https://support.google.com/vault/answer/4388708?hl=enMarch 7, 2019
If your organization enables Gmail confidential mode, Vault can hold, retain, search, and export all confidential mode messages sent by users in your organization.
Confidential messages sent after November 30, 2018 are visible to Vault in the mailboxes of all internal senders and recipients. Messages are always available to Vault, even when the sender sets an expiration date or revokes recipients' access to confidential mode messages.
https://support.google.com/a/answer/7684332?hl=en
Confidential mode messages and Vault
Vault can hold, retain, search, and export all confidential mode messages sent by users in your domain. Vault has no visibility into the content of confidential mode messages sent to your organization from external parties. If your domain uses Vault, carefully review how Vault handles confidential mode messages
To support Vault's requirement to access confidential mode messages, Gmail attaches a copy of the confidential mode content to the recipient's message.
Here's what you should know about this copy:
It's attached only when the message sender and recipient are in the same organization.
It's only available to Vault.
Senders and recipients cannot access the copy from Gmail.
Third-party mail archiving tools cannot access the copy.
To delete all copies of a confidential mode message, you must delete it from the sender account and all recipients' accounts.