Dual Document & Data Storage System Checklist

Google Workspace for low-sensitivity work, Tresorit for medium- and high-sensitivity data. This checklist walks through classification, setup, migration, and the policy decisions that make the split actually hold up in practice. 
 1. Classify Your Data Before You Touch Either Platform 
 This has to happen first. Without it, staff default to whatever's easiest, usually Google, and the system doesn't work. 
 
 Define your organization's sensitivity tiers (we recommend 2 or 3, not more; a 5-tier system won't get used):
 
 Low: general programmatic work, public-facing drafts, routine admin, scheduling 
 Medium: legal or HR files, strategic plans, internal memos 
 High: donor and beneficiary PII, incident response records, anything with legal discovery exposure 
 
 
 Identify and document your organization's low-, medium-, and high-risk categories 
 
 2. Set Up Google Workspace (Low-Sensitivity Tier) 
 Admin console configuration 
 
 Set default link-sharing to "Restricted" org-wide (not "Anyone with the link") 
 Disable external sharing by default; allow it per-domain or per-request only 
 Enforce 2-factor authentication for all accounts (security key, passkey, or authenticator app, not SMS) 
 Advanced: Turn on Google Workspace DLP rules to flag exports/shares containing SSNs, financial account numbers, or other PII patterns 
 Disable "Show editors" in version history for shared links 
 Set a data retention / auto-delete policy for Drive trash and shared drive versions 
 
 Structure 
 
 Create Shared Drives (not "My Drive" folders) for team-owned content so access survives staff turnover 
 Build a folder structure that mirrors your data tiers, so "where does this go" has an obvious answer 
 Name shared drives and top-level folders consistently (e.g., by program, not by person) 
 
 Access 
 
 Audit current sharing permissions; remove former external collaborators and "Anyone with the link" shares 
 Set quarterly permission review as a recurring calendar item, not a one-time cleanup 
 
 3. Set Up Tresorit (Medium/High-Sensitivity Tier) 
 Account & structure 
 
 Provision Tresorit accounts for staff who will handle medium/high-sensitivity data 
 Build a Tresorit folder structure with clear permission hierarchies (mirror the Workspace structure where useful) 
 Set permission levels deliberately: Managers (read/change/re-share) only for those who need to grant access; most staff should be Editors or Viewers 
 
 Collaboration approach 
 
 Decide your desktop vs. web policy: Tresorit Drive for staff who prefer local file editing, web interface for occasional access 
 Tresorit is not built for the kind of real-time multi-editor collaboration Google Docs offers; plan workflows accordingly (e.g., check-out/check-in norms, or draft in Google at low sensitivity and move final sensitive versions to Tresorit) 
 
 Sharing controls 
 
 Set expiration dates as default practice on all shared links 
 Use download limits (i.e., 5–10 opens) for highly sensitive one-off shares 
 Enable access logs (browser, IP, email) on shared links for anything above medium sensitivity 
 Require email verification before link access for high-sensitivity shares 
 Apply watermarking on shared documents/videos where leak-tracing matters 
 Send link passwords through a separate channel from the link itself (e.g., Signal, not the same email) 
 
 4. Write the Policy That Ties Both Together 
 
 Draft a one-page "where does this go" policy: tier definitions, examples, and the platform each maps to 
 Name a specific person or role responsible for policy questions and edge cases 
 Decide how you'll handle documents that start low-sensitivity and become sensitive (e.g., a draft becomes a legal matter): who moves it, and when 
 Set a policy on AI tool use with each tier: flag that most AI platforms retain and can be compelled to produce data, similar to standard cloud storage, so high-sensitivity documents shouldn't be pasted into AI tools by default 
 Circulate the policy in writing (not just verbally in a meeting) and store it somewhere staff will actually find it again 
 
 5. Migrate Existing Data 
 
 Inventory what's currently in Google Drive that should be reclassified as medium/high sensitivity 
 Move those files to Tresorit; don't leave duplicate copies behind in Google Drive 
 Remove metadata from sensitive documents before they're moved or shared (Document Inspector in Word/Google Docs, or ExifTool/BleachBit for a final pass) 
 Check for sensitive data sitting in email threads or chat history that should be relocated to structured storage 
 
 Quick Reference: What Goes Where 
 
 
 
 Category 
 Detail 
 
 
 
 
 Low sensitivity 
 General programmatic drafts, public-facing content, routine scheduling and admin, non-sensitive internal comms 
 
 
 Medium/high sensitivity 
 Donor & beneficiary PII, legal and HR files, strategic/campaign plans, incident response records, anything with litigation discovery exposure 
 
 
 Platform 
 Google Workspace (low) → Tresorit (medium/high) 
 
 
 AI tools 
 Treat like cloud storage for discovery purposes; don't paste high-sensitivity content into AI platforms by default