Privacy facts at a glance
- Jurisdictions
- US · EU · IL · IE
- Subprocessors
- 9
- Retention
- The DPA states Gong processes Customer's Personal Data for the duration under the Agreement, but no specific retention period in days is stated.
- Breach notification
- The trust center references a Data Breach Notifications section, but no specific notification timeframe in hours is stated in the provided documents.
- Transfer mechanism
- Standard Contractual Clauses (EU SCCs, UK Addendum, and Switzerland Addendum)
- SCC modules
- Module 2 · Module 3
- DPA available
- Yes
- Certifications
- CSA STAR Level 1 · EU-US DPF · ISO/IEC 27001 · ISO/IEC 27017:2015 · ISO/IEC 27018:2019 · ISO/IEC 27701 · ISO/IEC 42001:2023 · PCI DSS · SOC 2
- GDPR addressed
- Yes
- CCPA addressed
- Yes
Named subprocessors
Gong.io Ltd.
Amazon Web Services, Inc.
MongoDB, Inc.
Mailgun Technologies, Inc.
Twilio, Inc.
Gongio Ireland Limited
Google Cloud EMEA Limited
Snowflake Inc.
Microsoft Ireland Operations Limited
Tracked documents
Recent changes
Public summary; per-account review history visible to subscribers tracking this vendor.
Track Gong in your workspace.
Get notified when Gong adds a subprocessor, changes retention, updates their DPA, or quietly amends their privacy posture.
Start tracking — 14-day trialNo card required.