Gong Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for Gong

1. 1

   Request Gong's SOC 2 Type II report and a bridge letter: contact their security team via trust.gong.io or email office.ciso@gong.io. Most enterprise vendors respond within 5–10 business days under NDA. Verify the audit period covers the last 12 months.

   SOC 2 Overview (AICPA)
2. 2

   Request the ISO 27001 certificate with issuing certification body and certificate number, then independently cross-reference at iafcertsearch.org to confirm active status and expiry — look up by organization name or certificate number.

   ISO 27001 Standard
3. 3

   Execute the AI training opt-out under Gong's privacy policy before go-live: locate the opt-out mechanism at gong.io/legal/privacy-policy, submit the request in writing, and document confirmation. Escalate to your legal/privacy team if opt-out confirmation is not provided.

4. 4

   Request Gong's Data Processing Agreement (DPA) and verify it includes: (a) explicit prohibition on AI training without affirmative consent or contractual opt-out, (b) defined data retention and deletion timelines for AI-processed data, and (c) subprocessor change notification requirements consistent with GDPR Article 28.

   GDPR Full TextDPA Template (GDPR Art. 28)
5. 5

   Request the PCI DSS SAQ-D Attestation of Compliance (AoC) and CSA STAR Level 1 self-assessment from Gong's security team; the CSA STAR registry (cloudsecurityalliance.org/star/registry) should also have the self-assessment publicly available if submitted.

   PCI DSS Standards
6. 6

   Scan the application domain (app.gong.io) separately using HTTP security scanner (observatory.mozilla.org) to assess whether the authenticated application environment has stronger security header configuration than the marketing site, and document findings in your vendor risk register.

   NIST Supply Chain Risk (SP 800-161)
7. 7

   Schedule a vendor risk review in 12 months or sooner if Gong announces significant changes to their AI data handling practices, subprocessor list, or ownership structure.

   GDPR Subprocessor RulesNIST Supply Chain Risk (SP 800-161)

• Certificate Transparency log data (Certificate Transparency service) was unavailable during this assessment; subdomain enumeration is based solely on direct TLS handshake data, which may be incomplete.
• Web archive history data was unavailable, limiting the ability to assess domain establishment age and historical site changes through that source.
• External cyber risk scoring was not available for this assessment; the infrastructure exposure analysis is based on direct scanning only.
• Domain registration (RDAP) data was not found for gong.io; this may reflect the .io ccTLD's limited RDAP coverage rather than a registration anomaly.
• The Legal Entity Registry legal entity match returned a low-confidence result (disambiguation score 30/100) referencing an unrelated Faroese entity; no verified LEI registration for Gong, Inc. was found through this source.
• HTTP security scanner scanned the marketing site (gong.io) rather than the application endpoint (app.gong.io); security header grades may differ materially for the authenticated application environment.
• SSL/TLS analysis service deep cipher analysis was not completed during this assessment; TLS configuration details are based on direct TLS handshake data only.
• ISO 27001 verification via IAF CertSearch returned no match; this may reflect search limitations or the certificate being listed under a legal entity name that differs from the trade name 'Gong'.
• SOC 2 reports are confidential and no public registry exists — compliance status cannot be independently verified by any automated means and requires direct document review.