Vendor record · gong.io
What Gong promises about your data.
Where Gong publishes its promises, how long it gives you when it adds a sub-processor, and what has changed.
- Where it publishes
Gong lists its sub-processors at gong.io/sub-processors. We last read it on October 16, 2026.
- What has changed
We've recorded no change to its sub-processor list or data processing agreement between August 31, 2026 and September 16, 2026. Subscribers hear about a change the morning we read it; the public record shows it 30 days later.
- Its window
When it adds a sub-processor, its clause at gong.io/legal/data-processing-addendum (read August 31, 2026) gives you 5 business days to object.
- Window
- 5
- Sub-processors
- 9
- Pages
- 6
- Copies
- 37
business days to object when it adds a sub-processor
sub-processors named
pages we watch
dated copies of all its pages, since August 31, 2026
Gong DPA
Gong's data processing agreement gives 5 business days to object to a new sub-processor. Here is the clause, from our August 31, 2026 copy:
5
business days to object
“Customer may object to the Processing of Customer’s Personal Data by the New Sub-Processor, for reasonable and explained grounds, by providing a written objection to [email address on the vendor's page] within 5 business days following Gong’s written notice to Customer of the intended engagement with the New Sub-Processor.”
A person read this clause in its surrounding context and confirmed it says what it appears to say. Nothing here says whether the term is good or bad, only that Gong published it.
gong.io/legal/data-processing-addendum · read 2026-08-31 · fingerprint cab59af09f81c04c…
How it says it sends notice
“Gong’s webpage accessible via https://www.gong.io/sub-processors offers a mechanism to subscribe to notifications of new Sub-Processors, to which Customer may subscribe.”
gong.io/legal/data-processing-addendum · read 2026-10-14
Gong sub-processors
Gong publishes a sub-processor list at gong.io/sub-processors; we last read it on October 16, 2026. It names 9 entries. The entries, as the list prints them: Amazon Web Services, Inc.; Gong.io Ltd.; Gongio Ireland Limited; Google Cloud EMEA Limited; Mailgun Technologies, Inc.; Microsoft Ireland Operations Limited; MongoDB, Inc.; Snowflake Inc.; Twilio, Inc.. The same list is in the full table below. The public record holds no change to the list read before September 16, 2026. A change we read after September 16, 2026 is published 30 days after we read it.
9 named · full table
Every public change we have recorded · Where vendors publish their lists
How long Gong keeps your data
Gong's trust and security page (gong.io/security, in the copy read October 11, 2026) says: “You can request a custom retention period, and all data is permanently deleted 30 days after contract termination.”
Training on customer data
“Understand how insights are generated — and trust that your data is never used to train generative models. Learn about Gong AISee documentation ###### Configurability ## Customize privacy and control settings to fit your needs You’re in control.”
gong.io/security · read 2026-10-11
Training on customer data
“Data Uses We use personal data as necessary for the performance of our Services (“Performance of Contract”); to comply with our legal and contractual obligations (“Legal Obligation**”); and to support our legitimate interests in maintaining and improving our Services, e.g., in understanding how our Services are used and how our campaigns are performing, and gaining insights which help us …”
gong.io/privacy-policy · read 2026-10-10
Retention windows vendors publish · What vendors say about training
What the pages say
Read automatically from the pages below and shown as printed. A missing row is a gap in our reading, not proof it isn’t there.
Sub-processors named · 9
Amazon Web Services, Inc.
Cloud services, language transcription, and application AI functionality
USA, EU; and USA, EU, and global endpoints for application AI services
Gong.io Ltd.
Providing the Gong service
Israel
Gongio Ireland Limited
A wholly-owned Gong subsidiary
Ireland
Google Cloud EMEA Limited
Cloud services, language transcription, and application AI functionality
USA, EU; and USA, EU, and global endpoints for application AI services
Mailgun Technologies, Inc.
Transactional email
USA, EU
Microsoft Ireland Operations Limited
Cloud services and application AI functionality
USA, EU; and USA, EU, and global endpoints for application AI services
MongoDB, Inc.
Data storage and querying
USA, EU
Snowflake Inc.
Data storage and querying
USA, EU
Twilio, Inc.
VOIP and text message notifications
USA, EU
Certifications the trust page names · ISO 27001 · ISO 27017 · ISO 27018 · ISO 27701 · ISO 42001 · PCI DSS · SOC 2 Type II
Laws the trust page names · GDPR · HIPAA
International transfer notice · United States
“To the extent Personal Data from the EEA, Switzerland or the UK is transferred to and processed by Gong in the USA on the basis of Gong’s certification to the DPF, and the Parties can no longer rely on the DPF, Section 6.3 of this DPA shall apply. **6.3.”
gong.io/legal/data-processing-addendum · read 2026-10-14
The pages' own stamps: LAST UPDATED 2026-09 · Last updated 2026-09-29 · LAST UPDATED 2026-06 · revised 2020-09-25
The pages we watch
Every page we read, so you can check it. Each is re-read on a schedule, and we keep a dated copy when it changes.
What this page doesn’t tell you
No score.
Nothing here rates Gong. A short notice window is a contract term, not a criticism.
Public pages only.
Private notices and negotiated terms are invisible to us. Your agreement may say something different.
Wrong? Tell us.
Corrections are free, always. We reply within 2–3 business days.
How we read a page · The change log
Work at Gong? With an email at gong.io you can claim this record, suggest pages we should watch, and take a free copy of it. Claiming changes nothing we publish.
Is Gong in your product? Hear the morning we read a change.
You get the lines that moved, in Gong’s own words, and the date any window closes. No card. Nothing to cancel.