How many subprocessors does Gong use?

Gong lists 9 subprocessors on its published list, including Gong.io Ltd., Amazon Web Services, Inc., MongoDB, Inc., Mailgun Technologies, Inc., and Twilio, Inc. and 4 more.

Where does Gong process customer data?

The subprocessors named by Gong are located in EU, USA, global endpoints for application AI services, Ireland, and Israel, as stated on its list.

How quickly does Gong report a personal data breach to customers?

According to its DPA, Gong reports a personal data breach to customers without undue delay, with no set deadline: “will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer's Personal Data”

How much notice does Gong give before adding a subprocessor?

Gong's DPA gives 5 days' notice of a new subprocessor, the time customers have to object: “by providing a written objection to [email protected] within 5 business days following Gong's written notice to Customer of the intended engagement with the New Sub-Processor”

How does Gong transfer personal data outside the EU?

Gong's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions: “The parties agree that the terms of the Standard Contractual Clauses are hereby incorporated by reference and shall apply to an EEA Transfer.”

When was Gong's subprocessor list last checked?

ClauseTrail last checked Gong's subprocessor list on September 25, 2026. Lists are re-checked daily.

How do I find out when Gong adds or removes a subprocessor?

ClauseTrail monitors Gong's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Gong Subprocessors List (September 2026): Changes and History

Gong names 9 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked September 25, 2026 Official source ↗

Gong subprocessors (September 2026)

#	Subprocessor	Purpose	Location
1	Gong.io Ltd.	Providing the Gong service	Israel
2	Amazon Web Services, Inc.	Cloud services, language transcription, and application AI functionality	USA, EU, global endpoints for application AI services
3	MongoDB, Inc.	Data storage and querying	USA, EU
4	Mailgun Technologies, Inc.	Transactional email	USA, EU
5	Twilio, Inc.	VOIP and text message notifications	USA, EU
6	Gongio Ireland Limited	A wholly-owned Gong subsidiary	Ireland
7	Google Cloud EMEA Limited	Cloud services, language transcription, and application AI functionality	USA, EU, global endpoints for application AI services
8	Snowflake Inc.	Data storage and querying	USA, EU
9	Microsoft Ireland Operations Limited	Cloud services and application AI functionality	USA, EU, global endpoints for application AI services

Get an email when Gong changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Gong free

Key DPA terms at Gong

What Gong's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer's Personal Data”
DPA, www.gong.io ↗
Notice of a new subprocessor: 5 days ahead

“by providing a written objection to [email protected] within 5 business days following Gong's written notice to Customer of the intended engagement with the New Sub-Processor”
DPA, www.gong.io ↗
Transfers outside the EU: Standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions

“The parties agree that the terms of the Standard Contractual Clauses are hereby incorporated by reference and shall apply to an EEA Transfer.”

“Personal Data may be transferred from the EEA, Switzerland or the UK to organizations in the United States of America ("USA") certified under the EU-US Data Privacy Framework, the UK Extension to the EU-US Data Privacy Framework, or the Swiss-US Data Privacy Framework”

“Personal Data may be transferred from EU Member States, the three EEA member countries (Norway, Liechtenstein and Iceland) (collectively, "EEA"), Switzerland, or the United Kingdom ("UK"), to countries that offer an adequate level of data protection pursuant to the adequacy decisions”
DPA, www.gong.io ↗
Customer data after the contract ends: Deleted within 30 days of the contract ending

“Upon 30 days following termination or expiration of the Agreement, Gong shall delete all Customer Data in its possession or control.”
DPA, www.gong.io ↗
Audit rights: Once a year

“the audit will be pre-scheduled in writing with Gong, at least 45 days in advance and will be performed not more than once a year”
DPA, www.gong.io ↗

Documents we track for Gong

DPA: checked September 25, 2026 www.gong.io ↗
Privacy policy: checked September 25, 2026 www.gong.io ↗
Subprocessor list: checked September 25, 2026 www.gong.io ↗

Change history

Tracking since September 25, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

Gong subprocessors FAQ

How many subprocessors does Gong use?: Gong lists 9 subprocessors on its published list, including Gong.io Ltd., Amazon Web Services, Inc., MongoDB, Inc., Mailgun Technologies, Inc., and Twilio, Inc. and 4 more.
Where does Gong process customer data?: The subprocessors named by Gong are located in EU, USA, global endpoints for application AI services, Ireland, and Israel, as stated on its list.
How quickly does Gong report a personal data breach to customers?: According to its DPA, Gong reports a personal data breach to customers without undue delay, with no set deadline: “will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer's Personal Data”
How much notice does Gong give before adding a subprocessor?: Gong's DPA gives 5 days' notice of a new subprocessor, the time customers have to object: “by providing a written objection to [email protected] within 5 business days following Gong's written notice to Customer of the intended engagement with the New Sub-Processor”
How does Gong transfer personal data outside the EU?: Gong's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions: “The parties agree that the terms of the Standard Contractual Clauses are hereby incorporated by reference and shall apply to an EEA Transfer.”
When was Gong's subprocessor list last checked?: ClauseTrail last checked Gong's subprocessor list on September 25, 2026. Lists are re-checked daily.
How do I find out when Gong adds or removes a subprocessor?: ClauseTrail monitors Gong's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.