Is HeyGen Safe? Data Training, Consent and Security Facts

The short answer: legitimate, with one setting to change

HeyGen is a real, funded company. It is run by HeyGen Technology Inc., a Delaware corporation based in Los Angeles, founded by Joshua Xu and Wayne Liang and backed by a Series A round led by Benchmark. On security, the paperwork looks solid: HeyGen says it is SOC 2 Type II compliant, encrypts data with TLS 1.2 or higher in transit and AES-256 at rest, and stores all customer data in the United States on AWS ^[1]. The trade-off is data use. Below Enterprise, your content can train HeyGen's models unless you opt out. Enterprise data is excluded.

So the honest verdict is safe to use, not private by default. A marketer making product explainers with stock avatars carries little risk. A team cloning a real employee's face and voice, or handling regulated data, needs to read the three layers below first. Two gaps matter most for buyers: HeyGen lists no ISO 27001 and makes no HIPAA claim. Everything else in this article is what HeyGen's own legal, security and help pages say, attributed as such.

What HeyGen may do with your scripts, face and voice

The rules sit in three documents, and they stack. The Terms are the widest layer: you grant HeyGen a royalty-free, sublicensable, worldwide and irrevocable licence to use your content, including to train and improve its AI models, and that licence survives the end of your account ^[2]. The privacy policy names the inputs it may use for training: text, voice, scripts, images and videos. It rests that on legitimate interest and lets you object by contacting HeyGen by email.

That opt-out is not a toggle. The security page says non-Enterprise customers may opt out at any time by contacting HeyGen, so nothing happens until you ask. Enterprise customers are excluded by default, and the Enterprise contract goes further: HeyGen uses customer data only to perform the agreement, the customer owns data and output, and data is deleted within 60 days after termination. HeyGen also says its contracts bar every AI subprocessor from training on customer data. Never read a marketing line about not training on customer content as covering Creator, Pro or Business.

The biometric notice is the third layer, and it is narrower than the Terms. For custom avatars HeyGen collects face geometry and may collect a voiceprint from your footage. It compares that geometry with a separate verification recording to confirm the consenting person is the one on screen, and deletes verification-only data typically within minutes ^[3]. Outside Enterprise, videos and face geometry train models only if you granted that consent. Creating an avatar does not require it.

HeyGen states it does not sell, lease or trade biometric data. Retention depends on where you live. For EEA, UK and Swiss users, avatar biometrics are destroyed within 60 days of avatar deletion or account termination. Illinois residents get destruction when the purpose is met or within three years of the last interaction, whichever comes first; Texas residents, within one year after the purpose expires. Under the CCPA, HeyGen says it does not sell or share personal information.

The website side is ordinary ad tech. The privacy policy lists Google Analytics, Datadog, DoubleClick and Meta, used partly for remarketing and targeted ads, and says the site ignores do-not-track signals. Visitors in the EU and UK are asked before non-essential trackers are set. One detail matters for companies: the privacy policy does not cover customers of HeyGen's enterprise or business offerings. Their data handling is governed by their customer contracts instead.

Consent: whose face and voice can become an avatar

Digital Twins are where HeyGen is strictest. Every video-based twin needs an on-camera consent clip by the person depicted, under about 30 seconds, reading HeyGen's text and a four-letter code. It must be the same person as the training footage. Screen recordings and AI-generated clips fail. To build an avatar of someone else, that person gives consent on their own phone through a QR code. Uploading a pre-recorded consent video is Enterprise only, and skipping consent entirely is Enterprise only with an indemnity agreement.

The depicted person can request removal of their likeness at any time. Removal has limits, though. Deleting an avatar does not delete videos already made, and HeyGen's developer docs say the footage, consent video and cloned voice are each deleted separately. Footage with nudity or minors is rejected, and a detected celebrity face goes to human moderation. Our HeyGen AI avatar guide covers the setup steps.

Three paths have no consent check at all. Photo Avatars are built from a single still image, and HeyGen runs no consent check and keeps no consent record; getting the subject's agreement is the customer's job ^[4]. Prompt-generated characters depict no real person, so no step applies. Professional Voice Clone uploads have no consent step either, according to HeyGen's help center. The missing check is technical, not a permission: HeyGen's Terms still forbid impersonating anyone, so the responsibility sits with you.

Moderation, age and what you may publish

HeyGen scans uploaded and generated content with machine-learning models, then sends flagged items to trained human moderators. The prohibited list covers violence, hate, fraud, sexual content, child-safety violations, misinformation, political content and campaigning, intellectual-property violations, and public figures used without consent. Mature educational or religious content is allowed only with custom avatars and labels. Enforcement runs up to account removal or reporting to authorities, and the Terms let HeyGen remove or edit user content at any time.

Moderation can slow you down. Videos can sit in Pending, and support cannot speed that up. Appeals go by email to HeyGen's moderation team, and a response is not guaranteed. The Terms require users to be 18 or older. Where the law requires it, you must disclose that a video was made with AI, and HeyGen's industry pages leave advertising and disclosure rules to the user.

Plan choice is a legal question too. The Free plan is for personal, non-commercial use only, one Free account is allowed per person, and HeyGen can cap or remove Free features without notice. Paid plans can switch off the HeyGen logo watermark at the Generate step, and workspaces have an AI-Assisted Watermarking setting. HeyGen says it discloses AI-generated content in line with Article 50 of the EU AI Act.

Certifications and hosting: what HeyGen claims, and what is missing

HeyGen uses the word compliant for SOC 2 Type II and offers the report on request through its Security Portal. It names a Data Protection Officer in Europe, with the Irish Data Protection Commission as lead authority. The published DPA casts HeyGen as processor, promises incident notice within 48 hours and gives customers 10 days to object to new sub-processors. Unresolved Data Privacy Framework complaints go to BBB National Programs, a free US-based mechanism.

The listed sub-processors are Microsoft Azure and ElevenLabs for text-to-speech, Intercom for support, AWS for hosting and processing, Datadog and Cloudflare, all with data in the United States. That is the catch for European buyers. There is no EU data residency option; transfers rely on the Data Privacy Framework and standard contractual clauses. HeyGen's own comparison table marks ISO 42001 as not held.

Other controls HeyGen lists: an annual third-party penetration test, daily backups, tenant separation, MFA for staff, role-based access, Cloudflare DDoS protection, employee background checks and a vulnerability disclosure programme. For healthcare, HeyGen's own page says its three healthcare video types use no protected health information, and patient-data workflows need a conversation with HeyGen first. HeyGen's status page reported 99.998% availability for the app and 99.83% for the API from July to October 2026.

Locking down your account and reading the fine print

Account security is basic but present. Two-factor authentication is set under Settings, Account tab, with an authenticator app after an emailed verification code. If you sign in with Google or Apple, you have no HeyGen password; turn on 2FA with that provider instead. SAML single sign-on comes with Business and Enterprise, with setup guides for Okta and Microsoft Entra ID. Enterprise adds SCIM provisioning, an audit log and a choice of allowed sign-in methods.

The dispute terms deserve a calendar note. The Terms send disputes to binding AAA arbitration with a class-action waiver, after an informal resolution period of at least 60 days, under California law with in-person hearings in Los Angeles County. You can opt out of arbitration by written notice within 30 days of first access. Miss that window and the waiver applies. Money is the last risk. Payments are generally non-refundable except where law requires, and plans renew automatically; our guide to cancelling HeyGen covers refund windows and the add-on cancellation trap.

The bottom line

HeyGen is a legitimate vendor with credible security claims, a real consent gate for Digital Twins and a clear moderation policy. The weak spots are specific. Content on Creator, Pro and Business can train HeyGen's models until you email an opt-out, Photo Avatars and Professional Voice Clones skip consent checks, all data stays in the US, and HeyGen lists no ISO 27001 or HIPAA claim. Opt out early, enable 2FA, and decide on arbitration within 30 days. EU-resident or HIPAA-covered data belongs elsewhere, since no HeyGen plan offers EU hosting or a BAA; Synthesia, for one, publishes EU data residency. Other confidential business data is safest on Enterprise, which is excluded from model training by default.