Dual Document & Data Storage System Checklist

Google Workspace for low-sensitivity work, Tresorit for medium- and high-sensitivity data. This checklist walks through classification, setup, migration, and the policy decisions that make the split actually hold up in practice.

1. Classify Your Data Before You Touch Either Platform

This has to happen first. Without it, staff default to whatever's easiest, usually Google, and the system doesn't work.

• Define your organization's sensitivity tiers (we recommend 2 or 3, not more; a 5-tier system won't get used):
  • Low: general programmatic work, public-facing drafts, routine admin, scheduling
  • Medium: legal or HR files, strategic plans, internal memos
  • High: donor and beneficiary PII, incident response records, anything with legal discovery exposure
• Identify and document your organization's low-, medium-, and high-risk categories

2. Set Up Google Workspace (Low-Sensitivity Tier)

Admin console configuration

• Set default link-sharing to "Restricted" org-wide (not "Anyone with the link")
• Disable external sharing by default; allow it per-domain or per-request only
• Enforce 2-factor authentication for all accounts (security key, passkey, or authenticator app, not SMS)
• Advanced: Turn on Google Workspace DLP rules to flag exports/shares containing SSNs, financial account numbers, or other PII patterns
• Disable "Show editors" in version history for shared links
• Set a data retention / auto-delete policy for Drive trash and shared drive versions

Structure

• Create Shared Drives (not "My Drive" folders) for team-owned content so access survives staff turnover
• Build a folder structure that mirrors your data tiers, so "where does this go" has an obvious answer
• Name shared drives and top-level folders consistently (e.g., by program, not by person)

Access

• Audit current sharing permissions; remove former external collaborators and "Anyone with the link" shares
• Set quarterly permission review as a recurring calendar item, not a one-time cleanup

3. Set Up Tresorit (Medium/High-Sensitivity Tier)

Account & structure

• Provision Tresorit accounts for staff who will handle medium/high-sensitivity data
• Build a Tresorit folder structure with clear permission hierarchies (mirror the Workspace structure where useful)
• Set permission levels deliberately: Managers (read/change/re-share) only for those who need to grant access; most staff should be Editors or Viewers

Collaboration approach

• Decide your desktop vs. web policy: Tresorit Drive for staff who prefer local file editing, web interface for occasional access
• Tresorit is not built for the kind of real-time multi-editor collaboration Google Docs offers; plan workflows accordingly (e.g., check-out/check-in norms, or draft in Google at low sensitivity and move final sensitive versions to Tresorit)

Sharing controls

• Set expiration dates as default practice on all shared links
• Use download limits (i.e., 5–10 opens) for highly sensitive one-off shares
• Enable access logs (browser, IP, email) on shared links for anything above medium sensitivity
• Require email verification before link access for high-sensitivity shares
• Apply watermarking on shared documents/videos where leak-tracing matters
• Send link passwords through a separate channel from the link itself (e.g., Signal, not the same email)

4. Write the Policy That Ties Both Together

• Draft a one-page "where does this go" policy: tier definitions, examples, and the platform each maps to
• Name a specific person or role responsible for policy questions and edge cases
• Decide how you'll handle documents that start low-sensitivity and become sensitive (e.g., a draft becomes a legal matter): who moves it, and when
• Set a policy on AI tool use with each tier: flag that most AI platforms retain and can be compelled to produce data, similar to standard cloud storage, so high-sensitivity documents shouldn't be pasted into AI tools by default
• Circulate the policy in writing (not just verbally in a meeting) and store it somewhere staff will actually find it again

5. Migrate Existing Data

• Inventory what's currently in Google Drive that should be reclassified as medium/high sensitivity
• Move those files to Tresorit; don't leave duplicate copies behind in Google Drive
• Remove metadata from sensitive documents before they're moved or shared (Document Inspector in Word/Google Docs, or ExifTool/BleachBit for a final pass)
• Check for sensitive data sitting in email threads or chat history that should be relocated to structured storage

Quick Reference: What Goes Where