On this page (12)
Before Gong records its first external call, set up five things: a consent profile your counsel has approved, exclude lists for calls and emails that must never be captured, a retention period, redaction for sensitive numbers, and permission profiles that limit who can see, download and delete calls. Gong supplies the controls; your organization decides how to use them, because Gong's help center says you must understand and comply with the recording laws where you and your customers are located.
Is it legal to record sales calls with Gong?
It depends on where you and the people on the call are located, and that is a question for your counsel. Recording laws differ by place. Some require only one participant to know about the recording, often called one-party consent, while others require every participant to be notified or to agree, often called all-party or two-party consent. Gong's help center notes that when a customer is in a different region, the stricter rule usually applies, that video and audio can have different requirements, and that industries such as healthcare and financial services may add their own rules. Ask counsel which standard to apply, then configure Gong to match.
How does Gong handle recording consent?
A Tech admin sets a consent profile, and it applies to every call; individual users cannot switch its settings off for a single meeting. Consent profiles let you set different rules for different teams or regions. For web conferences, Gong offers three methods:
- A consent page participants see before joining. When it is enabled, someone can still join without consenting and the meeting may be recorded. When it is enforced, the meeting is recorded only if every participant consents through the page.
- An audio prompt played when participants join, either for each participant or once.
- A pre-call email sent 10 to 20 minutes before the meeting. The recording notice in that email cannot be removed or edited.
Profiles can also let participants opt out and stay on the call. Two gaps need a process, not a setting: Gong says you must tell people verbally on telephony calls, and the consent page does not appear when a meeting starts from a physical meeting room system. Dynamic consent links need the Gong calendar add-on for Google Workspace or Outlook.
How do you stop Gong recording calls it should not?
Use exclude lists. A Tech admin can list email domains, email addresses and meeting title words for calls, and domains, addresses, prefixes and subject words for emails. Two details matter. Ad hoc recordings bypass exclude rules and are always recorded, so train reps on when not to add Gong to a meeting. And adding an entry does not remove calls already recorded, so build the list before launch.
What security certifications does Gong publish?
| Attestation | What it covers |
|---|---|
| SOC 2 Type II | Security, availability, confidentiality and privacy; Gong says it maps HIPAA controls in this audit |
| ISO/IEC 27001, 27017, 27018 | Information security management, cloud security controls, and protection of personal data in public clouds |
| ISO/IEC 27701 | Privacy information management |
| ISO/IEC 42001 | AI management system |
| PCI DSS (SAQ-D) | Payment card data handling |
| CSA STAR Registry | Cloud Security Alliance listing |
| Data Privacy Framework | EU-U.S., UK Extension and Swiss-U.S. certification |
Gong also states that customer data is encrypted in transit with at least TLS 1.2 and at rest with AES-256, that customers can bring their own keys, and that it uses third-party penetration testing. Request the reports through Gong's Trust Center.
Is Gong GDPR compliant, and can our data stay in the EU?
Gong describes your organization as the controller that owns the data and itself as the processor. It says it meets GDPR and CCPA requirements through updated Standard Contractual Clauses in its Data Processing Addendum, and it publishes a sub-processor list. Gong hosts data on AWS. New customers can choose a US or EU data center, and the default is the US, so make that choice at signing. One caveat for the Gong dialer: in the EU data center, communications data stays in the EU, but some Twilio resources such as phone numbers stay in the US.
How long does Gong keep recordings, and how is data deleted?
By default, Gong keeps calls, emails and transcripts for the lesser of three years and the time you are a customer. A Tech admin can change the period. Calls saved in the company library are not deleted automatically unless you turn on the setting that applies retention to the library. Shortening the period purges calls permanently, and Gong says it cannot restore them. To handle an individual's deletion request, a Tech admin enters their email address or phone number and Gong deletes the matching calls, emails, contacts and leads. Delete the person in your CRM first so the record does not sync back. When a contract ends, Gong deletes customer data within 30 days.
Does Gong redact sensitive information?
Yes, optionally. Numeric redaction removes digit sequences at or above a length you set from both the audio and the transcript, which Gong positions for card numbers and other personal data. It applies to new calls, not historical ones, the removal is irreversible, and it can affect quantity trackers, so redact the fewest digits your business needs. Gong also offers PHI redaction, currently for English-language calls only.
Who can see, download and delete calls?
Permission profiles control access to calls, emails, deals, forecasts, CRM data and exports. Call-level permissions decide who can download call media and who can delete calls. Gong supports SSO through SAML 2.0 and OpenID Connect, SCIM provisioning, and an Audit API that logs both your users' activity and access by Gong staff. Map profiles to roles before go-live rather than giving everyone the default.
Does Gong train its AI on our calls?
Gong's trust page states that customer data is never used to train generative AI models and is never shared with or exposed to the public domain. Gong also holds ISO/IEC 42001 for AI management. If your security team needs more than that statement, such as how non-generative models are built, ask Gong to confirm it in writing.
Can regulated firms such as financial services and healthcare use Gong?
Gong publishes several controls these teams look for: HIPAA controls mapped in its SOC 2 Type II audit, PHI redaction for English calls, PCI DSS SAQ-D, numeric redaction and bring-your-own-key encryption. Its public pages do not say whether it signs a Business Associate Agreement, so ask Gong directly if you need one, and have compliance review recording and retention rules for your industry.
Can we export our recordings if we leave Gong?
Plan for it before the contract ends, because data is deleted within 30 days of termination. Gong's help center describes downloading a single call as audio or video, plus an English transcript, for users with the download call media permission, and its API provides transcripts and call data such as participants, trackers and scorecards. Gong's public pages do not describe a bulk export of recordings, so ask Gong how to get media out at scale and write the answer into your contract.
How do you get your InfoSec team comfortable with Gong?
- Share Gong's Trust Center and request the SOC 2 Type II report and ISO certificates.
- Review the Data Processing Addendum and sub-processor list with legal and privacy.
- Decide US or EU hosting before signing.
- Write down the consent, exclude list, retention and redaction settings, and have counsel approve them.
- Map permission profiles to roles and connect SSO and SCIM before rollout.
As a Gong Certified Partner with 900+ Gong projects delivered, we configure and document these settings for your security and legal teams. Your counsel signs off on consent.
Questions people also ask
Does Gong handle all-party (two-party) consent?
Gong gives you the tools, but your counsel decides the rule. You can enforce the consent page so a meeting is recorded only when every participant agrees, add an audio prompt and a pre-call email, and use separate consent profiles for different teams or regions. Telephony calls and meeting room systems still need a verbal notice.
Is Gong SOC 2 compliant?
Yes. Gong states it is SOC 2 Type II compliant, with a report covering security, availability, confidentiality and privacy that also maps HIPAA controls. It also lists ISO/IEC 27001, 27017, 27018, 27701 and 42001. Request the reports through Gong's Trust Center.
Where is Gong data stored?
Gong hosts data on AWS. New customers can choose a US or EU data center, and the default is the US, so choose at signing. If you use the Gong dialer in the EU data center, some Twilio resources such as phone numbers stay in the US.
How long does Gong keep call recordings?
By default, the lesser of three years and the time you are a customer. A Tech admin can change the period. Company library calls are kept until deleted unless you apply retention to the library. Purged calls cannot be restored, and data is deleted within 30 days after the contract ends.
Does Gong use our calls to train its AI?
Gong states that customer data is never used to train generative AI models and is never shared with or exposed to the public domain. Gong also holds ISO/IEC 42001 for AI management. If your security review needs more detail, ask Gong to confirm its approach in writing.
