PCI DSS compliance

PCI DSS is a proprietary information security standard for organizations that handle payment card information. The PCI Standard is mandated by payment card brands and administered by the Payment Card Industry Security Standards Council. The standard was created to increase controls around cardholder data to reduce credit card fraud. Validation of compliance is performed annually.

Gong’s PCI DSS compliance includes the completion of the SAQ-D questionnaire and an external validation by a Qualified Security Assessor (QSA).

Gong may distribute the PCI DSS AOC to interested parties after they execute a non-disclosure agreement (NDA) with Gong. To receive an NDA from Gong, contact your Customer Success Manager or sales account executive.

The PCI DSS compliant environment includes the Gong app integrations with telephony systems, initial storage of these calls, and processing intended to redact all credit card information from these calls in a non recoverable manner.

Once enabled, all data stored and processed in the Gong Service is “free” of credit card information and the resulting environment is PCI DSS compliant.

All customers can make use of the Gong PCI DSS compliance by defining the redaction rules for calls uploaded through telephony system integrations.

The customer’s responsibility is to define the redaction rules for calls being uploaded from telephony systems to the Gong Service. This can be done easily in the DATA PROTECTION & PRIVACY settings by defining the minimum sequence of digits that should be redacted. Once this is defined all future calls will have these settings applied both on the audio files as well as on the call transcripts.