Gong AI Vendor Risk Profile
Revenue intelligence platform that records, transcribes, and analyzes sales conversations. Uses AI to surface deal insights, forecast revenue, coach reps, and identify winning behaviors across calls, emails, and meetings.
Risk overview
Risk score: 37/100
Risk tier: Moderate
Safety rating: 63/100 (higher is better)
Lower risk scores indicate lower assessed risk.
Last verified: Apr 19, 2026 Aging
Risk dimensions
| Dimension | Risk score |
|---|---|
| Data Handling | 42/100 |
| IP Exposure | 31/100 |
| Jurisdiction | 13/100 |
| Security | 26/100 |
| Regulatory Compliance | 60/100 |
| Transparency | 80/100 |
| Business Stability | 37/100 |
| Dependency Chain | 32/100 |
| Agent Governance | Not assessed |
Analyst summary
Rating: Acceptable
Gong is the category leader in revenue-intelligence AI, capturing sales calls, emails, and deals to drive forecasting and coaching. Data handling is solid (no training on customer data, SOC 2, ISO 27001, GDPR DPA), and built-in consent capture helps with two-party-consent jurisdictions. The absence of a HIPAA BAA limits healthcare use and the vendor's Israel-based engineering presence introduces some operational risk factors.
Bottom line: Category leader for sales AI; solid data posture for non-healthcare enterprise use.
Strengths
- No training on customer conversations; data isolated per tenant
- SOC 2 Type II, ISO 27001/27017/27018/27701 certified
- Mature GDPR DPA with EU data residency available
- Built-in consent capture supports two-party-consent wiretap compliance
- Customer retains full ownership of conversation recordings and AI summaries
- Category-defining revenue-intelligence feature set (calls, emails, deals, forecasting)
Concerns
- No HIPAA Business Associate Agreement; healthcare is out of scope
- Large engineering footprint in Tel Aviv introduces operational risk during regional conflict
- Premium pricing (high per-user cost) limits adoption to mid-market and enterprise
- AI features depend on some third-party LLM providers under zero-retention contracts
- Recording and transcription surface creates employee-surveillance concerns to navigate
Best for
- Enterprise and mid-market sales organizations wanting AI coaching and forecasting
- Revenue operations teams standardizing on one conversation-intelligence platform
- Organizations needing two-party-consent recording compliance built into the platform
Avoid if
- You handle PHI or other HIPAA-regulated conversation data
- Your sales team will not accept recording and AI-scoring of calls
- Your budget cannot support premium per-user conversation-intelligence pricing
Citations
- Data Handling — Hipaa Baa Available
Gong does not currently offer HIPAA Business Associate Agreements; HIPAA workloads are not supported.
- Data Handling — Third Party Data Sharing
Gong AI uses a combination of in-house and third-party LLMs under zero-retention subprocessor agreements.
- Data Handling — Trains On User Data
Gong does not use customer conversation data to train generative AI foundation models, and does not share customer data across tenants.
- Governance — Wiretap Compliance
Gong supports two-party-consent jurisdictions with built-in consent capture and recording disclosures to support compliance with state and federal wiretap laws.
- Ip Profiles — User Owns Outputs
Customer retains all ownership rights in Customer Data, including conversation recordings and AI-generated summaries derived from Customer Data.
- Jurisdiction Profiles — Incorporation Country
Gong.io Inc. is a Delaware corporation with headquarters in San Francisco, California, and significant operations in Tel Aviv, Israel.
- Security Compliance — Gdpr Compliant
Gong provides a GDPR-compliant Data Processing Addendum and supports EU data residency for qualifying customers.
- Security Compliance — Iso 27001
Gong holds ISO/IEC 27001, 27017, 27018, and 27701 certifications.
- Security Compliance — Soc2 Type2
Gong maintains SOC 2 Type II certification with annual independent audits.