PCI DSS compliance

PCI DSS is a information security standard for organizations that handle payment card information. Credit card payment brands require adherence to the PCI DSS standard for any entity that processes, transmits, or stores cardholder data. The standard was created to increase controls around cardholder data to reduce credit card fraud. Validation of compliance is performed annually.

Gong’s PCI DSS compliance includes the completion of the SAQ-D questionnaire and external validation by a Qualified Security Assessor (QSA). Gong’s PCI DSS environment is limited in scope and does not cover the entire Gong platform. Gong’s current PCI DSS compliance only applies to the mechanisms that ingest calls from external telephony systems.

The PCI DSS compliant environment includes Gong’s application integrations with telephony systems only, initial storage of these calls, and processing intended to redact all payment card information from these calls i a non-recoverable manner. The QSA’s scope consisted of Gong’s API servers, call analyzer processors, the ability to identify and redact PCI-related data, and the temporary storage of calls before the sensitive data is redacted. What is not in scope of Gong’s PCI DSS compliance are web recorders’ calls or videos and other types of data (e.g. email). Gong The Reality Platform® is not intended to store payment card information.

The customer’s responsibility is to define the redaction rules for calls being uploaded from telephony systems to the Gong application. This can be done easily in the DATA PROTECTION & PRIVACY settings by defining the minimum sequence of digits that should be redacted. Once this is defined, all future calls will have these settings applied both on the audio files as well as on the call transcripts. Gong will only redact data based on the redaction settings the customer has defined. The customer still has the ability to delete recordings or telephony uploads. It is the customer’s responsibility to adhere to Gong’s stated PCI DSS scope.