Category: CRM & Sales
Secure Gong browsing
Gong's trust center lists SOC 2 and ISO 27001. Browser risk centers on the session. A stolen session reaches call recordings and deal notes.
Quick answer
Gong publishes its security documents at trust.gong.io. Its list includes SOC 2 and ISO/IEC 27001. It also lists ISO/IEC 42001:2023 for AI management. Those audits cover Gong's systems, not your browser. Gong holds call recordings, transcripts, and deal notes. Stolen sessions and fake shared-call pages expose them. Verify unexpected recording links with the sender. Open unknown links in an isolated browser.
Last updated
2026-10-30
Main browser risks for Gong
- Phishing that impersonates Gong notifications, recordings, or “shared call” links.
- External links inside notes or shared resources that route users to malicious destinations.
- Session hijacking and token theft leading to access to customer recordings and analysis.
- Data leakage from copying sensitive customer details into untrusted tools or AI prompts.
- Downloading call assets or exports from untrusted contexts without scanning.
Typical sensitive data in Gong
- Call recordings and transcripts (often sensitive).
- Customer contact information and meeting notes.
- Deal context and sales enablement content.
- Links to connected CRMs and calendars.
- Exports and analytics reports.
- User access and permission settings.
What Gong's trust center lists
| Item | Type | What it covers |
|---|---|---|
| SOC 2 | Audit report, including a SOC 2 Type 2 + HIPAA report | Security controls at Gong |
| ISO/IEC 27001 | Certification | Information security management |
| ISO/IEC 27017:2015 and 27018:2019 | Certifications | Cloud security and cloud privacy controls |
| ISO/IEC 27701 | Certification | Privacy information management |
| ISO/IEC 42001:2023 | Certification | AI management system |
| PCI DSS and TX-RAMP Level 2 | Compliance programs | Card data handling and Texas state cloud use |
Listed on trust.gong.io, checked October 30, 2026.
Recommended controls by role
Sales
- Verify unexpected recording links with the sender first.
- Avoid downloading exports or attachments from unknown sources without scanning.
- Keep customer details out of unapproved AI tools.
IT Admins
- Enforce SSO and session limits through your identity provider.
- Isolate unknown links from Gong notifications and shared resources.
- Restrict browser extensions and risky permissions across revenue teams.
Security
- Monitor for unusual export patterns and suspicious logins.
- Use isolation for investigating suspicious “shared recording” landing pages.
- Apply stricter controls to roles with broad customer data access.
Where Shield fits with Gong
The controls above are general security practices, not Legba features. Gong is not a Legba integration.
Legba's part is narrow. Shield opens a page in an isolated browser off your device. Use it for a link you do not trust.
Limits
Shield moves page execution off your device. Downloads and copied data still cross that boundary. It cannot stop you sharing passwords with unfamiliar sites. Treat downloads and sign-in prompts with care.
Free for 30 days. No card required.
Gong security questions
Where is Gong's trust center?
Is Gong ISO 42001 certified?
What should reps do with an unexpected shared-call link?
Can copied call notes leak through AI tools?
References
- 01
- 02
- 03
Keep exploring
- How to open a suspicious link safelyVerify the sender first. Isolate only what you must inspect.
- ShieldShield opens a page in an isolated browser off your device.
- All guidesThreats, secure apps, and AI security pages.
- All secure app guidesBrowse apps by category.
- Browser threatsUnderstand threats and mitigation patterns.
- AI security guidesBrowse guides about AI prompt leakage and prompt injection.
