Gong: security & AI-training scorecard
gong.io ↗ · Conversation intelligence · Last checked Oct 16, 2026
Does Gong train AI on customer data?
No“Is customer data used to train generative AI? No. Your data is never used to train generative AI models, and it’s never shared with or exposed to the public domain.”
Note: Statement is scoped to generative AI models.
SOC 2
Independent audit of security controls. Type II covers operating effectiveness over a period.
Type II
“SOC 2 (Type 2) Service Controls”
ISO/IEC 27001
Certified information security management system.
Yes
“ISO/IEC 27001:2022 Information Security Management System (ISMS)”
HIPAA / BAA
Whether the vendor will sign a Business Associate Agreement for PHI.
HIPAA controls mapped in SOC 2; BAA not confirmed
“While Gong is not a covered entity, we map HIPAA controls in our SOC 2 Type II audit.”
Note: Trust center also lists a 'SOC 2 Type 2 + HIPAA Report'. No public statement found on BAA availability.
GDPR DPA
Data Processing Agreement/Addendum for personal data.
DPA referenced (customer DPA)
“Gong processes Customer Data strictly in accordance with our Customer’s reasonable instructions and as further stipulated in our Data Processing Addendum”
Trains AI on customer data
Whether the vendor says it uses customer data to train AI models.
No
“Is customer data used to train generative AI? No. Your data is never used to train generative AI models, and it’s never shared with or exposed to the public domain.”
Note: Statement is scoped to generative AI models.
Data retention
What the vendor publishes about how long customer data is kept.
Default up to 3 years or contract duration, whichever is shorter; deleted 30 days after termination
“By default, Gong retains customer data for up to three years or the duration of your contract — whichever is shorter. You can request a custom retention period, and all data is permanently deleted 30 days after contract termination.”
Subprocessor list
Where the vendor lists third parties that process customer data.
All sources checked (4)
Fetched on Oct 16, 2026. Vendor pages can change after this date.
Is this wrong? / Claim this listing
Vendors and readers can send evidence links. Nothing is published without a source.
Informational only, not legal advice or an audit. Summaries reflect Gong's published pages as of Oct 16, 2026; verify with the vendor. Methodology & disclaimer.