Business Plus or Enterprise, set a default Vault retention rule for Gmail before you need it. Vault only holds what a rule or hold covers.
5. Send yourself a test message with a harmless attachment and check the headers in the Email Header Analyzer to confirm SPF, DKIM and DMARC pass.

Google says Gmail setting changes can take time to apply, so test the next day if a change doesn't show at once. For the wider Gmail settings, see our Gmail spam settings admin guide.

Does a higher edition stop people spoofing your domain?

No. Protecting your own domain from spoofing depends on DNS records, not on your edition. SPF lists the servers allowed to send as your domain, DKIM signs your outgoing mail, and DMARC tells other receivers what to do with mail that fails those checks. You publish all three yourself, and every edition can use them. Business Starter with an enforced DMARC policy (p=quarantine or p=reject) protects your domain's name better than Enterprise Plus with no DMARC record at all.

An edition upgrade does change what you can see. The security dashboard's authentication and spoofing charts need an edition that includes the dashboard's email reports, as above. On any edition, you can read the aggregate reports that receivers send to the address in your DMARC record. Our guides to setting up DMARC in Google Workspace and fixing DKIM that isn't authenticating cover the setup, and the free DMARC Checker shows your current policy.

What gaps remain on every Google Workspace edition?

Some gaps don't close with any edition, because they come from how Gmail is built:

• Users aren't told about admin quarantine. Google says "Recipients are never notified when a message is quarantined", and a quarantined message is permanently deleted after 30 days if no one acts on it (Google Workspace Admin Help). See Google Workspace admin quarantine.
• Warning banners are Gmail-only. Users reading mail in Outlook or Apple Mail don't see Gmail's banners; see Gmail warning banners explained.
• No outage holding of your own. If mail can't reach Google, delivery depends on each sender's retry behavior.
• One platform at a time. Domains on Microsoft 365 or cPanel need their own filters and quarantines.

An MX-level filtering service in front of Gmail adds an independent layer, a personal quarantine digest for every user and mail spooling during outages, priced per domain rather than per user. It doesn't replace Gmail's own filtering, which keeps running behind it. Our Google Workspace platform page explains how iBlockSpam sets up as an inbound gateway, and is the Google Workspace spam filter enough? covers when that's worth it.

Next steps

• Check Billing > Subscriptions to confirm your edition before planning changes.
• Turn on the Safety settings today, and Security Sandbox and Enhanced Safe Browsing if your edition includes them.
• If you're on Starter and receive many attachments from outside, price Business Standard first; it's the tier with the largest email security jump.
• Run the free Email Health Check, and read how a gateway works with Gmail on the Google Workspace platform page.