The standards HeyGen meets, what each one covers, and where to find the evidence.
An independent audit of how HeyGen’s security controls operate over time.
The general-use summary of the SOC 2 audit, ready to share.
HeyGen applies the EU and UK GDPR as the standard for all of its personal data processing.
HeyGen acts as both controller and processor of personal data and meets its obligations in each role.
Access, rectification, erasure and the other GDPR rights are handled promptly. Write to [email protected].
Special categories of personal data, including biometric data, are processed only with explicit consent and with additional security measures.
A dedicated DPO based in Europe oversees GDPR matters and is reachable at [email protected].
HeyGen provides a Data Processing Addendum to controllers and holds DPAs with all of its sub-processors. The sub-processor list is in the Trust Center.
Transfers of personal data from Europe to the US rely on the Data Privacy Framework.
Enterprise data is excluded from AI training by default. Any user can opt out by writing to [email protected].
SOC 2 Type II controls, with data protection by design and by default built into processing activities.
HeyGen’s GDPR Compliance Statement, effective 22 October 2024. HeyGen monitors regulatory guidance and court decisions and updates its practices as they change.
Privacy rights for residents of California and states with similar laws.
Certified for transfers of personal data from the EU, the UK and Switzerland to the US.
HeyGen offers HIPAA-eligible services for Enterprise customers under an applicable BAA.
As a provider under the EU AI Act, HeyGen is committed to having its transparency measures in place by December 2, 2026.
Configurable automatic deletion for content submitted to or created through the HeyGen API.
Avatars, voice clones, brand kits and templates sit outside the ZDR window and are kept until you delete them. A job that uses one still follows the ZDR schedule.
Request IDs, timestamps, processing status and usage are kept to operate, secure and bill the service. Logs exclude prompts, scripts, transcripts, media and download URLs.
Covered content is scheduled for automatic deletion after the agreed retention window, counted from its last qualifying use. Completion timing follows the ZDR addendum.
Yes. Reusing covered content before it expires restarts its window, so repeated reuse can extend retention beyond the original window.
Their covered content stays on the ZDR deletion schedule.
New jobs follow the new setting. Content already scheduled keeps its deadline, unless qualifying reuse changes it.
ZDR applies to covered API content created after activation. Your account team can discuss retention options for existing and in-app content.
Deleted content is no longer available through the service. Keep your own copy of anything you need.
It shows the resource is unavailable. On its own it does not confirm deletion across all systems.
Restrictions on using customer content for model training are set out in your customer agreement.
ZDR applies to covered API content created after activation. This overview does not amend your customer agreement, data processing addendum or ZDR addendum; the signed agreements govern scope, deletion timing, exclusions and any legally required retention.
An Accessibility Conformance Report for the HeyGen app, in preparation.
Reports, policies, pen test summaries and sub-processors live in the Trust Center.
Privacy questions: [email protected]