HeyGen
HeyGen (AI avatar videos)
Provider: HeyGen Technology Inc. · Based in: HeyGen Technology Inc., 12130 Millennium Drive Suite 300, Los Angeles, CA 90094… · Provider website
- Plans
- 4
- Sources
- 7
- As of
- 18 Oct
As of 18 Oct 2026. Based on our research on this date and the process described in the methodology. No guarantee of accuracy, not legal advice. The provider’s current documents take precedence. Found an error? Report a correction.
Incomplete. 5 points could not be verified in any provider source (see open points). This does not mean the matter is unproblematic; it means we have not checked it.
At a glance
- Hosting
- US only: all 4 plans
- Training on inputs
- opt-out available: Free, Creator / Pro, Businessno: Enterprise
- DPA
- yes: all 4 plans
- Provider
- HeyGen Technology Inc.
- Based in
- HeyGen Technology Inc., 12130 Millennium Drive Suite 300, Los Angeles, CA 90094, USA (q3)
Values from 4 plans, each listed with the plans it applies to. Details and evidence are in the plan table.
Compare HeyGen
Compare with another toolCompared plan by plan with other tools in the category Image & design:
Details per plan
Short values per plan. Click a feature to open the evidence and notes for all plans; sources with retrieval dates are under “Evidence”.
| Feature | FreeCompare HeyGen Free with another tool | Creator / ProCompare HeyGen Creator / Pro with another tool | BusinessCompare HeyGen Business with another tool | EnterpriseCompare HeyGen Enterprise with another tool |
|---|---|---|---|---|
| differs by plan | 0 USD | 29 USD/mo… (further prices in the details) | 149 USD/mo… (further prices in the details) | custom |
| Details: Price | 0 USD (pricing page) | Creator USD 29/month or USD 24/month with annual payment (USD 288 per year); Pro from USD 49/month or USD 41/month with annual payment (USD 488 per year) with 1,000 credits; further Pro tiers up to 100,000 credits for USD 4,300/month (pricing page). Not stated whether VAT is included; according to the Terms, the customer bears applicable taxes ('including all taxes'). | USD 149/month or USD 119/month with annual payment (USD 1,428 per year) with 1,500 credits; additional seats USD 20 per seat per month; credit packs and auto-reload available, prices for these not stated (pricing page). Not stated whether VAT is included; according to the Terms, the customer bears applicable taxes ('including all taxes'). | Custom (contact sales) |
| yes | yes | yes | yes | |
| Details: AI features included | yes (3 videos/month up to 1 min, export up to 1080p, 1 custom avatar according to the pricing page; Terms Section 4: output licensed only to a limited extent, no commercial exploitation) | yes (Creator 600 credits/month, Pro 1,000 credits/month; videos up to 30 min; Pro with 4K export; Avatar IV, voice cloning according to the pricing page; 1 seat each) | yes (1,500 credits/month, videos up to 60 min, 4K, 5 custom avatars; SAML/SSO, central billing, workspace collaboration and team management according to the pricing page) | yes (according to the pricing page, custom sales; scope not itemised) |
| yes | yes | yes | yes | |
| Details: DPA | yes (Data Processing Addendum; according to the Terms, applies when a business accepts the Terms; version 'Effective as of October 2024') Provider’s DPA | yes (Data Processing Addendum; according to the Terms, applies when a business accepts the Terms; version 'Effective as of October 2024') Provider’s DPA | yes (Data Processing Addendum; according to the Terms, applies when a business accepts the Terms; version 'Effective as of October 2024') Provider’s DPA | yes (Data Processing Addendum, part of the Order Form or Enterprise SaaS Agreement) Provider’s DPA |
| differs by plan | opt-out available | opt-out available | opt-out available | no |
| Details: Training on inputs | Security page: 'Non-enterprise customers may opt out at any time by contacting' the privacy contact; contracts with all AI sub-processors prohibit training on customer data. Privacy policy (as of 2026-10-15): submitted texts, voices, scripts, images and videos may be used for training on the basis of legitimate interest, opt-out by email to the privacy address. Terms (as of 2026-10-15): Section 4 (Free Plan) contains no separate training licence; Section 1 permits processing for 'research and development of its AI models' for all users. Trust Center FAQ: data of non-enterprise customers 'may be used to train and enhance the models that power our Services'; according to the FAQ, opt-out via the privacy policy (request by email). | Security page: 'Non-enterprise customers may opt out at any time by contacting' the privacy contact; contracts with all AI sub-processors prohibit training on customer data. Privacy policy (as of 2026-10-15): submitted texts, voices, scripts, images and videos may be used for training on the basis of legitimate interest, opt-out by email to the privacy address. Terms (as of 2026-10-15, Section 3 for Creator/Pro/Business): licence to 'Your Content' also 'to train or otherwise improve or modify our artificial intelligence and machine learning models'. For avatars, face/body parts are processed; biometric verification on the basis of explicit consent. Trust Center FAQ: data of non-enterprise customers 'may be used to train and enhance the models that power our Services'; according to the FAQ, opt-out via the privacy policy (request by email). | Security page: 'Non-enterprise customers may opt out at any time by contacting' the privacy contact; contracts with all AI sub-processors prohibit training on customer data. Privacy policy (as of 2026-10-15): submitted texts, voices, scripts, images and videos may be used for training on the basis of legitimate interest, opt-out by email to the privacy address. Terms (as of 2026-10-15, Section 3 for Creator/Pro/Business): licence to 'Your Content' also 'to train or otherwise improve or modify our artificial intelligence and machine learning models'. For avatars, face/body parts are processed; biometric verification on the basis of explicit consent. Trust Center FAQ: data of non-enterprise customers 'may be used to train and enhance the models that power our Services'; according to the FAQ, opt-out via the privacy policy (request by email). | Security page: 'Enterprise customers' data is excluded from AI model training by default.' Trust Center FAQ: 'We ensure that our enterprise customers' data is not used to train our AI systems'. Contracts with AI sub-processors prohibit training on customer data. |
| differs by plan | Privacy policy | Privacy policy | Privacy policy | as self-service |
| Details: Data retention | Privacy policy (as of 2026-10-15): according to the text, deletion requests are processed within 72 hours; backups/disaster recovery are retained for 60 days and then permanently deleted. Terms Section 23: Free accounts may be deleted after six months of inactivity following reasonable notice. In general (section 8): retention for as long as necessary to provide the services or with permission, based on criteria such as account administration, maintaining generated content, dispute resolution; no fixed periods stated for videos and avatars. | Privacy policy (as of 2026-10-15): according to the text, deletion requests are processed within 72 hours; backups/disaster recovery are retained for 60 days and then permanently deleted. In general (section 8): retention for as long as necessary to provide the services or with permission, based on criteria such as account administration, maintaining generated content, dispute resolution; no fixed periods stated for videos and avatars. | Privacy policy (as of 2026-10-15): according to the text, deletion requests are processed within 72 hours; backups/disaster recovery are retained for 60 days and then permanently deleted. In general (section 8): retention for as long as necessary to provide the services or with permission, based on criteria such as account administration, maintaining generated content, dispute resolution; no fixed periods stated for videos and avatars. | as self-service (privacy policy). DPA Section 9(b): erasure 'within a reasonable amount of time' after the end of the contract or earlier on request; return of a copy and confirmation of deletion each within 30 days on request. |
| US only | US only | US only | US only | |
| Details: Hosting | Security page: 'All HeyGen customer data is stored in the United States on AWS infrastructure.' Sub-processor list in the Trust Center: all service providers with data location USA except BytePlus (Singapore, video generation for Video Agent). For EU customers, HeyGen refers to its certification under the EU-US Data Privacy Framework. | Security page: 'All HeyGen customer data is stored in the United States on AWS infrastructure.' Sub-processor list in the Trust Center: all service providers with data location USA except BytePlus (Singapore, video generation for Video Agent). For EU customers, HeyGen refers to its certification under the EU-US Data Privacy Framework. | Security page: 'All HeyGen customer data is stored in the United States on AWS infrastructure.' Sub-processor list in the Trust Center: all service providers with data location USA except BytePlus (Singapore, video generation for Video Agent). For EU customers, HeyGen refers to its certification under the EU-US Data Privacy Framework. | as self-service: the security page states storage in the USA on AWS; according to the Trust Center, sub-processors in the USA and Singapore (BytePlus); no EU storage location documented. |
| list available | list available | list available | list available | |
| Details: Sub-processors |
|
|
|
|
| differs by plan | 6 sources | 6 sources | 6 sources | 3 sources |
| Details: Sources with retrieval date |
|
|
|
|
Compare HeyGen Free with another tool
Price and scope
- differs by plan
- 0 USD
0 USD (pricing page)
- yes
yes (3 videos/month up to 1 min, export up to 1080p, 1 custom avatar according to the pricing page; Terms Section 4: output licensed only to a limited extent, no commercial exploitation)
Contract and data use
- yes
yes (Data Processing Addendum; according to the Terms, applies when a business accepts the Terms; version 'Effective as of October 2024')
Provider’s DPA- differs by plan
- opt-out available
Security page: 'Non-enterprise customers may opt out at any time by contacting' the privacy contact; contracts with all AI sub-processors prohibit training on customer data. Privacy policy (as of 2026-10-15): submitted texts, voices, scripts, images and videos may be used for training on the basis of legitimate interest, opt-out by email to the privacy address. Terms (as of 2026-10-15): Section 4 (Free Plan) contains no separate training licence; Section 1 permits processing for 'research and development of its AI models' for all users. Trust Center FAQ: data of non-enterprise customers 'may be used to train and enhance the models that power our Services'; according to the FAQ, opt-out via the privacy policy (request by email).
- differs by plan
- Privacy policy
- Privacy policy (as of 2026-10-15): according to the text, deletion requests are processed within 72 hours; backups/disaster recovery are retained for 60 days and then permanently deleted. Terms Section 23: Free accounts may be deleted after six months of inactivity following reasonable notice. In general (section 8): retention for as long as necessary to provide the services or with permission, based on criteria such as account administration, maintaining generated content, dispute resolution; no fixed periods stated for videos and avatars.
Hosting and sharing
- US only
Security page: 'All HeyGen customer data is stored in the United States on AWS infrastructure.' Sub-processor list in the Trust Center: all service providers with data location USA except BytePlus (Singapore, video generation for Video Agent). For EU customers, HeyGen refers to its certification under the EU-US Data Privacy Framework.
- list available
- Amazon Web Services (web hosting, data storage, image moderation, video processing): USA
- AI: Anthropic (LLM), OpenAI and Google (script generation, video translation, text-to-speech, content moderation), xAI (LLM, TTS, voice clone), Microsoft Azure and Elevenlabs (text-to-speech), Cartesia (TTS, voice clone), Gladia (speech recognition), fal (image generation): each USA
- BytePlus (video generation for Video Agent): Singapore
- Datadog (monitoring, log storage), Posthog (data analytics), Hex and Snowflake (data processing and querying), Retool (internal tooling), LiveKit (no purpose stated), Cloudflare (DNS): each USA
- Customer.io (email communication), Intercom (customer support and help centre): USA
Evidence
- differs by plan
- 6 sources
- PricingPricing page, retrieved 18 Oct 2026
- SecurityTrust Center, retrieved 18 Oct 2026
- Privacy Policy (as of 2026-10-15)Privacy notice, retrieved 18 Oct 2026
- Terms of Service (as of 2026-10-15)Terms and conditions, retrieved 18 Oct 2026
- Data Processing AddendumDPA, retrieved 14 Oct 2026
- HeyGen Trust Center (Drata)Trust Center, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
Third-country transfers
Privacy policy (as of 2026-10-15): HeyGen is certified under the EU-US Data Privacy Framework, the UK Extension and the Swiss-US DPF. DPF list (retrieved 2026-10-18): HeyGen Technology Inc. with EU-U.S. DPF, Swiss-U.S. DPF and UK Extension each 'Active' (HR and non-HR data). The DPA contains standard contractual clauses (listed there ahead of the DPA in the order of precedence). According to the security page, all customer data is located in the USA; according to the Trust Center, one AI sub-processor (BytePlus) is based in Singapore.
- Security (Trust Center), retrieved 18 Oct 2026
- Privacy Policy (as of 2026-10-15) (Privacy notice), retrieved 18 Oct 2026
- Data Processing Addendum (DPA), retrieved 14 Oct 2026
- HeyGen Trust Center (Drata) (Trust Center), retrieved 18 Oct 2026
- Data Privacy Framework List: HeyGen Technology Inc. (Documentation), retrieved 18 Oct 2026
Certifications (as stated by the provider)
Trust Center (security.heygen.com, Drata): compliance tiles SOC 3 Report, SOC 2 Type 2, GDPR, CCPA, Data Privacy Framework and AI Act; documents including SOC 2 Type 2 Report, penetration test report, 'HeyGen SOC 2 Type 2 Confirmation Letter 2026' and 'HeyGen SOC 2 Bridge Letter 2026'. Neither the Trust Center nor the security page lists an ISO 27001 certification. Security page: SOC 2 Type II (annual third-party audit), annual third-party penetration test. A data protection officer based in Europe has been appointed. Reports not reviewed.
- Security (Trust Center), retrieved 18 Oct 2026
- HeyGen Trust Center (Drata) (Trust Center), retrieved 18 Oct 2026
AI Act
Functions: Text-to-video with AI avatars (Avatar IV), Custom and Photo Avatars, voice cloning, video translation, API, team workspace (pricing page, privacy policy).
Provider’s statement: Security page and Trust Center: HeyGen 'meets rigorous compliance requirements for global standards, including SOC 2 Type II, GDPR, CCPA, the EU-US Data Privacy Framework (DPF), and the EU AI Act' (self-declaration, without evidence). The Trust Center tile 'AI Act' only links to an external summary of the Act; no role as provider or deployer is stated.
Classification (for review, not legal advice): For review: customer typically deployer (Art. 3(4) AI Act). Synthetic videos, avatars and voices touch on labelling obligations under Art. 50; whether and how they apply depends on the use and must be reviewed. Facial/voice data is biometric; clarify consents for avatars. Not legal advice.
- Security (Trust Center), retrieved 18 Oct 2026
- Privacy Policy (as of 2026-10-15) (Privacy notice), retrieved 18 Oct 2026
- HeyGen Trust Center (Drata) (Trust Center), retrieved 18 Oct 2026
Current notes 2026
Privacy Policy and Terms last updated 2026-10-15. Non-enterprise customers can object to training, Enterprise is excluded by default; at the same time, the Terms grant HeyGen a licence for training. According to the provider, all customer data is located in the USA; the Trust Center lists around 20 sub-processors, including several AI model providers.
Open points of the review
- Training opt-out for non-enterprise customers only described as a request by email (privacy policy, Trust Center FAQ); whether it also restricts the training licence in the Terms (section 3) is not stated.
- Prices for credit packs (Business) not stated; Enterprise prices custom.
- Retention during ongoing operation only governed by criteria (privacy policy section 8); no specific periods for videos and avatars.
- SOC 2 report, bridge letter, SOC 3 report and Data Retention Policy in the Trust Center not reviewed.
- Role as AI provider/deployer under the AI Act not stated; only a self-declaration of compliance.
Frequently asked questions
Where does HeyGen store data?
US only (plans: Free, Creator / Pro, Business, Enterprise). According to the provider, as of 18 Oct 2026.
Is there a DPA for HeyGen?
yes in: Free, Creator / Pro, Business, Enterprise. According to the provider, as of 18 Oct 2026.
Does HeyGen use inputs for AI training?
opt-out available in: Free, Creator / Pro, Business; no in: Enterprise. According to the provider, as of 18 Oct 2026.
Where is the provider based?
HeyGen Technology Inc., 12130 Millennium Drive Suite 300, Los Angeles, CA 90094, USA. According to the provider, as of 18 Oct 2026.
All sources
- 01PricingPricing page · retrieved 18 Oct 2026
- 02SecurityTrust Center · retrieved 18 Oct 2026
- 03Privacy Policy (as of 2026-10-15)Privacy notice · retrieved 18 Oct 2026
- 04Terms of Service (as of 2026-10-15)Terms and conditions · retrieved 18 Oct 2026
- 05Data Processing AddendumDPA · retrieved 14 Oct 2026
- 06HeyGen Trust Center (Drata)Trust Center · retrieved 18 Oct 2026
- 07Data Privacy Framework List: HeyGen Technology Inc.Documentation · retrieved 18 Oct 2026
More tools in Image & design with an EU hosting option (in at least one plan)
- ElevenLabs · Based in: Eleven Labs Inc., 169 Madison Ave #2484, New York, NY 10016, USA
- Figma AI · Based in: Figma, Inc., 760 Market St, Floor 10, San Francisco, CA, USA
All tools in Image & design · Tools with an EU hosting option
Further reading
All tools in the category: Image & design. Figures across all tools: Data report.