FAQs for data protection & privacy
  • 6 minute read
  • Contributors
  • Dark
    Light

FAQs for data protection & privacy

  • Dark
    Light

Article summary

Gong records meeting events forwarded by additional domain users if the sender's email address is associated with a Gong user, the sender's email domain is authorized in Gong, or the domain is mapped for data capture. Gong is PCI DSS compliant for data in transit. Customizable controls define which web conferences Gong records, while emails are imported based on CRM sales contacts. Excluding specific domains, email addresses, or words is recommended to control imports. The exclude list applies to CC and BCC, and changes are not retroactive. Voice identification helps identify speakers in calls, and personal data deletion removes associated calls, emails, leads, and contacts. Gong retains recorded call data for up to 3 years, excluding library calls.

Data capture domains & mapped domains

When does Gong record events forwarded by additional domain users?

In order to record meeting events forwarded to Gong by a sender with an email address in an additional domain, one of the following conditions must be met:

  • The sender’s email address must be associated with a Gong user

  • The sender's email address domain must be authorized in Gong as a data capture domain

  • The sender's email address domain must be a mapped domain for data capture.

For example, John@legacy_domain.com forwards a meeting event to [email protected]. In order to record the meeting, one of the following conditions must be met:

  • John's email address John@legacy_domain.com is associated with his Gong account, which is set up with [email protected]

  • legacy_domain.com is authorized in Gong as a data capture domain

  • legacy_domain.com is mapped to company.com in the Data protection & privacy settings > Mapped domains for data capture section, so that Gong knows that john@legacy_domain.com and [email protected] are the same user.

Data protection

Is Gong compliant with PCI DSS?

Yes, Gong handles data in transit in a way that's compliant with PCI DSS (Payment Card Industry Data Security Standard). Go here for all the details.

Exclude list for web conference & email import

What web conference calls does Gong record?

Gong provides multiple customizable controls for defining which web conferences it records. Gong will record a web conference based on your customizations, and any changes you make in the web conferencing software.

What emails does Gong import?

Gong imports emails based on sales contacts in your CRM. Gong does not import bulk emails, or emails sent from or to mailing lists, such as sales and support.

What should I add to the exclude list?

We recommend that you exclude domains and specific email addresses for which you do not want to import email communication or web conference meetings, for example, your investors. You can also exclude by words in email subjects and web conference titles; enter words that might appear in email subjects you don’t want to import, such as “privileged”, “confidential”, “offer letter”, “interview”, etc.

What terms are in the default exclude lists?

Gong has added some common terms to the exclude lists that cover emails and web conference meetings that typically you won't want to import into Gong. To see the full list, go here.

Can I exclude multiple domains, emails addresses, and subjects?

Yes! Enter each domain, address, or words on a separate line, or separated by commas.

If I exclude an email alias, does it exclude all the people in that email list?

If you exclude an alias, only the alias address itself is added to the exclude list. The people who belong to an email list alias are not excluded individually.

Does the exclude list apply for CC and BCC?

If an excluded domain or email address is CC’d on an email or web conference invite, or BCC's in an outgoing email, Gong does not import the mail.

In incoming emails, if an excluded domain or email address is BCC’d, Gong can not know they are included, and therefore the mail is imported or web conference is recorded unless it matches other exclude criteria.

If I change something to the exclude list, is it applied retroactively?

If you add something to the exclude list, here's what happens:

  • Gong immediately stops importing matching emails and web conferences.

  • Gong removes any imported emails that match the new list.

  • Gong removes any future scheduled calls that match the new list, but leaves (does not remove) any recorded or live web conferences that match the new list.

If you remove something from the exclude list, here's what happens:

  • Emails: From this point, all emails are checked against the updated exclude list and imported if they do not match the exclude list criteria. Existing emails are not reprocessed, therefore historic emails that should not be excluded according to the updated list are not imported to Gong.

  • Web conferences: From this point, all web conferences are checked against the updated exclude list, and will be recorded if they do not match the exclude list criteria. We also delete cached data and reprocess all existing meetings. This can take up to 1.5 hours, in which time, there is a risk that we'll miss recording a meeting that should be recorded. In this case, add the Gong recorder manually (either by adding [email protected] to the meeting participants, by forwarding the calendar invite (as an attachment) to [email protected], by clicking Schedule in the homepage, or by using the mobile recorder).

To remove existing web conference calls, follow these steps.

Does the exclude list apply when working with Microsoft Exchange on-premises?

Emails and events that match exclude list criteria are not imported to Gong, as expected.

After you make a change to the exclude list, cancel and recreate any existing web conference meetings that no longer match the exclude list to make sure that they are recorded by Gong.

Are ad hoc calls excluded too?

If you record a call ad hoc (either by adding [email protected] to the meeting participants, by forwarding the calendar invite (as an attachment) to [email protected], by clicking Schedule in the homepage, or by using the mobile recorder), Gong disregards the exclude list rules and records the call.

Information redaction

What happens when I redact digits?

When you redact digits, Gong removes any sequence equal to or above the given number from the audio and transcript. In the audio, the recording skips that part of speech; in the transcript, the sequence is replaced by asterisks. Redacting digits may affect quantity trackers.

How many digits do you recommend redacting?

Data redaction is mainly used for PCI and PII regulations to hide private or credit card information. We recommend that you redact the minimum number of digits in a sequence, but the exact number depends on your business.

What happens after I select or change the number of digits to redact?

All new calls that contain that number of digits or more are irreversibly removed. Historical calls are not affected.

Voice identification

Why would I enable voice identification?

Voice identification helps identify speakers in calls made using telephony systems that record calls in mono, or when a call recording is manually uploaded to Gong.

In mono calls, it can be difficult to identify the different speakers. In order to associate a voice with the Gong user it belongs to, so that we can then assign to them relevant stats and insights, Gong uses machine learning to identify the company side of the call. In some cases (for example, when the call recording is not in English), Gong may not identify the user correctly. In such cases, you can enable voice identification so that Gong can identify the Gong-using participant in the call.This capability lets Gong use a small sampling of voice recordings for each Gong user to identify them during calls. For more information, see this.

When speakers cannot be distinguished in a call, they are marked on the call page as Speaker 1 and Speaker 2. If you see many unidentified speakers in your org’s calls, we recommend that you enable voice identification.

Delete personal data

What exactly gets deleted when you delete someone’s personal data?

We locate any calls, emails, leads, or contacts that refer to the given email address or phone number, and delete all these entities from Gong. In addition, we delete any associated Gong data that was synced to Salesforce, such as Gong conversations and tasks.

How long does it take to delete someone’s data?

It can take several hours to delete all entities associated with someone’s data.

Data retention policy

Does Gong have a data retention policy?

Gong's data retention policy is that we keep data for recorded calls and all related artifacts (such as transcripts and statistics) for up to 3 years, by default.

Calls stored in the library are excluded from this policy, and are preserved indefinitely.


Was this article helpful?

Changing your password will log you out immediately. Use the new password to log back in.
First name must have atleast 2 characters. Numbers and special characters are not allowed.
Last name must have atleast 1 characters. Numbers and special characters are not allowed.
Enter a valid email
Enter a valid password
Your profile has been successfully updated.
ESC

Bruno AI, a genAI helper, will scrub our help center to give you an answer that summarizes our content. Ask a question in plain language and let me do the rest.