HeyGen vs. Synthesia: data protection per plan
HeyGen (4 plans) and Synthesia (4 plans) side by side: DPA, training on inputs, hosting and data retention per plan, based on the providers’ public documents. Without rating.
Last updated: (latest review date of the tools shown)
At a glance
Each value is listed with the plans it applies to. Pick a tier to see only plans of that tier; if plans are chosen in the plan comparison below, the table shows exactly those.
All plans: each value is listed with the plans it applies to.
| Feature | HeyGen | Synthesia |
|---|---|---|
| Provider based in | HeyGen Technology Inc., 12130 Millennium Drive Suite 300, Los Angeles, CA 90094, USA | Synthesia Ltd, 20 Triton Street, Regent's Place, 3rd Floor, London NW1 3BF, United Kingdom |
| Plans recorded | 4 | 4 |
| Hosting | US only: all 4 plans | mixed: all 4 plans |
| Training on inputs | opt-out available: Free, Creator / Pro, Businessno: Enterprise | no: all 4 plans |
| DPA | yes: all 4 plans | yes: all 4 plans |
| As of | 18 Oct 2026 | 18 Oct 2026 |
Plans compared
Comparing: HeyGen Business vs. Synthesia Starter
| Feature | HeyGenBusiness | SynthesiaStarter |
|---|---|---|
| yes | yes | |
| Details: DPA available | yes (Data Processing Addendum; according to the Terms, applies when a business accepts the Terms; version 'Effective as of October 2024') Provider’s DPA | yes (Customer Terms: Data Processing Addendum 'hereby incorporated by reference'; additionally a pre-signed PDF version as of 2026-07-22 for countersignature by email to dpasubmission@synthesia.io; no differentiation by plan) Provider’s DPA |
| differs by plan | opt-out available | no |
| Details: Training on inputs | Security page: 'Non-enterprise customers may opt out at any time by contacting' the privacy contact; contracts with all AI sub-processors prohibit training on customer data. Privacy policy (as of 2026-10-15): submitted texts, voices, scripts, images and videos may be used for training on the basis of legitimate interest, opt-out by email to the privacy address. Terms (as of 2026-10-15, Section 3 for Creator/Pro/Business): licence to 'Your Content' also 'to train or otherwise improve or modify our artificial intelligence and machine learning models'. For avatars, face/body parts are processed; biometric verification on the basis of explicit consent. Trust Center FAQ: data of non-enterprise customers 'may be used to train and enhance the models that power our Services'; according to the FAQ, opt-out via the privacy policy (request by email). | AI Governance Practices: Synthesia does not use customer data (inputs and outputs) for pre-training its AI components; fine-tuning with customer data only on the customer's written instruction. Privacy Policy (effective 2026-10-01): usage information and feedback are processed to improve the platform and models; for avatar creation, facial/voice data (biometric data) are processed with consent, among other things to create the avatar and to fine-tune the model. DPA clause 2.2: no processing 'for any purpose other than providing the Services to Customer'; under clause 3.1, sub-processors must agree equivalent restrictions on use. Explicit exclusion of training in the sub-processor list only in the OpenAI entry. Documentation does not differentiate by plan. |
| differs by plan | US only | mixed |
| Details: Data residency | Security page: 'All HeyGen customer data is stored in the United States on AWS infrastructure.' Sub-processor list in the Trust Center: all service providers with data location USA except BytePlus (Singapore, video generation for Video Agent). For EU customers, HeyGen refers to its certification under the EU-US Data Privacy Framework. | Security Practices: customer data is currently stored in the EU in AWS data centres in Ireland; operational backups in Ireland, secondary backups in the AWS Frankfurt region. EU-US transfer within AWS based on the SCCs of the AWS DPA; transfer impact assessment at security.synthesia.io/documents. The sub-processor list additionally names providers in the USA, Japan and Singapore. Documentation does not differentiate by plan. |
| list available | list available | |
| Details: List published |
|
|
| differs by plan | Privacy policy | Security Practices: deletion of customer… |
| Details: Data retention | Privacy policy (as of 2026-10-15): according to the text, deletion requests are processed within 72 hours; backups/disaster recovery are retained for 60 days and then permanently deleted. In general (section 8): retention for as long as necessary to provide the services or with permission, based on criteria such as account administration, maintaining generated content, dispute resolution; no fixed periods stated for videos and avatars. | Security Practices: deletion of customer data on request within up to 90 days; without a request, automatic deletion within 90 days after account termination; export of videos up to 90 days after the end of the contract; residual copies may remain in backups for a limited period. Daily database backups for at least three months. Security-relevant logs up to 4 years. DPA clause 7.2: after termination of the Services, destruction of all personal data after 90 days unless the customer has requested their return beforehand. Customer Terms: export may be limited by the plan and by the retention settings enabled by the customer. |
| differs by plan | 149 USD/mo… (further prices in the details) | several tiers |
| Details: Price | USD 149/month or USD 119/month with annual payment (USD 1,428 per year) with 1,500 credits; additional seats USD 20 per seat per month; credit packs and auto-reload available, prices for these not stated (pricing page). Not stated whether VAT is included; according to the Terms, the customer bears applicable taxes ('including all taxes'). | Pricing page in browser (retrieved from Germany, EUR): EUR 19 per month with monthly billing (1,250 credits/month); EUR 12 per month with annual billing (15,000 credits/year); learner seat EUR 29 monthly or EUR 25 with annual billing. Server-side version in USD: USD 29 or USD 18 per month, learner seat USD 29 or USD 25. No indication whether VAT is included. |
| yes | yes | |
| Details: AI features included | yes (1,500 credits/month, videos up to 60 min, 4K, 5 custom avatars; SAML/SSO, central billing, workspace collaboration and team management according to the pricing page) | yes (1,250 credits/month according to the pricing page) |
| 6 sources | 8 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- HeyGen Businessyes
- Synthesia Starteryes
- HeyGen Business
yes (Data Processing Addendum; according to the Terms, applies when a business accepts the Terms; version 'Effective as of October 2024')
Provider’s DPASynthesia Starteryes (Customer Terms: Data Processing Addendum 'hereby incorporated by reference'; additionally a pre-signed PDF version as of 2026-07-22 for countersignature by email to dpasubmission@synthesia.io; no differentiation by plan)
Provider’s DPA
Training
- differs by plan
- HeyGen Businessopt-out available
- Synthesia Starterno
- HeyGen Business
Security page: 'Non-enterprise customers may opt out at any time by contacting' the privacy contact; contracts with all AI sub-processors prohibit training on customer data. Privacy policy (as of 2026-10-15): submitted texts, voices, scripts, images and videos may be used for training on the basis of legitimate interest, opt-out by email to the privacy address. Terms (as of 2026-10-15, Section 3 for Creator/Pro/Business): licence to 'Your Content' also 'to train or otherwise improve or modify our artificial intelligence and machine learning models'. For avatars, face/body parts are processed; biometric verification on the basis of explicit consent. Trust Center FAQ: data of non-enterprise customers 'may be used to train and enhance the models that power our Services'; according to the FAQ, opt-out via the privacy policy (request by email).
Synthesia StarterAI Governance Practices: Synthesia does not use customer data (inputs and outputs) for pre-training its AI components; fine-tuning with customer data only on the customer's written instruction. Privacy Policy (effective 2026-10-01): usage information and feedback are processed to improve the platform and models; for avatar creation, facial/voice data (biometric data) are processed with consent, among other things to create the avatar and to fine-tune the model. DPA clause 2.2: no processing 'for any purpose other than providing the Services to Customer'; under clause 3.1, sub-processors must agree equivalent restrictions on use. Explicit exclusion of training in the sub-processor list only in the OpenAI entry. Documentation does not differentiate by plan.
Hosting
- differs by plan
- HeyGen BusinessUS only
- Synthesia Startermixed
- HeyGen Business
Security page: 'All HeyGen customer data is stored in the United States on AWS infrastructure.' Sub-processor list in the Trust Center: all service providers with data location USA except BytePlus (Singapore, video generation for Video Agent). For EU customers, HeyGen refers to its certification under the EU-US Data Privacy Framework.
Synthesia StarterSecurity Practices: customer data is currently stored in the EU in AWS data centres in Ireland; operational backups in Ireland, secondary backups in the AWS Frankfurt region. EU-US transfer within AWS based on the SCCs of the AWS DPA; transfer impact assessment at security.synthesia.io/documents. The sub-processor list additionally names providers in the USA, Japan and Singapore. Documentation does not differentiate by plan.
Sub-processors
- HeyGen Businesslist available
- Synthesia Starterlist available
- HeyGen Business
- Amazon Web Services (web hosting, data storage, image moderation, video processing): USA
- AI: Anthropic (LLM), OpenAI and Google (script generation, video translation, text-to-speech, content moderation), xAI (LLM, TTS, voice clone), Microsoft Azure and Elevenlabs (text-to-speech), Cartesia (TTS, voice clone), Gladia (speech recognition), fal (image generation): each USA
- BytePlus (video generation for Video Agent): Singapore
- Datadog (monitoring, log storage), Posthog (data analytics), Hex and Snowflake (data processing and querying), Retool (internal tooling), LiveKit (no purpose stated), Cloudflare (DNS): each USA
- Customer.io (email communication), Intercom (customer support and help centre): USA
Synthesia Starter- Amazon Web Services EMEA SARL (Luxembourg): hosting, storage, computing power, hosted AI models
- MongoDB Limited (Ireland): production data
- Mux Inc. (USA): video delivery
- StackOne Technologies Ltd (UK): third-party integrations
- Modal Labs, Inc. (USA): computing power for video processing
- ClickHouse, Inc. (USA): analytics for sessions
- Script processing: Google Cloud EMEA (Ireland), IBM United Kingdom, CoeFont (Japan), WellSaid Labs (USA), Microsoft Ireland, Eleven Labs Inc. (USA), DeepL SE (Germany), OpenAI OpCo (USA), Cinder Technologies (USA), Anthropic PBC (USA), Cartesia AI (USA), Exa Labs (USA; web search)
- Asset processing: UAB ConvertAPI (Lithuania), Canva Austria GmbH (Austria; pre-processing for Custom Avatars), Runway AI (USA), Features & Labels (USA), AssemblyAI (USA), LiveKit (USA), ai-coustics GmbH (Germany), BFL GmbH (Germany), BytePlus Pte. Ltd. (Singapore; hosted AI models)
- Other: Intercom R&D Unlimited Company (Ireland), Datadog, Inc. (USA)
- Group companies: Synthesia Inc. (USA), Synthesia B.V. (Netherlands), Synthesia GmbH (Germany), Synthesia ApS (Denmark)
Retention
- differs by plan
- HeyGen BusinessPrivacy policy
- Synthesia StarterSecurity Practices: deletion of customer…
- HeyGen BusinessPrivacy policy (as of 2026-10-15): according to the text, deletion requests are processed within 72 hours; backups/disaster recovery are retained for 60 days and then permanently deleted. In general (section 8): retention for as long as necessary to provide the services or with permission, based on criteria such as account administration, maintaining generated content, dispute resolution; no fixed periods stated for videos and avatars.Synthesia StarterSecurity Practices: deletion of customer data on request within up to 90 days; without a request, automatic deletion within 90 days after account termination; export of videos up to 90 days after the end of the contract; residual copies may remain in backups for a limited period. Daily database backups for at least three months. Security-relevant logs up to 4 years. DPA clause 7.2: after termination of the Services, destruction of all personal data after 90 days unless the customer has requested their return beforehand. Customer Terms: export may be limited by the plan and by the retention settings enabled by the customer.
Price
- differs by plan
- HeyGen Business149 USD/mo… (further prices in the details)
- Synthesia Starterseveral tiers
- HeyGen Business
USD 149/month or USD 119/month with annual payment (USD 1,428 per year) with 1,500 credits; additional seats USD 20 per seat per month; credit packs and auto-reload available, prices for these not stated (pricing page). Not stated whether VAT is included; according to the Terms, the customer bears applicable taxes ('including all taxes').
Synthesia StarterPricing page in browser (retrieved from Germany, EUR): EUR 19 per month with monthly billing (1,250 credits/month); EUR 12 per month with annual billing (15,000 credits/year); learner seat EUR 29 monthly or EUR 25 with annual billing. Server-side version in USD: USD 29 or USD 18 per month, learner seat USD 29 or USD 25. No indication whether VAT is included.
- HeyGen Businessyes
- Synthesia Starteryes
- HeyGen Business
yes (1,500 credits/month, videos up to 60 min, 4K, 5 custom avatars; SAML/SSO, central billing, workspace collaboration and team management according to the pricing page)
Synthesia Starteryes (1,250 credits/month according to the pricing page)
Evidence
- HeyGen Business6 sources
- Synthesia Starter8 sources
- HeyGen Business
- PricingPricing page, retrieved 18 Oct 2026
- SecurityTrust Center, retrieved 18 Oct 2026
- Privacy Policy (as of 2026-10-15)Privacy notice, retrieved 18 Oct 2026
- Terms of Service (as of 2026-10-15)Terms and conditions, retrieved 18 Oct 2026
- Data Processing AddendumDPA, retrieved 14 Oct 2026
- HeyGen Trust Center (Drata)Trust Center, retrieved 18 Oct 2026
Synthesia Starter- Pricing (rendered in browser, monthly/annual; EUR when retrieved from Germany, USD in the server-side version)Pricing page, retrieved 18 Oct 2026
- Security Practices (as of 2026-02-03)Trust Center, retrieved 18 Oct 2026
- Data Processing Addendum (PDF as of 2026-07-22, incorporated via Customer Terms)DPA, retrieved 18 Oct 2026
- Subprocessors (as of 2026-10-08)Sub-processor list, retrieved 18 Oct 2026
- Privacy Policy (effective 2026-10-01)Privacy notice, retrieved 14 Oct 2026
- Customer Terms of Service (effective 2026-07-20)Terms and conditions, retrieved 18 Oct 2026
- AI Governance Practices (published September 2024)AI governance, retrieved 14 Oct 2026
- Synthesia Trust Center (Vanta; ISO certificates viewable, SOC 2 and TIA via Request access)Trust Center, retrieved 18 Oct 2026
| Feature | HeyGen | Synthesia |
|---|---|---|
| yesall 4 plans | yesall 4 plans | |
| Details: DPA available |
|
|
| differs by tool |
| noall 4 plans |
| Details: Training on inputs |
|
|
| differs by tool | US onlyall 4 plans | mixedall 4 plans |
| Details: Data residency |
|
|
| list availableall 4 plans | list availableall 4 plans | |
| Details: List published |
|
|
| differs by tool |
| Security Practices: deletion of customer…all 4 plans |
| Details: Data retention |
|
|
| differs by tool |
|
|
| Details: Price |
|
|
| yesall 4 plans | yesall 4 plans | |
| Details: AI features included |
|
|
| 6 sources | 8 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- HeyGenyesall 4 plans
- Synthesiayesall 4 plans
- HeyGen
- Free
yes (Data Processing Addendum; according to the Terms, applies when a business accepts the Terms; version 'Effective as of October 2024')
Provider’s DPA - Creator / Pro
yes (Data Processing Addendum; according to the Terms, applies when a business accepts the Terms; version 'Effective as of October 2024')
Provider’s DPA - Business
yes (Data Processing Addendum; according to the Terms, applies when a business accepts the Terms; version 'Effective as of October 2024')
Provider’s DPA - Enterprise
yes (Data Processing Addendum, part of the Order Form or Enterprise SaaS Agreement)
Provider’s DPA
Synthesia- Basic (free of charge)
yes (Customer Terms: Data Processing Addendum 'hereby incorporated by reference'; additionally a pre-signed PDF version as of 2026-07-22 for countersignature by email to dpasubmission@synthesia.io; no differentiation by plan)
Provider’s DPA - Starter
yes (Customer Terms: Data Processing Addendum 'hereby incorporated by reference'; additionally a pre-signed PDF version as of 2026-07-22 for countersignature by email to dpasubmission@synthesia.io; no differentiation by plan)
Provider’s DPA - Pro
yes (Customer Terms: Data Processing Addendum 'hereby incorporated by reference'; additionally a pre-signed PDF version as of 2026-07-22 for countersignature by email to dpasubmission@synthesia.io; no differentiation by plan)
Provider’s DPA - Enterprise
yes (Customer Terms: Data Processing Addendum 'hereby incorporated by reference'; additionally a pre-signed PDF version as of 2026-07-22 for countersignature by email to dpasubmission@synthesia.io; no differentiation by plan)
Provider’s DPA
- Free
Training
- differs by tool
- HeyGen
- opt-out availableFree, Creator / Pro, Business
- noEnterprise
- Synthesianoall 4 plans
- HeyGen
- Free
Security page: 'Non-enterprise customers may opt out at any time by contacting' the privacy contact; contracts with all AI sub-processors prohibit training on customer data. Privacy policy (as of 2026-10-15): submitted texts, voices, scripts, images and videos may be used for training on the basis of legitimate interest, opt-out by email to the privacy address. Terms (as of 2026-10-15): Section 4 (Free Plan) contains no separate training licence; Section 1 permits processing for 'research and development of its AI models' for all users. Trust Center FAQ: data of non-enterprise customers 'may be used to train and enhance the models that power our Services'; according to the FAQ, opt-out via the privacy policy (request by email).
- Creator / Pro
Security page: 'Non-enterprise customers may opt out at any time by contacting' the privacy contact; contracts with all AI sub-processors prohibit training on customer data. Privacy policy (as of 2026-10-15): submitted texts, voices, scripts, images and videos may be used for training on the basis of legitimate interest, opt-out by email to the privacy address. Terms (as of 2026-10-15, Section 3 for Creator/Pro/Business): licence to 'Your Content' also 'to train or otherwise improve or modify our artificial intelligence and machine learning models'. For avatars, face/body parts are processed; biometric verification on the basis of explicit consent. Trust Center FAQ: data of non-enterprise customers 'may be used to train and enhance the models that power our Services'; according to the FAQ, opt-out via the privacy policy (request by email).
- Business
Security page: 'Non-enterprise customers may opt out at any time by contacting' the privacy contact; contracts with all AI sub-processors prohibit training on customer data. Privacy policy (as of 2026-10-15): submitted texts, voices, scripts, images and videos may be used for training on the basis of legitimate interest, opt-out by email to the privacy address. Terms (as of 2026-10-15, Section 3 for Creator/Pro/Business): licence to 'Your Content' also 'to train or otherwise improve or modify our artificial intelligence and machine learning models'. For avatars, face/body parts are processed; biometric verification on the basis of explicit consent. Trust Center FAQ: data of non-enterprise customers 'may be used to train and enhance the models that power our Services'; according to the FAQ, opt-out via the privacy policy (request by email).
- Enterprise
Security page: 'Enterprise customers' data is excluded from AI model training by default.' Trust Center FAQ: 'We ensure that our enterprise customers' data is not used to train our AI systems'. Contracts with AI sub-processors prohibit training on customer data.
Synthesia- Basic (free of charge)
AI Governance Practices: Synthesia does not use customer data (inputs and outputs) for pre-training its AI components; fine-tuning with customer data only on the customer's written instruction. Privacy Policy (effective 2026-10-01): usage information and feedback are processed to improve the platform and models; for avatar creation, facial/voice data (biometric data) are processed with consent, among other things to create the avatar and to fine-tune the model. DPA clause 2.2: no processing 'for any purpose other than providing the Services to Customer'; under clause 3.1, sub-processors must agree equivalent restrictions on use. Explicit exclusion of training in the sub-processor list only in the OpenAI entry. Documentation does not differentiate by plan.
- Starter
AI Governance Practices: Synthesia does not use customer data (inputs and outputs) for pre-training its AI components; fine-tuning with customer data only on the customer's written instruction. Privacy Policy (effective 2026-10-01): usage information and feedback are processed to improve the platform and models; for avatar creation, facial/voice data (biometric data) are processed with consent, among other things to create the avatar and to fine-tune the model. DPA clause 2.2: no processing 'for any purpose other than providing the Services to Customer'; under clause 3.1, sub-processors must agree equivalent restrictions on use. Explicit exclusion of training in the sub-processor list only in the OpenAI entry. Documentation does not differentiate by plan.
- Pro
AI Governance Practices: Synthesia does not use customer data (inputs and outputs) for pre-training its AI components; fine-tuning with customer data only on the customer's written instruction. Privacy Policy (effective 2026-10-01): usage information and feedback are processed to improve the platform and models; for avatar creation, facial/voice data (biometric data) are processed with consent, among other things to create the avatar and to fine-tune the model. DPA clause 2.2: no processing 'for any purpose other than providing the Services to Customer'; under clause 3.1, sub-processors must agree equivalent restrictions on use. Explicit exclusion of training in the sub-processor list only in the OpenAI entry. Documentation does not differentiate by plan.
- Enterprise
AI Governance Practices: Synthesia does not use customer data (inputs and outputs) for pre-training its AI components; fine-tuning with customer data only on the customer's written instruction. Privacy Policy (effective 2026-10-01): usage information and feedback are processed to improve the platform and models; for avatar creation, facial/voice data (biometric data) are processed with consent, among other things to create the avatar and to fine-tune the model. DPA clause 2.2: no processing 'for any purpose other than providing the Services to Customer'; under clause 3.1, sub-processors must agree equivalent restrictions on use. Explicit exclusion of training in the sub-processor list only in the OpenAI entry. Documentation does not differentiate by plan.
- Free
Hosting
- differs by tool
- HeyGenUS onlyall 4 plans
- Synthesiamixedall 4 plans
- HeyGen
- Free
Security page: 'All HeyGen customer data is stored in the United States on AWS infrastructure.' Sub-processor list in the Trust Center: all service providers with data location USA except BytePlus (Singapore, video generation for Video Agent). For EU customers, HeyGen refers to its certification under the EU-US Data Privacy Framework.
- Creator / Pro
Security page: 'All HeyGen customer data is stored in the United States on AWS infrastructure.' Sub-processor list in the Trust Center: all service providers with data location USA except BytePlus (Singapore, video generation for Video Agent). For EU customers, HeyGen refers to its certification under the EU-US Data Privacy Framework.
- Business
Security page: 'All HeyGen customer data is stored in the United States on AWS infrastructure.' Sub-processor list in the Trust Center: all service providers with data location USA except BytePlus (Singapore, video generation for Video Agent). For EU customers, HeyGen refers to its certification under the EU-US Data Privacy Framework.
- Enterprise
as self-service: the security page states storage in the USA on AWS; according to the Trust Center, sub-processors in the USA and Singapore (BytePlus); no EU storage location documented.
Synthesia- Basic (free of charge)
Security Practices: customer data is currently stored in the EU in AWS data centres in Ireland; operational backups in Ireland, secondary backups in the AWS Frankfurt region. EU-US transfer within AWS based on the SCCs of the AWS DPA; transfer impact assessment at security.synthesia.io/documents. The sub-processor list additionally names providers in the USA, Japan and Singapore. Documentation does not differentiate by plan.
- Starter
Security Practices: customer data is currently stored in the EU in AWS data centres in Ireland; operational backups in Ireland, secondary backups in the AWS Frankfurt region. EU-US transfer within AWS based on the SCCs of the AWS DPA; transfer impact assessment at security.synthesia.io/documents. The sub-processor list additionally names providers in the USA, Japan and Singapore. Documentation does not differentiate by plan.
- Pro
Security Practices: customer data is currently stored in the EU in AWS data centres in Ireland; operational backups in Ireland, secondary backups in the AWS Frankfurt region. EU-US transfer within AWS based on the SCCs of the AWS DPA; transfer impact assessment at security.synthesia.io/documents. The sub-processor list additionally names providers in the USA, Japan and Singapore. Documentation does not differentiate by plan.
- Enterprise
Security Practices: customer data is currently stored in the EU in AWS data centres in Ireland; operational backups in Ireland, secondary backups in the AWS Frankfurt region. EU-US transfer within AWS based on the SCCs of the AWS DPA; transfer impact assessment at security.synthesia.io/documents. The sub-processor list additionally names providers in the USA, Japan and Singapore. Documentation does not differentiate by plan.
- Free
Sub-processors
- HeyGenlist availableall 4 plans
- Synthesialist availableall 4 plans
- HeyGen
- Free
- Amazon Web Services (web hosting, data storage, image moderation, video processing): USA
- AI: Anthropic (LLM), OpenAI and Google (script generation, video translation, text-to-speech, content moderation), xAI (LLM, TTS, voice clone), Microsoft Azure and Elevenlabs (text-to-speech), Cartesia (TTS, voice clone), Gladia (speech recognition), fal (image generation): each USA
- BytePlus (video generation for Video Agent): Singapore
- Datadog (monitoring, log storage), Posthog (data analytics), Hex and Snowflake (data processing and querying), Retool (internal tooling), LiveKit (no purpose stated), Cloudflare (DNS): each USA
- Customer.io (email communication), Intercom (customer support and help centre): USA
- Creator / Pro
- Amazon Web Services (web hosting, data storage, image moderation, video processing): USA
- AI: Anthropic (LLM), OpenAI and Google (script generation, video translation, text-to-speech, content moderation), xAI (LLM, TTS, voice clone), Microsoft Azure and Elevenlabs (text-to-speech), Cartesia (TTS, voice clone), Gladia (speech recognition), fal (image generation): each USA
- BytePlus (video generation for Video Agent): Singapore
- Datadog (monitoring, log storage), Posthog (data analytics), Hex and Snowflake (data processing and querying), Retool (internal tooling), LiveKit (no purpose stated), Cloudflare (DNS): each USA
- Customer.io (email communication), Intercom (customer support and help centre): USA
- Business
- Amazon Web Services (web hosting, data storage, image moderation, video processing): USA
- AI: Anthropic (LLM), OpenAI and Google (script generation, video translation, text-to-speech, content moderation), xAI (LLM, TTS, voice clone), Microsoft Azure and Elevenlabs (text-to-speech), Cartesia (TTS, voice clone), Gladia (speech recognition), fal (image generation): each USA
- BytePlus (video generation for Video Agent): Singapore
- Datadog (monitoring, log storage), Posthog (data analytics), Hex and Snowflake (data processing and querying), Retool (internal tooling), LiveKit (no purpose stated), Cloudflare (DNS): each USA
- Customer.io (email communication), Intercom (customer support and help centre): USA
- Enterprise
- as self-service
Synthesia- Basic (free of charge)
- Amazon Web Services EMEA SARL (Luxembourg): hosting, storage, computing power, hosted AI models
- MongoDB Limited (Ireland): production data
- Mux Inc. (USA): video delivery
- StackOne Technologies Ltd (UK): third-party integrations
- Modal Labs, Inc. (USA): computing power for video processing
- ClickHouse, Inc. (USA): analytics for sessions
- Script processing: Google Cloud EMEA (Ireland), IBM United Kingdom, CoeFont (Japan), WellSaid Labs (USA), Microsoft Ireland, Eleven Labs Inc. (USA), DeepL SE (Germany), OpenAI OpCo (USA), Cinder Technologies (USA), Anthropic PBC (USA), Cartesia AI (USA), Exa Labs (USA; web search)
- Asset processing: UAB ConvertAPI (Lithuania), Canva Austria GmbH (Austria; pre-processing for Custom Avatars), Runway AI (USA), Features & Labels (USA), AssemblyAI (USA), LiveKit (USA), ai-coustics GmbH (Germany), BFL GmbH (Germany), BytePlus Pte. Ltd. (Singapore; hosted AI models)
- Other: Intercom R&D Unlimited Company (Ireland), Datadog, Inc. (USA)
- Group companies: Synthesia Inc. (USA), Synthesia B.V. (Netherlands), Synthesia GmbH (Germany), Synthesia ApS (Denmark)
- Starter
- Amazon Web Services EMEA SARL (Luxembourg): hosting, storage, computing power, hosted AI models
- MongoDB Limited (Ireland): production data
- Mux Inc. (USA): video delivery
- StackOne Technologies Ltd (UK): third-party integrations
- Modal Labs, Inc. (USA): computing power for video processing
- ClickHouse, Inc. (USA): analytics for sessions
- Script processing: Google Cloud EMEA (Ireland), IBM United Kingdom, CoeFont (Japan), WellSaid Labs (USA), Microsoft Ireland, Eleven Labs Inc. (USA), DeepL SE (Germany), OpenAI OpCo (USA), Cinder Technologies (USA), Anthropic PBC (USA), Cartesia AI (USA), Exa Labs (USA; web search)
- Asset processing: UAB ConvertAPI (Lithuania), Canva Austria GmbH (Austria; pre-processing for Custom Avatars), Runway AI (USA), Features & Labels (USA), AssemblyAI (USA), LiveKit (USA), ai-coustics GmbH (Germany), BFL GmbH (Germany), BytePlus Pte. Ltd. (Singapore; hosted AI models)
- Other: Intercom R&D Unlimited Company (Ireland), Datadog, Inc. (USA)
- Group companies: Synthesia Inc. (USA), Synthesia B.V. (Netherlands), Synthesia GmbH (Germany), Synthesia ApS (Denmark)
- Pro
- Amazon Web Services EMEA SARL (Luxembourg): hosting, storage, computing power, hosted AI models
- MongoDB Limited (Ireland): production data
- Mux Inc. (USA): video delivery
- StackOne Technologies Ltd (UK): third-party integrations
- Modal Labs, Inc. (USA): computing power for video processing
- ClickHouse, Inc. (USA): analytics for sessions
- Script processing: Google Cloud EMEA (Ireland), IBM United Kingdom, CoeFont (Japan), WellSaid Labs (USA), Microsoft Ireland, Eleven Labs Inc. (USA), DeepL SE (Germany), OpenAI OpCo (USA), Cinder Technologies (USA), Anthropic PBC (USA), Cartesia AI (USA), Exa Labs (USA; web search)
- Asset processing: UAB ConvertAPI (Lithuania), Canva Austria GmbH (Austria; pre-processing for Custom Avatars), Runway AI (USA), Features & Labels (USA), AssemblyAI (USA), LiveKit (USA), ai-coustics GmbH (Germany), BFL GmbH (Germany), BytePlus Pte. Ltd. (Singapore; hosted AI models)
- Other: Intercom R&D Unlimited Company (Ireland), Datadog, Inc. (USA)
- Group companies: Synthesia Inc. (USA), Synthesia B.V. (Netherlands), Synthesia GmbH (Germany), Synthesia ApS (Denmark)
- Enterprise
- Amazon Web Services EMEA SARL (Luxembourg): hosting, storage, computing power, hosted AI models
- MongoDB Limited (Ireland): production data
- Mux Inc. (USA): video delivery
- StackOne Technologies Ltd (UK): third-party integrations
- Modal Labs, Inc. (USA): computing power for video processing
- ClickHouse, Inc. (USA): analytics for sessions
- Script processing: Google Cloud EMEA (Ireland), IBM United Kingdom, CoeFont (Japan), WellSaid Labs (USA), Microsoft Ireland, Eleven Labs Inc. (USA), DeepL SE (Germany), OpenAI OpCo (USA), Cinder Technologies (USA), Anthropic PBC (USA), Cartesia AI (USA), Exa Labs (USA; web search)
- Asset processing: UAB ConvertAPI (Lithuania), Canva Austria GmbH (Austria; pre-processing for Custom Avatars), Runway AI (USA), Features & Labels (USA), AssemblyAI (USA), LiveKit (USA), ai-coustics GmbH (Germany), BFL GmbH (Germany), BytePlus Pte. Ltd. (Singapore; hosted AI models)
- Other: Intercom R&D Unlimited Company (Ireland), Datadog, Inc. (USA)
- Group companies: Synthesia Inc. (USA), Synthesia B.V. (Netherlands), Synthesia GmbH (Germany), Synthesia ApS (Denmark)
- Free
Retention
- differs by tool
- HeyGen
- Privacy policyFree, Creator / Pro, Business
- as self-serviceEnterprise
- SynthesiaSecurity Practices: deletion of customer…all 4 plans
- HeyGen
- FreePrivacy policy (as of 2026-10-15): according to the text, deletion requests are processed within 72 hours; backups/disaster recovery are retained for 60 days and then permanently deleted. Terms Section 23: Free accounts may be deleted after six months of inactivity following reasonable notice. In general (section 8): retention for as long as necessary to provide the services or with permission, based on criteria such as account administration, maintaining generated content, dispute resolution; no fixed periods stated for videos and avatars.
- Creator / ProPrivacy policy (as of 2026-10-15): according to the text, deletion requests are processed within 72 hours; backups/disaster recovery are retained for 60 days and then permanently deleted. In general (section 8): retention for as long as necessary to provide the services or with permission, based on criteria such as account administration, maintaining generated content, dispute resolution; no fixed periods stated for videos and avatars.
- BusinessPrivacy policy (as of 2026-10-15): according to the text, deletion requests are processed within 72 hours; backups/disaster recovery are retained for 60 days and then permanently deleted. In general (section 8): retention for as long as necessary to provide the services or with permission, based on criteria such as account administration, maintaining generated content, dispute resolution; no fixed periods stated for videos and avatars.
- Enterpriseas self-service (privacy policy). DPA Section 9(b): erasure 'within a reasonable amount of time' after the end of the contract or earlier on request; return of a copy and confirmation of deletion each within 30 days on request.
Synthesia- Basic (free of charge)Security Practices: deletion of customer data on request within up to 90 days; without a request, automatic deletion within 90 days after account termination; export of videos up to 90 days after the end of the contract; residual copies may remain in backups for a limited period. Daily database backups for at least three months. Security-relevant logs up to 4 years. DPA clause 7.2: after termination of the Services, destruction of all personal data after 90 days unless the customer has requested their return beforehand. Customer Terms: export may be limited by the plan and by the retention settings enabled by the customer.
- StarterSecurity Practices: deletion of customer data on request within up to 90 days; without a request, automatic deletion within 90 days after account termination; export of videos up to 90 days after the end of the contract; residual copies may remain in backups for a limited period. Daily database backups for at least three months. Security-relevant logs up to 4 years. DPA clause 7.2: after termination of the Services, destruction of all personal data after 90 days unless the customer has requested their return beforehand. Customer Terms: export may be limited by the plan and by the retention settings enabled by the customer.
- ProSecurity Practices: deletion of customer data on request within up to 90 days; without a request, automatic deletion within 90 days after account termination; export of videos up to 90 days after the end of the contract; residual copies may remain in backups for a limited period. Daily database backups for at least three months. Security-relevant logs up to 4 years. DPA clause 7.2: after termination of the Services, destruction of all personal data after 90 days unless the customer has requested their return beforehand. Customer Terms: export may be limited by the plan and by the retention settings enabled by the customer.
- EnterpriseSecurity Practices: deletion of customer data on request within up to 90 days; without a request, automatic deletion within 90 days after account termination; export of videos up to 90 days after the end of the contract; residual copies may remain in backups for a limited period. Daily database backups for at least three months. Security-relevant logs up to 4 years. DPA clause 7.2: after termination of the Services, destruction of all personal data after 90 days unless the customer has requested their return beforehand. Customer Terms: export may be limited by the plan and by the retention settings enabled by the customer.
Price
- differs by tool
- HeyGen
- 0 USDFree
- 29 USD/mo… (further prices in the details)Creator / Pro
- 149 USD/mo… (further prices in the details)Business
- customEnterprise
- Synthesia
- 0 EUR/moBasic (free of charge)
- several tiersStarter
- 79 EUR/mo… (further prices in the details)Pro
- customEnterprise
- HeyGen
- Free
0 USD (pricing page)
- Creator / Pro
Creator USD 29/month or USD 24/month with annual payment (USD 288 per year); Pro from USD 49/month or USD 41/month with annual payment (USD 488 per year) with 1,000 credits; further Pro tiers up to 100,000 credits for USD 4,300/month (pricing page). Not stated whether VAT is included; according to the Terms, the customer bears applicable taxes ('including all taxes').
- Business
USD 149/month or USD 119/month with annual payment (USD 1,428 per year) with 1,500 credits; additional seats USD 20 per seat per month; credit packs and auto-reload available, prices for these not stated (pricing page). Not stated whether VAT is included; according to the Terms, the customer bears applicable taxes ('including all taxes').
- Enterprise
Custom (contact sales)
Synthesia- Basic (free of charge)
EUR 0 or USD 0 per month (pricing page; no indication whether VAT is included)
- Starter
Pricing page in browser (retrieved from Germany, EUR): EUR 19 per month with monthly billing (1,250 credits/month); EUR 12 per month with annual billing (15,000 credits/year); learner seat EUR 29 monthly or EUR 25 with annual billing. Server-side version in USD: USD 29 or USD 18 per month, learner seat USD 29 or USD 25. No indication whether VAT is included.
- Pro
Pricing page in browser (retrieved from Germany, EUR): EUR 79 per month with monthly billing (6,000 credits/month); EUR 49 per month with annual billing (72,000 credits/year); higher credit tiers up to EUR 600/month (monthly) or EUR 372/month (annual). Server-side version in USD: USD 89 or USD 64 per month, tiers up to USD 676/month. No indication whether VAT is included.
- Enterprise
Custom (pricing page: 'Custom', 'tailored pricing'; FAQ: 'Enterprise pricing is custom')
- Free
- HeyGenyesall 4 plans
- Synthesiayesall 4 plans
- HeyGen
- Free
yes (3 videos/month up to 1 min, export up to 1080p, 1 custom avatar according to the pricing page; Terms Section 4: output licensed only to a limited extent, no commercial exploitation)
- Creator / Pro
yes (Creator 600 credits/month, Pro 1,000 credits/month; videos up to 30 min; Pro with 4K export; Avatar IV, voice cloning according to the pricing page; 1 seat each)
- Business
yes (1,500 credits/month, videos up to 60 min, 4K, 5 custom avatars; SAML/SSO, central billing, workspace collaboration and team management according to the pricing page)
- Enterprise
yes (according to the pricing page, custom sales; scope not itemised)
Synthesia- Basic (free of charge)
yes (500 credits/month, videos with watermark according to the pricing page)
- Starter
yes (1,250 credits/month according to the pricing page)
- Pro
yes (6,000 credits/month according to the pricing page)
- Enterprise
yes
- Free
Evidence
- HeyGen6 sources
- Synthesia8 sources
- HeyGen
- PricingPricing page, retrieved 18 Oct 2026
- SecurityTrust Center, retrieved 18 Oct 2026
- Privacy Policy (as of 2026-10-15)Privacy notice, retrieved 18 Oct 2026
- Terms of Service (as of 2026-10-15)Terms and conditions, retrieved 18 Oct 2026
- Data Processing AddendumDPA, retrieved 14 Oct 2026
- HeyGen Trust Center (Drata)Trust Center, retrieved 18 Oct 2026
Synthesia- Pricing (rendered in browser, monthly/annual; EUR when retrieved from Germany, USD in the server-side version)Pricing page, retrieved 18 Oct 2026
- Security Practices (as of 2026-02-03)Trust Center, retrieved 18 Oct 2026
- Data Processing Addendum (PDF as of 2026-07-22, incorporated via Customer Terms)DPA, retrieved 18 Oct 2026
- Subprocessors (as of 2026-10-08)Sub-processor list, retrieved 18 Oct 2026
- Privacy Policy (effective 2026-10-01)Privacy notice, retrieved 14 Oct 2026
- Customer Terms of Service (effective 2026-07-20)Terms and conditions, retrieved 18 Oct 2026
- AI Governance Practices (published September 2024)AI governance, retrieved 14 Oct 2026
- Synthesia Trust Center (Vanta; ISO certificates viewable, SOC 2 and TIA via Request access)Trust Center, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
No guarantee of accuracy, not legal advice. Each entry is valid as of the date shown. Open points are listed on the detail pages.
More comparisons
HeyGen compared with
Synthesia compared with
Individual pages: HeyGen, Synthesia. All tools in the category: Image & design.