FAQs about Office 365 mail integration

Gong offers two ways of connecting to Office 365 mailboxes: User-by-user (OAuth) or company-wide (Azure app).

In user-by-user mode, the company’s Gong admin selects users to import emails for in the Team Members configuration page. Users will then receive an invitation over email to connect their mailbox using OAuth. Each user must approve Gong’s access to their mailbox for Gong to be able to import their emails.

In company-wide mode, the company’s Azure admin installs Gong’s Azure app, allowing it to access the mailboxes of all users in the company’s Azure AD, or a subset of them. Gong will then scan the mailboxes of users who are set to be imported, without the need for individual user approval.

Gong requests the following permission scopes:

These scopes are used to identify the user (user.read, profile, openid, email), read their mailboxes (mail.read) and do so in the background without requiring the user to initiate each sync (offline_access).

As with all user data, Gong encrypts authentication tokens with keys managed by Amazon’s AWS Key Management System (KMS), using AES-256 encryption. Data is stored on the AWS N. Virginia data center.

You can read more about Gong’s security policy at https://www.gong.io/security/

In user-by-user mode, users can revoke OAuth access at any time from their Office 365 account settings. Admins can revoke individual user access in the Azure admin portal, or block the app altogether in the API Permissions settings.

In company-wide mode, admins can uninstall Gong’s Azure app from the active directory, removing access to all users at once.

Gong periodically scans mailboxes of users who are set for email import by the company’s Gong admin, looking through the message meta-data to determine whether it should be imported.

The following rules are applied to make this decision:

In Gong’s Email Import settings page, an admin can manage the lists of blacklisted addresses, domains, and phrases. A message containing any of these will be ignored and not imported.

Adding new entries to the blacklist will delete from Gong’s database all previously imported matching messages.

Users and admins can delete imported messages in the email preview screen. Admins can delete all email messages, while standard users can only delete messages from accounts associated with them.

Admins can also add entries to the participant and phrases blacklists, which will delete all matching messages.

After an integration with the customer’s CRM has been established, Gong uses the CRM API to match participants to CRM accounts, contacts and leads, by looking at their email addresses and domains.

If a participant’s email address matches that of a contact or lead, the message will be assigned to them. If a participant’s domain matches any of the domains assigned to an account or a lead, the message will be assigned to that account or lead.

Messages can be assigned to multiple accounts or leads. Messages without any matching participants will not be imported.

No. Gong does not store any information about messages that do not pass the previously described filters. Any meta-data collected for filtering purposes is never stored in Gong’s database or any other form of permanent storage, and is wiped when the filtering process terminates.

Gong stores imported email data in the AWS N. Virginia data center.

Data is encrypted both in-transit and at rest with keys managed by Amazon’s AWS Key Management System (KMS), using AES-256 encryption.

You can read more about Gong’s security policy at https://www.gong.io/security/

An admin can configure access for the Beat account page where emails can be shown in the Permission Profile settings page.

The customer owns the data, and Gong processes it to provide the service.

Read more about Gong’s Data Processing Addendum (DPA) at https://www.gong.io/data-processing-addendum/

Gong delete all user data and emails based on its data retention policy, which is set to 3 years by default.

Yes. Customer data is deleted within 30 days of contract termination.