1. Overview
The Gong integration reads authorized call metadata, extensive call data, transcripts, participants, users, topics, trackers, and explicit call-user access through a Technical Admin API key pair.
Call media URLs are excluded unless separately approved; call content remains restricted because Gong roles and sharing do not produce a complete Seedling audience projection.
2. Connection and scope
Seedling verifies the provider account before storing the connection. A personal connection remains actor-owned; a workspace connection is administered for the selected Seedling workspace. Credentials are never inferred from an email address or silently promoted between scopes.
- Gong API access key and secret
- A Gong Technical Admin creates the key pair for the intended company account and assigns the released least-privilege read capabilities.
- Connection ownership
- Seedling supports actor-owned personal access and administrator-managed workspace access for this connector. The selected scope and exact connection remain fixed through synchronization, rotation, disconnect, and purge.
3. Gong data Seedling accesses
Seedling uses synchronized information for source-backed search, operating context, verification, and customer-approved workflows. Availability depends on the connected account, selected resources, provider plan, and native permissions.
- Calls
- Call identity, title, timing, duration, direction, systems, and participant context.
- Conversation content
- Authorized transcripts, speakers, topics, trackers, and supported summaries.
- People and access
- Gong users, external parties, ownership, attribution, and explicit call-user access records.
4. Read-only permission contract
Grant the Gong key pair only the released call and user read scopes.
- api:users:read — Gong users and attribution.
- api:calls:read:basic and api:calls:read:extensive — call metadata, participants, topics, trackers, and supported extended fields.
- api:calls:read:transcript — authorized transcripts.
- api:call-user-access:read — explicit call-user access diagnostics.
- api:logs:read is optional future permission-change evidence; api:calls:read:media-url remains excluded unless separately approved.
- No call, user, tracker, topic, library, or sharing mutation is implemented.
5. Security and access
- Provider credentials and other connection secrets are encrypted in the workspace tenant data plane, never returned to the browser, and excluded from logs and queue payloads.
- Every source, synchronization, secret lookup, audience contribution, disconnect, and purge remains bound to the exact connection that created it.
- The provider does not expose enough complete object-level audience evidence for Seedling to reproduce native permissions safely. Workspace content therefore uses the connection's restricted-by-default workspace-or-no-human-access policy; administrator and steward status grant no raw-content bypass.
- For a personal connection, raw content remains visible only to the connecting member in human-facing Seedling surfaces. Personal content may contribute to trusted system exploration under workspace policy, but that authority never transfers to another member.
- Generated output cannot bypass Seedling's human review, verification, and approval gates.
6. Retention and deletion
- Connected data
- Synchronized Gong records remain while the connection is active and are removed through a durable integration purge after disconnect.
- Credentials
- Stored Gong credentials or connection secrets and connection-owned synchronization state are deleted from active Seedling systems as part of the purge.
- Backups
- Deleted information may remain in encrypted, access-restricted backups until expiry, ordinarily within 35 days after active-system deletion.