How many subprocessors does Gong use?

Gong lists 10 subprocessors on its published list, including Gong.io Ltd., Amazon Web Services, Inc., MongoDB, Inc., Mailgun Technologies, Inc., and Twilio, Inc. and 5 more.

Where does Gong process customer data?

The subprocessors named by Gong are located in EU, USA, Global, United States, Ireland, and Israel, as stated on its list.

How quickly does Gong report a personal data breach to customers?

According to its DPA, Gong reports a personal data breach to customers without undue delay, with no set deadline: “will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data”

How much notice does Gong give before adding a subprocessor?

Gong's DPA gives 5 days' notice of a new subprocessor, the time customers have to object: “by providing a written objection to privacy@gong.io within 5 business days following Gong's written notice to Customer of the intended engagement with the New Sub-Processor”

How does Gong transfer personal data outside the EU?

Gong's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions: “The parties agree that the terms of the Standard Contractual Clauses are hereby incorporated by reference and shall apply to an EEA Transfer.”

When was Gong's subprocessor list last checked?

ClauseTrail last checked Gong's subprocessor list on November 9, 2026 and last saw it change on November 7, 2026. Lists are re-checked daily.

How do I find out when Gong adds or removes a subprocessor?

ClauseTrail monitors Gong's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Gong Subprocessors List (November 2026): Changes and History

Gong names 10 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked November 9, 2026 Last change November 7, 2026 Official source ↗

Gong subprocessors (November 2026)

#	Subprocessor	Purpose	Location
1	Gong.io Ltd.	Providing the Gong service	Israel
2	Amazon Web Services, Inc.	Cloud services, language transcription, and application AI functionality	United States, EU, Global
3	MongoDB, Inc.	Data storage and querying	USA, EU
4	Mailgun Technologies, Inc.	Transactional email	USA, EU
5	Twilio, Inc.	VOIP and text message notifications	USA, EU
6	Gongio Ireland Limited	A wholly-owned Gong subsidiary	Ireland
7	Google Cloud EMEA Limited	Cloud services, language transcription, and application AI functionality	United States, EU, Global
8	Snowflake Inc.	Data storage and querying	USA, EU
9	Microsoft Ireland Operations Limited	Cloud services and application AI functionality	United States, EU, Global
10	LiveKit Incorporated	Real-time communications and infrastructure services	USA, EU

Get an email when Gong changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Gong free

Key DPA terms at Gong

What Gong's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data”
DPA, www.gong.io ↗
Notice of a new subprocessor: 5 days ahead

“by providing a written objection to privacy@gong.io within 5 business days following Gong's written notice to Customer of the intended engagement with the New Sub-Processor”
DPA, www.gong.io ↗
Transfers outside the EU: Standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions

“The parties agree that the terms of the Standard Contractual Clauses are hereby incorporated by reference and shall apply to an EEA Transfer.”

“Personal Data may be transferred from the EEA, Switzerland or the UK to organizations in the United States of America ("USA") certified under the EU-US Data Privacy Framework, the UK Extension to the EU-US Data Privacy Framework, or the Swiss-US Data Privacy Framework”

“Personal Data may be transferred from EU Member States and the three EEA member countries (Norway, Liechtenstein and Iceland) (collectively, "EEA"), Switzerland, or the United Kingdom ("UK"), to countries that offer an adequate level of data protection pursuant to the adequacy decisions published by the relevant data protection authorities”
DPA, www.gong.io ↗
Customer data after the contract ends: Deleted within 30 days of the contract ending

“Upon 30 days following termination or expiration of the Agreement, Gong shall delete all Customer Data in its possession or control.”
DPA, www.gong.io ↗
Audit rights: Once a year

“the audit will be pre-scheduled in writing with Gong, at least 45 days in advance and will be performed not more than once a year (except for an audit following a Personal Data Breach)”
DPA, www.gong.io ↗

Documents we track for Gong

DPA: checked November 9, 2026 changed September 30, 2026 www.gong.io ↗
Privacy policy: checked November 9, 2026 changed September 30, 2026 www.gong.io ↗
Subprocessor list: checked November 9, 2026 changed November 7, 2026 www.gong.io ↗

Change history

November 7, 2026

Subprocessor added

Gong added LiveKit Incorporated (USA, EU) as a subprocessor.
September 30, 2026

Privacy policy changed

Gong's privacy policy adds a new category, "Professional Data" — personal data about business professionals obtained from public sources and third-party data providers for enrichment features like Gong Enrich — for which Gong now acts as "data controller" and which it may sell to Customers under the CCPA. The policy also narrows SMS-sharing protections (no longer excludes "sold or rented" data or sharing with "partners") and removes the standalone Mobile Information/SMS Compliance clause.
September 30, 2026

DPA changed

The DPA's definitions were revised to introduce a new term "Customer Personal Data" throughout, and Section 2.1 now states "Except as set forth under Schedule 2, this DPA applies when Customer Personal Data is Processed by Gong strictly on behalf of Customer," with a new cross-reference to Schedule 2 added in Section 2.3 describing categories of personal data." The intro also dropped language limiting the DPA to processing "in the course of providing the Services to Customer under the Agreement," and the diff is truncated before Schedule 2's actual content is shown.

Tracking since September 25, 2026. Every change links to the two versions of the document it came from. All vendors' changes →

Gong subprocessors FAQ

How many subprocessors does Gong use?: Gong lists 10 subprocessors on its published list, including Gong.io Ltd., Amazon Web Services, Inc., MongoDB, Inc., Mailgun Technologies, Inc., and Twilio, Inc. and 5 more.
Where does Gong process customer data?: The subprocessors named by Gong are located in EU, USA, Global, United States, Ireland, and Israel, as stated on its list.
How quickly does Gong report a personal data breach to customers?: According to its DPA, Gong reports a personal data breach to customers without undue delay, with no set deadline: “will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data”
How much notice does Gong give before adding a subprocessor?: Gong's DPA gives 5 days' notice of a new subprocessor, the time customers have to object: “by providing a written objection to privacy@gong.io within 5 business days following Gong's written notice to Customer of the intended engagement with the New Sub-Processor”
How does Gong transfer personal data outside the EU?: Gong's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions: “The parties agree that the terms of the Standard Contractual Clauses are hereby incorporated by reference and shall apply to an EEA Transfer.”
When was Gong's subprocessor list last checked?: ClauseTrail last checked Gong's subprocessor list on November 9, 2026 and last saw it change on November 7, 2026. Lists are re-checked daily.
How do I find out when Gong adds or removes a subprocessor?: ClauseTrail monitors Gong's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.