---
title: "Set up data encryption"
slug: "set-up-for-data-encryption"
updated: 2026-07-23T10:48:17Z
published: 2026-07-23T10:48:17Z
canonical: "help.gong.io/set-up-for-data-encryption"
stale: true
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.gong.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up data encryption

You can use cryptographic keys stored and managed in your AWS Key Management Service (KMS) to encrypt your organization's data stored in Gong.

For Gong to use the external KMS keys, the following is needed:

- The KMS should have a policy that allows a Gong-owned principal (specifically an IAM role), to use the KMS with a set of predefined permissions, for example, Encrypt or Decrypt.
- The principal should have an attached policy to use the KMS with appropriate permissions.

This article explains how to set up the KMS in your AWS account.

## **Required permissions**

This table explains the permissions we need for your key and why:

| Permission | Why we need the permission |
| --- | --- |
| ```plaintext Decrypt Encrypt GenerateDataKey ``` | To enable Gong to store encrypted files for your organization. |
| ```plaintext DescribeKey ``` | To enable Gong to verify that the key is a symmetric key that meets requirements. |
| ```plaintext ListGrants ``` | To enable Gong to list existing grants for the CMK. |
| ```plaintext CreateGrant ``` | To enable Gong to delegate permissions dynamically from the ExternalCmkAccessGranter principal to the various services in Gong that store and read encrypted data. |
| ```plaintext RevokeGrant RetireGrant ``` | To enable Gong to remove the created grant, retire in regular cases, and revoke if some services get forcefully shutdown. |

## Before you start

Copy Gong’s AWS data to be used when setting up your CMK.

**To find AWS details:**

1. From the left sidebar, click **Admin center**.
2. In the **Settings** tab, click **Data protection and privacy** under **Data capture**.
3. Scroll down to **Encrypt data using your key**. Make a note of your company’s data location, AWS region code, and Gong AWS account number.

## **Create and configure your CMK**

**To set up your CMK**:

1. In AWS KMS, make sure your AWS region is set to the AWS region code listed in Gong.
2. In AWS KMS, create a symmetric encryption.

![CMK_config](https://cdn.us.document360.io/2837c190-3ec8-4120-9116-6d427e774667/Images/Documentation/24883313484173.png)
3. Paste the **Gong AWS account number** you copied to add a policy that enables access from the Gong AWS account.

```plaintext
{            
    "Sid": "Allow Gong.io to use this CMK",
    "Effect": "Allow",
    "Principal": {
"AWS":"arn:aws:iam::<Gong account number>:role/ExternalCmkAccessGranter"            
    },
    "Action":[                
    "kms:Decrypt",
    "kms:Encrypt",
    "kms:RevokeGrant",
    "kms:GenerateDataKey",
    "kms:DescribeKey",
    "kms:RetireGrant",    
    "kms:CreateGrant",
    "kms:ListGrants"
    ],
    "Resource": "*"        
}
```

The screenshot below is an example of the policy snippet for the US data center:

![CMK_edit](https://cdn.us.document360.io/2837c190-3ec8-4120-9116-6d427e774667/Images/Documentation/24883296689677.png)

After the KMS is created, make a note of the KMS ARN, for example:

**arn:aws:kms::1234567890:key/12345678-90ab-cdef-1234-123456789ab**

## Encrypt your data

Gong uses this key to encrypt all new S3 files stored in your organization’s Gong account. Existing files will not be re-encrypted.

> [!TIP]
> Important:
> 
> Make sure that you don't delete the key from your KMS. If the key is deleted, all data encrypted in Gong with this key is irreversibly invalidated.

**To set up the data encryption in Gong:**

1. From the left sidebar, click **Admin center**.
2. In the **Settings** tab, click **Data protection and privacy** under **Data capture**.
3. Scroll down to **Encrypt data using your key**.
4. In **KEY ARN TO ENCRYPT S3 FILES**, click **Edit** and enter your key. This encrypts new S3 files stored in your Gong account.
5. In **KEY ARN TO ENCRYPT TRANSCRIPTS**, click **Edit** and enter your key. This encrypts new transcriptions stored in your Gong account.
6. Click **Save**.