AI Vendor Directory · Sales AI
Does Gong train on your data?
No — does not train on your data by default. Vendor-stated default: no for generative models (all tiers, per Gong's trust page). Gong's trust page states 'your data is never used to train generative models.' Note the scoping: the public commitment covers generative models; whether interaction data is used to improve Gong's non-generative/proprietary feature models (e.g. trackers, scoring) is not stated on the public page — confirm via Gong's trust portal and DPA during review. Operationally the bigger compliance surface is recording itself: Gong provides consent pages/workflows, custom retention and redaction settings, granular permissions and BYO-key encryption; you are responsible for lawful basis and two-party-consent handling for recorded external participants.
By the Shieldra Compliance Team · Last updated 2026-07-29
What is Gong?
Revenue-AI platform that records and analyzes sales calls, emails and CRM activity for coaching, forecasting and deal insights; records both employees and external call participants.
Key facts
- Vendor: Gong.io — https://www.gong.io
- Trains on customer data by default: no for generative models (all tiers, per Gong's trust page)
- Source for the training answer: https://www.gong.io/platform/trust
- Last verified: 2026-07-29
What certifications does Gong hold?
- SOC 2 Type II
- ISO/IEC 27001:2022
- ISO/IEC 27017
- ISO/IEC 27018
- ISO/IEC 27701
- ISO/IEC 42001:2023
- PCI DSS SAQ-D
- CSA STAR
- EU-U.S. Data Privacy Framework
Security, DPA, and subprocessor links
- Security / trust page: https://www.gong.io/platform/trust
- Data processing agreement (DPA): https://www.gong.io/legal/data-processing-addendum
- Subprocessor list: https://www.gong.io/legal/sub-processors
What is your EU AI Act role when you build on Gong?
Deployer; disclose AI recording/analysis to call participants. Caution: the EU AI Act (Article 5) prohibits emotion-recognition systems in the workplace — if you enable sentiment-style analysis of your own employees' calls, get a legal read before turning it on.
What to record in your AI registry
- Provider: Gong.io
- Model type: third party api
- Data typically flowing to the vendor: call recordings (audio/video), transcripts, emails and calendar data, CRM records, participant PII
Sources
- https://www.gong.io/platform/trust
- https://www.gong.io/legal/data-processing-addendum
- https://www.gong.io/legal/sub-processors
Disclaimer
Curated from vendor-published pages on the date above. Vendor terms change - verify against the cited sources before relying on a profile for a procurement decision. Last verified 2026-07-29.
Frequently asked questions
Does Gong train AI models on your data?
No — does not train on your data by default. Vendor-stated default: no for generative models (all tiers, per Gong's trust page). Gong's trust page states 'your data is never used to train generative models.' Note the scoping: the public commitment covers generative models; whether interaction data is used to improve Gong's non-generative/proprietary feature models (e.g. trackers, scoring) is not stated on the public page — confirm via Gong's trust portal and DPA during review. Operationally the bigger compliance surface is recording itself: Gong provides consent pages/workflows, custom retention and redaction settings, granular permissions and BYO-key encryption; you are responsible for lawful basis and two-party-consent handling for recorded external participants.
What certifications does Gong hold?
Per the vendor's published pages as of 2026-07-29: SOC 2 Type II; ISO/IEC 27001:2022; ISO/IEC 27017; ISO/IEC 27018; ISO/IEC 27701; ISO/IEC 42001:2023; PCI DSS SAQ-D; CSA STAR; EU-U.S. Data Privacy Framework.
What is your EU AI Act role when you build on Gong?
Deployer; disclose AI recording/analysis to call participants. Caution: the EU AI Act (Article 5) prohibits emotion-recognition systems in the workplace — if you enable sentiment-style analysis of your own employees' calls, get a legal read before turning it on.
