The long version
The feature list as the software actually ships. Items marked coming are in active development on the roadmap.
Not the code — the order of operations, and the checks at each step. This is what separates a backup you can rely on from a job that merely finished without complaining.
Is this client active, is another run already going, is a restore in progress? If the answer is wrong, the run doesn’t start.
Each account’s mail, files, calendars and contacts are listed from Google. Only a listing that reached the end is used to spot what has been deleted.
Unchanged items are skipped. A file that has only moved is re-pointed, not re-transferred.
Parallel workers that stay inside Google’s limits. If the daily quota is reached, the run pauses and says so — never a false green tick.
Data lands at your destination first, and is recorded only once it is safely there. An interrupted run carries on cleanly.
Deletions at source are noticed and dated — with safety checks so a bad listing can never mark a live account as deleted.
After every backup, a sample of stored copies is checked against your storage. A copy that is missing or the wrong size is an error on the run, not a surprise at restore time.
OK, errors, partly done, paused by Google’s daily limit, interrupted, stopped or failed — each means exactly what it says. Each client gets one word for its health: OK, Warning, Failed or Running.
Separately from the run, items deleted in Google Workspace are removed from the backup after a fixed year, unless an Admin keeps them for ever. Old file versions are pruned only after you confirm, having seen exactly what the first pass would remove.
What happens when things go wrong.
The backup carries on by itself as soon as the app is back, skipping what it had already copied.
On cPanel, the installer adds one small cron job, so the host’s nightly web-server restart never leaves the app stopped, with no backups, until someone opens a page.
Every destination is tested with a real write before it is accepted — problems surface at setup, not at 3am.
The old destination is frozen, not deleted — everything already backed up stays restorable.
A local-folder destination’s free space is checked before the run and before each account. When it runs low, the backup pauses rather than failing half way.
Resuming a restore skips what already arrived, from the same backup and into the same place — nothing is duplicated.
Removing a client is two deliberate acts, both by an Admin: archive first (restores keep working), then delete, with the client named by hand, a reason given and the impact shown before anything happens.
An unreachable licence server never stops a backup or a restore — the software carries on.
The application backs up its own database every night, encrypted, to your destination, and verifies the copy before pruning an old one. There is nothing to switch on.
Complete coverage of a Google Workspace account, not just the inbox.
Every message, indexed and restorable individually — including labels.
All files, with the original folder tree recorded so restores rebuild it exactly.
Full shared-drive backup with per-drive tracking and containment on restore. Each client’s Status shows when every drive was last backed up.
Backed up alongside mail and files; calendar restores update rather than duplicate events.
Docs, Sheets and Slides are exported to Word, Excel and PowerPoint, and that is what a restore gives back: Drive opens them as they are, and Save as Google Docs makes a Google copy. If Google refuses an export, a PDF fallback runs, then a record of the file’s details — nothing is silently skipped.
A backup asks Google only for read-only permissions; the write permissions a restore needs are asked for only when it restores. Each client’s Connect page lists the exact scopes to grant, and tests them.
What is encrypted in your storage, and what is not, in plain words.
Every email with its subject, sender, recipients, date and labels, every calendar and contact list, and the console’s own backups are always encrypted in your storage. Drive files are too, for every client added from 1.00.
A box in each client’s Settings turns Drive encryption off, or on for a client added earlier. Copies already stored stay as they were written, and restore either way.
File and folder names, which are the names things are stored under. Your storage provider’s own encryption at rest comes on top of ours.
decrypt-backup.mjs comes with every download. With your key, it turns downloaded backups back into ordinary files and emails. Without the key, nobody can read them.
AES-256, with one key per installation that you download and keep. It cannot be regenerated, so the setup checklist reminds you until you have saved it.
Built for the realities of Google's API: quotas, rate limits and very large first runs.
After the first full run, only changed files and new mail move. Unchanged data is never re-downloaded or re-uploaded — including files that were merely moved between folders.
Google doesn't change a file's modified time when it moves. GWS Backup notices anyway and updates the recorded path without re-transferring a byte.
Concurrent workers per data type, tuned to stay politely inside Google's rate limits — a client’s Status page shows the account and file being copied right now.
The engine runs in its own thread, so pages stay quick during a big backup. It starts only as many backups together as your server can take (Backups at once, in Settings → System) and the rest wait their turn.
When Google's daily quota runs out, the run pauses cleanly within seconds — a warning, never a fake success — and the next run continues where it left off.
Every network call gets exponential backoff, Retry-After handling and 429/5xx retries. Rate limits get at least six tries before a run pauses, and a call that hangs is timed out and tried again.
Stopping a run tears down in-flight connections immediately via AbortController — no zombie threads, no leaked memory, status recorded honestly as Stopped.
A backup cut off by a restart or crash carries on by itself when the app is back, and a watcher stops any run that has not moved for five minutes and continues it. Either way the new run inherits the old one’s progress rather than starting over.
Your storage, your rules — and changing your mind is safe.
Google Drive, S3-compatible storage (Amazon S3, Cloudflare R2, Google Cloud Storage, Wasabi, Backblaze B2 and others), Azure Blob storage, and, in the Windows edition, a local folder. A folder on a NAS needs the Windows task to run as an account that can reach it. Every type is used for both backup and restore.
A new destination is probed with real read, write and delete tests before a single backup is pointed at it.
Switch destinations (say, Drive to S3) and the old one is frozen as a restore-only archive — everything ever backed up stays findable and restorable. When you no longer need it, retire it client by client, once each has a complete backup at the new destination; Rescue first copies across anything held only there.
Every destination records where each file lived, so a restore rebuilds the real folder tree — not a flat dump at the root.
After each backup, 20 stored copies are checked with your storage for their size, without downloading anything. History shows the result, and Check a sample now checks 50 whenever you like.
Backups are only as good as the restore. This is where the obsession shows.
A whole workspace, one account, one shared drive, or a single email or file, all from one Restore page with one search and filters for each kind.
What, from which backup, into which account and folder. Before you start, a check confirms the backup can be read and estimates how long Google’s limits will make it. Only an Admin can delete the files, events and contacts in an account first (mail is never deleted), and must type DELETE to do it.
Google Docs, Sheets and Slides come back as Word, Excel and PowerPoint files, which Drive opens and edits as they are. The restore screens say so whenever Drive files are included.
Every backup keeps the previous copy of a changed Drive file, so you can pick an earlier version by date and restore it — including one from before ransomware encrypted it. Email is immutable and cannot be edited, so it is restored as sent rather than versioned.
Restore a whole workspace, one account, or one section as it stood at a chosen backup, including everything that backup copied, not merely as it stands now. How far back you can go is set by your own retention policy.
Recover an absent employee's mail or files straight into a colleague's account — no password resets, no 2FA workarounds.
Cross-account restores are tagged automatically — a Restored/<source> Gmail label, name prefixes on Drive files — so restored data is easy to find and tidy up.
Cross-account and shared-drive restores rebuild inside a clearly named container folder; anything whose original location was never recorded is quarantined in Unfiled/ instead of littering the drive root.
An interrupted restore continues where it stopped — a per-item ledger means nothing already restored is duplicated.
Restores pause on Google’s daily limit just like backups and resume by themselves once it passes, retry transient errors with backoff, and can be stopped instantly mid-run.
A restore that fails says why, in plain English, on the client’s Restore page, with Google’s own words kept for support.
Every restore says when it is done — single item or bulk. A running one shows on Overview under Running now, and on the client’s Restore page under Recent restores, wherever you go in between.
Each client’s schedule is in its own Settings, from every hour to once a day. One client never runs twice at once, and Pause all scheduled backups stops every schedule for maintenance and resumes them as they were.
A scheduled time missed while the server was down runs once when it is back — one catch-up, not one per missed slot.
Two clear rules: how long earlier file versions are kept, one rule for every client with a way to leave a client out, and a fixed year for items deleted in Google Workspace, or for ever if you prefer.
Each night, when no backup is due, housekeeping tidies and compacts the app’s own databases; once a week every file is checked for damage. Nothing to set, and Settings → System shows when each task last ran.
Jobs orphaned by a crash or restart are detected and closed out honestly on boot — nothing spins forever, and a backup among them carries on by itself.
As many Google Workspace domains as your licence covers, from one interface, in one list with one health word each, and each with its own schedule and its own choice of what to back up.
An archived client keeps every backup and stays restorable while nothing new runs. Only an archived client can be deleted, by an Admin who types its name and a reason once the impact has been shown. A second client with the same domain or name is refused on the way in.
Three roles. An Admin can do everything. An Operator looks after the clients that are there: backups, schedules, suspending, connection tests and restores, in part or whole. An Operator cannot add, archive or delete a client, delete anything, or change settings or users. A Viewer can only look. Anyone can turn on two-step sign-in.
Each account has five free tries. After that it waits a minute before each try up to the tenth, five minutes up to the fifteenth and fifteen minutes up to the twentieth. The twentieth wrong password or two-step code in a row locks the account. An Admin unlocks it under Settings → Users & security.
The recovery key you save at setup resets the password of the Admin account made at setup. It also makes that account an Admin again, unlocks it and turns off its two-step sign-in. The console never sends email, so there is no reset link: other accounts are reset by an Admin.
Download a client’s whole backup history as a CSV — one row per run, with what it actually did, so the figures add up.
Every backup, restore, sign-in and settings change is on the Activity page in a plain sentence, with who did it and when — including who started each restore.
Read-only status endpoints secured by API key, feeding a companion mobile app — check backup health from your phone.
The feature the whole product is built around.
A run is only reported successful when it truly finished. Paused, partly done, interrupted and stopped runs say exactly that — with the real error, in plain English. A client whose last backup failed is never shown in green.
A client’s Status page shows the account and file being copied now and what has been copied so far, and says so if nothing has moved for five minutes. Nothing is hidden behind a spinner.
One word per client — OK, Warning, Failed or Running — and the reason in words for each run, on every screen and in every export.
Raw Google API errors are rewritten as actionable messages, with the original preserved for support. A failed connection test says what Google actually refused, check by check.
A .zip and a small PHP installer for cPanel’s Node.js hosting, on Node.js 22.13 or newer. On a Linux server without cPanel, use Docker.
One .exe that installs Node.js if the PC needs it and sets up a startup task.
A pre-configured Docker Compose file for instant, isolated deployment on any OS.
On Windows, a startup task runs the app before anyone signs in. On cPanel, a small cron job starts it again after the host restarts its web server. Docker restarts the container with the host.
One edition, built for organisations and MSPs — the complete application, free under the GWS Backup Free Licence. Above ten workspaces, by enquiry.
Free licence keys, normally sent automatically when you register — one key, one running installation, up to ten client workspaces. Donating changes nothing about the software — there is nothing held back.
About 1 GB for each backup running at once. The rest wait their turn.
The console says when an update is out. On cPanel and Windows an Admin clicks Install update: it checks nothing is running, backs up the databases and restarts, and on cPanel puts the previous version back if the new one will not start. On Docker the console shows the version to set as GWSB_VERSION in .env and the two commands to run.
That's the honest state of the software today. For what's next, see the roadmap. For how it all behaves in practice, the FAQ answers the questions everyone asks.
Get your free licence