VendorScore · Sales call recording · Data-access posture
A plain-language answer from Gong's Trust page, sub-processor list, DPA, Privacy Policy and Help Center. BYOK gives you a revoke switch for new files, not zero access.
Get the full 5-dimension PDF — join the waitlistEvidence dated 2026-10-07, public docs only, not legal advice.
Short answer
Yes, by design (with controls): Gong records, transcribes and analyses calls in plaintext; BYOK adds a revoke switch for new files and the Audit API exposes Gong staff access.
Scored configuration: Gong with a customer AWS KMS key (BYOK) for new files and transcriptions, US or EU data centre chosen at onboarding, consent page enforced, Audit API feeding your SIEM, custom retention.
Default setup (Gong-managed keys, consent page optional) scores lower; the report estimates Overall ~60.
Higher = more customer control / less inherent vendor read access for the scored configuration. A strong SOC 2 doesn't mean the vendor can't read your data.
BYOK encrypts only new S3 files and new transcriptions with your AWS KMS key; deleting the key irreversibly invalidates that data.
Evidence: Gong: set up for data encryptionAccess to customer data by Gong personnel through the platform can be audited by the customer via the Audit API.
Evidence: Gong: summary of security featuresCustomers get only 5 business days to object to a new sub-processor; AI runs on AWS, Google Cloud and Microsoft with global endpoints.
Evidence: Gong DPA, Gong sub-processorsOur report flags these gaps in Gong's public documentation:
Get the full 5-dimension PDF — join the waitlist
PDFs aren't for sale yet. Join the waitlist and we'll email yours when it's ready. No calls.
Yes, by design (with controls): Gong records, transcribes and analyses calls in plaintext; BYOK adds a revoke switch for new files and the Audit API exposes Gong staff access. VendorScore rates Gong 67/100 overall from public documentation (evidence dated 2026-10-07). Scored configuration: Gong with a customer AWS KMS key (BYOK) for new files and transcriptions, US or EU data centre chosen at onboarding, consent page enforced, Audit API feeding your SIEM, custom retention.
No. Gong uses TLS 1.2+ in transit and AES-256 at rest. With BYOK you supply an AWS KMS key that Gong uses to encrypt all new S3 files and, with a separate setting, new transcriptions; existing files aren't re-encrypted, and if the key is deleted, data encrypted with it is irreversibly invalidated. Gong still needs encrypt and decrypt rights on your key in normal operation, so BYOK gives custody and revocation, not zero access. Gong makes no end-to-end encryption claim.
Yes, for troubleshooting or customer support, and you can see it. Gong says "Access of customer data by Gong personnel through the Gong platform can be audited in the Audit API." You can pull that log as JSON into your SIEM. Gong staff may process data in the US, Israel and Ireland.
Not generative AI. Gong's Trust page says: "No. Your data is never used to train generative AI models, and it's never shared with or exposed to the public domain." Its Privacy Policy cites improving services through AI and machine learning, and Gong doesn't say publicly whether customer data trains its non-generative models. No opt-in is documented. Gong's DPA also lets it render data anonymous and use it.
VendorScore doesn't certify compliance; Gong publishes a DPA at https://www.gong.io/legal/data-processing-addendum. It gives you only 5 business days after Gong's written notice to object to a new sub-processor, and relies on SCCs plus the Data Privacy Framework. It also makes you responsible for using Gong's recording-consent features, including dual-party consent.
Gong's list at https://www.gong.io/legal/sub-processors has 9 entries, including AWS, Google Cloud and Microsoft for cloud, transcription and application AI, plus MongoDB, Mailgun, Twilio and Snowflake. No third-party model labs such as OpenAI or Anthropic are named; AI runs through the hyperscalers on global endpoints, and Gong doesn't publish zero-data-retention terms with them.
Yes, if chosen at onboarding: new customers pick US or EU AWS data centres (US is the default). Gong staff may still process data in the US, Israel and Ireland, and AI uses global endpoints.
Every URL cited on this page. Score, key findings and FAQ: VendorScore report (gong.md), evidence dated 2026-10-07.