// Trust & Security Report
Gong
Revenue AI OS - AI-powered conversation intelligence platform with sub-products: Gong Engage (sales engagement), Gong Forecast (pipeline forecasting), Gong Enable (sales enablement), Gong Agents (agentic automation), Gong Revenue Graph (data connectivity), and Gong Collective (integrations/services).
Certifications held
11
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on trust.gong.io“Center with our latest security and compliance documentation. Newly available: SOC 2 Type II Report (2026) ISO/IEC 27017 and ISO/IEC 27018 certificates, covering cloud security and the protection of PII i”
Verify on gong.io“) Service Controls ISO/IEC 42001:2023 Artificial Intelligence Management System ISO/IEC 27001:2022 Information Security Management System (ISMS) ISO/IEC 27017 Information security controls for cloud services ISO/I”
Verify on trust.gong.io“ISO/IEC 27017 and ISO/IEC 27018 certificates, covering cloud security and the protection of PII in cloud environments”
Verify on trust.gong.io“ISO/IEC 27017 and ISO/IEC 27018 certificates, covering cloud security and the protection of PII in cloud environments”
Verify on help.gong.io“Internally, Gong maintains a privacy program to ensure compliance with privacy regulations, and we are ISO 27701 and ISO 27018 certified.”
Verify on gong.io“compliance standards. See our certifications SOC 2 (Type 2) Service Controls ISO/IEC 42001:2023 Artificial Intelligence Management System ISO/IEC 27001:2022 Information Security Management System (ISMS) ISO/IEC”
Verify on help.gong.io“Gong is SOC2 Type II compliant and provides a third-party attestation report covering security, availability, confidentiality, privacy, and HIPAA compliance (Mapping of HIPAA Security Requirements).”
Verify on trust.gong.io“Management Risk Management Program Third Party Risk Management Data Privacy GDPR Compliance Gong DPF Active Participant Data Privacy Officer View more Legal Subprocessors Certificate of Insurance Data”
Verify on trust.gong.io“27001 ISO/IEC 27017:2015 ISO/IEC 27018:2019 ISO/IEC 27701 ISO/IEC 42001:2023 PCI DSS SOC 2 Documents All Public Private Get access Bulk download Featured Documents REPORTS Gong Trust Brochure - Security,”
Verify on trust.gong.io“and other security artifacts available through the Trust Center. Compliance CSA STAR CSA STAR Level 1 EU-US DPF ISO/IEC 27001 ISO/IEC 27017:2015 ISO/IEC 27018:2019 ISO/IEC 27701 ISO/IEC 42001:2023 PCI DSS”
Verify on gong.io“EU-U.S. Data Privacy Framework (DPF), UK Extension to the EU-U.S. DPF, and Swiss-U.S. Data Privacy Framework”
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
New customers can choose US or EU data centers. Parent company headquartered in Israel; data processing offices in US, Israel, and Ireland. Complies with DPF, UK GDPR, and Swiss data protection frameworks.
Gong explicitly states 'your data is never used to train generative models.' Training is per-customer only; cross-customer training only occurs on safe cases like transcription, not business-specific processes. ISO 42001 certified with dedicated AI governance team focused on ethical use and human validation.
// Security controls
Access control
Role-based access control with four standard roles plus granular permission profiles; workspace segmentation for least privilege
help.gong.ioAuthentication
Single Sign-On support for Google, Microsoft Entra ID, Okta, and other major identity providers
help.gong.ioAudit logging
Comprehensive audit logging accessible via Gong Audit API in JSON format; tracks both user activity and Gong personnel access to customer data
help.gong.ioMonitoring and threat detection
Real-time monitoring and threat detection with built-in redundancy
help.gong.ioPenetration testing
Independent penetration testing conducted regularly with executive summaries available through Trust Center
trust.gong.ioData redaction
Custom redaction capabilities for sensitive sequences; enables regulated industries to safely leverage AI insights
help.gong.io// Products & data scope
Data it handles: Processes email, call recordings, transcripts, and communications data. Analyzes customer interactions for insights.
Prioritizes and personalizes sales engagement; uses AI agents for targeted communications
Data it handles: Processes pipeline, deal, and forecast data; analyses conversation insights for forecasting accuracy
Provides unbiased insights and centralized analytics for org-wide action
Data it handles: Processes customer call recordings, transcripts, and interaction data to create training content
AI Trainer feature allows teams to practice using simulated conversations from real customer interactions within Gong environment
Data it handles: Processes pipeline, CRM, and interaction data for automated actions
Automates follow-ups, pipeline edits, enablement triggers, and forecast corrections
Data it handles: Central data store capturing interactions across email, calls, CRM, and integrations
Automatically captures and connects every interaction across customer's business
Data it handles: Curated third-party integrations and professional services
Robust ecosystem of integrations and expert services
// At a glance
Pricing model
Subscription-based SaaS; usage-based or per-user tiers available; custom enterprise pricing
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Gong.io Ltd.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-07. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.gong.io// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.