Compliance - HeyGen Documentation

Audit reports, sub-processors, policies and pen test summaries are in the Trust Center, and the full program is on the compliance page. Your account team confirms which reports and products your contract covers.

Standard	Status	Scope
SOC 2 Type II	In place	Independent audit against the AICPA Trust Services Criteria. The 2025 report, 2026 bridge letter and confirmation letter are in the Trust Center.
SOC 3	In place	General-use summary of the SOC 2 audit.
GDPR	In place	EU and UK GDPR apply to all personal data processing, with a Europe-based DPO and a Data Processing Addendum.
CCPA	In place	California and other U.S. state privacy laws. See the state disclosures.
Data Privacy Framework	In place	EU-U.S., UK Extension and Swiss-U.S. frameworks, listed on the DPF list.
HIPAA	Enterprise	HIPAA-eligible services under a signed BAA. Send PHI only after the BAA is executed.
EU AI Act	By December 2, 2026	Invisible watermarks, provenance metadata and a verification tool for AI-generated content. Details.
Zero Data Retention	Enterprise	Scheduled deletion of API content after an agreed retention period. See below.

Your data

Enterprise data is excluded from AI training by default.
Biometric data, such as the face and voice behind a digital twin, is processed with the subject’s explicit consent.
EU-to-US transfers rely on the Data Privacy Framework, and every sub-processor is under a DPA.

Zero Data Retention

Zero Data Retention (ZDR) is enabled per workspace or subspace under a ZDR addendum and covers API content created after activation. Covered content enters scheduled deletion when its agreed retention period expires, and your ZDR addendum sets the completion schedule.


Scheduled for deletion	Inputs, outputs and intermediates of each request
Retention period	24 hours to 100 days, counted from the content’s last qualifying use. Qualifying reuse, a Video Agent follow-up or a proofread edit restarts the period.
Kept until you delete them	Avatars, voice clones, brand kits and templates
Kept in logs	Request IDs, timestamps, status and usage, as shown in Request Logs. Prompts, media, transcripts and download URLs stay out of logs.

Download results to your own storage before the retention period expires: video_url and other download links stop resolving once content is deleted. Use webhooks to fetch each result as soon as it completes. Your customer agreement, DPA and ZDR addendum set the exact scope and deletion timing.

Request documents

Contact sales for a BAA or a ZDR addendum. The Privacy Policy, Terms of Service and Trust and Safety pages cover the rest.

⌘I