AI Vendor BAA Check

Does Gong sign a BAA?

Not confirmed

Gong says it maps HIPAA controls in its SOC 2 Type II audit and offers PHI redaction on request. None of its official pages says whether it signs a BAA.

Based on 5 sources, all from Gong unless marked.

Business associate
Gong
Tool
Gong
Plans with a BAA
Not stated
Checked
Not confirmed
No BAA offer found on Gong's own pages.

By plan

PlanBAAHow to get itConditions
All Gong plansNot confirmedNot statedThe trust center says Gong is not a covered entity and maps HIPAA controls in its SOC 2 Type II audit. The healthcare page says Gong helps customers stay HIPAA compliant. No page mentions a BAA.[1],[2],[3]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Gong says about each one.

AI featureUnder the BAADetails
AI briefs, summaries and tracker detectionsNot statedGong turns on PHI redaction only on request, and only for English-language calls. Gong warns that redaction may affect AI briefs, summaries and trackers. No page says whether a BAA covers these features.[4],[5]

Meeting note-takers that offer a BAA

  • Fireflies.aiBAA on: EnterpriseSome plans only
  • GranolaBAA on: EnterpriseSome plans only
  • Krisp AI Meeting AssistantBAA on: Meeting AI Enterprise (Business tier), 100+ seatsSome plans only
  • MeetGeekBAA on: Any annual planSome plans only
  • Otter.aiBAA on: Enterprise (with HIPAA add-on)Some plans only
  • Read AIBAA on: Enterprise+ (annual)Some plans only

All BAA-ready alternatives to Gong

Sources

  1. Gong Trust CenterGong, Trust center. Checked Oct 11, 2026.
  2. Review Gong compliance certifications and attestationsGong, Help center. Checked Oct 11, 2026.
  3. Gong for HealthcareGong, Documentation. Checked Oct 11, 2026.
  4. Summary of security featuresGong, Help center. Checked Oct 11, 2026.
  5. Redact sensitive informationGong, Help center. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.