> ## Documentation Index
> Fetch the complete documentation index at: https://heygen-1fa696a7.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance

> HeyGen's security and privacy certifications, Zero Data Retention for API content, and where to get audit reports, the DPA and a BAA.

![](https://mintcdn.com/heygen-1fa696a7/hfMXXwJzjE7vBSYZ/images/theme/research.webp?fit=max\&auto=format\&n=hfMXXwJzjE7vBSYZ\&q=85\&s=3e4c2594813dcfd56985f3d63e3ba321)

Audit reports, sub-processors, policies and pen test summaries are in the [Trust Center](https://security.heygen.com/), and the full program is on the [compliance page](https://www.heygen.com/enterprise/compliance). Your account team confirms which reports and products your contract covers.

| Standard | Status | Scope |
| :- | :- | :- |
| SOC 2 Type II | In place | Independent audit against the AICPA Trust Services Criteria. The 2025 report, 2026 bridge letter and confirmation letter are in the [Trust Center](https://security.heygen.com/). |
| SOC 3 | In place | General-use summary of the SOC 2 audit. |
| GDPR | In place | EU and UK GDPR apply to all personal data processing, with a Europe-based DPO and a [Data Processing Addendum](https://www.heygen.com/data-processing-addendum). |
| CCPA | In place | California and other U.S. state privacy laws. See the [state disclosures](https://www.heygen.com/privacy#14-additional-us-state-disclosures). |
| Data Privacy Framework | In place | EU-U.S., UK Extension and Swiss-U.S. frameworks, listed on the [DPF list](https://www.dataprivacyframework.gov/list). |
| HIPAA | Enterprise | HIPAA-eligible services under a signed BAA. Send PHI only after the BAA is executed. |
| EU AI Act | By December 2, 2026 | Invisible watermarks, provenance metadata and a verification tool for AI-generated content. [Details](https://help.heygen.com/en/articles/11395771-heygen-s-compliance-with-the-eu-ai-act). |
| Zero Data Retention | Enterprise | Scheduled deletion of API content after an agreed retention period. See [below](#zero-data-retention). |

## Your data

* Enterprise data is excluded from AI training by default.
* Biometric data, such as the face and voice behind a [digital twin](https://heygen-1fa696a7.mintlify.site/docs/avatar-from-video.md), is processed with the subject's explicit [consent](https://heygen-1fa696a7.mintlify.site/docs/avatar-consent.md).
* EU-to-US transfers rely on the Data Privacy Framework, and every sub-processor is under a DPA.

## Zero Data Retention

Zero Data Retention (ZDR) is enabled per workspace or subspace under a ZDR addendum and covers API content created after activation. Covered content enters scheduled deletion when its agreed retention period expires, and your ZDR addendum sets the completion schedule.

| | |
| :- | :- |
| **Scheduled for deletion** | Inputs, outputs and intermediates of each request |
| **Retention period** | 24 hours to 100 days, counted from the content's last qualifying use. Qualifying reuse, a [Video Agent](https://heygen-1fa696a7.mintlify.site/docs/video-agent.md) follow-up or a proofread edit restarts the period. |
| **Kept until you delete them** | Avatars, voice clones, brand kits and templates |
| **Kept in logs** | Request IDs, timestamps, status and usage, as shown in [Request Logs](https://heygen-1fa696a7.mintlify.site/docs/request-logs.md). Prompts, media, transcripts and download URLs stay out of logs. |

Download results to your own storage before the retention period expires: `video_url` and other download links stop resolving once content is deleted. Use [webhooks](https://heygen-1fa696a7.mintlify.site/docs/webhooks.md) to fetch each result as soon as it completes.

Your customer agreement, DPA and ZDR addendum set the exact scope and deletion timing.

## Request documents

[Contact sales](https://www.heygen.com/contact-us/sales) for a BAA or a ZDR addendum. The [Privacy Policy](https://www.heygen.com/privacy), [Terms of Service](https://www.heygen.com/terms) and [Trust and Safety](https://www.heygen.com/trust-and-safety) pages cover the rest.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.