Synthesia
Synthesia (Basic / Starter / Pro / Enterprise)
Provider: Synthesia Limited · Based in: Synthesia Ltd, 20 Triton Street, Regent's Place, 3rd Floor, London NW1 3BF, Uni… · Provider website
- Plans
- 4
- Sources
- 9
- As of
- 18 Oct
As of 18 Oct 2026. Based on our research on this date and the process described in the methodology. No guarantee of accuracy, not legal advice. The provider’s current documents take precedence. Found an error? Report a correction.
Incomplete. 6 points could not be verified in any provider source (see open points). This does not mean the matter is unproblematic; it means we have not checked it.
At a glance
- Hosting
- mixed: all 4 plans
- Training on inputs
- no: all 4 plans
- DPA
- yes: all 4 plans
- Provider
- Synthesia Limited
- Based in
- Synthesia Ltd, 20 Triton Street, Regent's Place, 3rd Floor, London NW1 3BF, United Kingdom (q5); group companies in, among others, Germany, the Netherlands, Denmark, USA (q4)
Values from 4 plans, each listed with the plans it applies to. Details and evidence are in the plan table.
Compare Synthesia
Compare with another toolCompared plan by plan with other tools in the category Image & design:
Details per plan
Short values per plan. Click a feature to open the evidence and notes for all plans; sources with retrieval dates are under “Evidence”.
| Feature | Basic (free of charge)Compare Synthesia Basic (free of charge) with another tool | StarterCompare Synthesia Starter with another tool | ProCompare Synthesia Pro with another tool | EnterpriseCompare Synthesia Enterprise with another tool |
|---|---|---|---|---|
| differs by plan | 0 EUR/mo | several tiers | 79 EUR/mo… (further prices in the details) | custom |
| Details: Price | EUR 0 or USD 0 per month (pricing page; no indication whether VAT is included) | Pricing page in browser (retrieved from Germany, EUR): EUR 19 per month with monthly billing (1,250 credits/month); EUR 12 per month with annual billing (15,000 credits/year); learner seat EUR 29 monthly or EUR 25 with annual billing. Server-side version in USD: USD 29 or USD 18 per month, learner seat USD 29 or USD 25. No indication whether VAT is included. | Pricing page in browser (retrieved from Germany, EUR): EUR 79 per month with monthly billing (6,000 credits/month); EUR 49 per month with annual billing (72,000 credits/year); higher credit tiers up to EUR 600/month (monthly) or EUR 372/month (annual). Server-side version in USD: USD 89 or USD 64 per month, tiers up to USD 676/month. No indication whether VAT is included. | Custom (pricing page: 'Custom', 'tailored pricing'; FAQ: 'Enterprise pricing is custom') |
| yes | yes | yes | yes | |
| Details: AI features included | yes (500 credits/month, videos with watermark according to the pricing page) | yes (1,250 credits/month according to the pricing page) | yes (6,000 credits/month according to the pricing page) | yes |
| yes | yes | yes | yes | |
| Details: DPA | yes (Customer Terms: Data Processing Addendum 'hereby incorporated by reference'; additionally a pre-signed PDF version as of 2026-07-22 for countersignature by email to dpasubmission@synthesia.io; no differentiation by plan) Provider’s DPA | yes (Customer Terms: Data Processing Addendum 'hereby incorporated by reference'; additionally a pre-signed PDF version as of 2026-07-22 for countersignature by email to dpasubmission@synthesia.io; no differentiation by plan) Provider’s DPA | yes (Customer Terms: Data Processing Addendum 'hereby incorporated by reference'; additionally a pre-signed PDF version as of 2026-07-22 for countersignature by email to dpasubmission@synthesia.io; no differentiation by plan) Provider’s DPA | yes (Customer Terms: Data Processing Addendum 'hereby incorporated by reference'; additionally a pre-signed PDF version as of 2026-07-22 for countersignature by email to dpasubmission@synthesia.io; no differentiation by plan) Provider’s DPA |
| no | no | no | no | |
| Details: Training on inputs | AI Governance Practices: Synthesia does not use customer data (inputs and outputs) for pre-training its AI components; fine-tuning with customer data only on the customer's written instruction. Privacy Policy (effective 2026-10-01): usage information and feedback are processed to improve the platform and models; for avatar creation, facial/voice data (biometric data) are processed with consent, among other things to create the avatar and to fine-tune the model. DPA clause 2.2: no processing 'for any purpose other than providing the Services to Customer'; under clause 3.1, sub-processors must agree equivalent restrictions on use. Explicit exclusion of training in the sub-processor list only in the OpenAI entry. Documentation does not differentiate by plan. | AI Governance Practices: Synthesia does not use customer data (inputs and outputs) for pre-training its AI components; fine-tuning with customer data only on the customer's written instruction. Privacy Policy (effective 2026-10-01): usage information and feedback are processed to improve the platform and models; for avatar creation, facial/voice data (biometric data) are processed with consent, among other things to create the avatar and to fine-tune the model. DPA clause 2.2: no processing 'for any purpose other than providing the Services to Customer'; under clause 3.1, sub-processors must agree equivalent restrictions on use. Explicit exclusion of training in the sub-processor list only in the OpenAI entry. Documentation does not differentiate by plan. | AI Governance Practices: Synthesia does not use customer data (inputs and outputs) for pre-training its AI components; fine-tuning with customer data only on the customer's written instruction. Privacy Policy (effective 2026-10-01): usage information and feedback are processed to improve the platform and models; for avatar creation, facial/voice data (biometric data) are processed with consent, among other things to create the avatar and to fine-tune the model. DPA clause 2.2: no processing 'for any purpose other than providing the Services to Customer'; under clause 3.1, sub-processors must agree equivalent restrictions on use. Explicit exclusion of training in the sub-processor list only in the OpenAI entry. Documentation does not differentiate by plan. | AI Governance Practices: Synthesia does not use customer data (inputs and outputs) for pre-training its AI components; fine-tuning with customer data only on the customer's written instruction. Privacy Policy (effective 2026-10-01): usage information and feedback are processed to improve the platform and models; for avatar creation, facial/voice data (biometric data) are processed with consent, among other things to create the avatar and to fine-tune the model. DPA clause 2.2: no processing 'for any purpose other than providing the Services to Customer'; under clause 3.1, sub-processors must agree equivalent restrictions on use. Explicit exclusion of training in the sub-processor list only in the OpenAI entry. Documentation does not differentiate by plan. |
| Security Practices: deletion of customer… | Security Practices: deletion of customer… | Security Practices: deletion of customer… | Security Practices: deletion of customer… | |
| Details: Data retention | Security Practices: deletion of customer data on request within up to 90 days; without a request, automatic deletion within 90 days after account termination; export of videos up to 90 days after the end of the contract; residual copies may remain in backups for a limited period. Daily database backups for at least three months. Security-relevant logs up to 4 years. DPA clause 7.2: after termination of the Services, destruction of all personal data after 90 days unless the customer has requested their return beforehand. Customer Terms: export may be limited by the plan and by the retention settings enabled by the customer. | Security Practices: deletion of customer data on request within up to 90 days; without a request, automatic deletion within 90 days after account termination; export of videos up to 90 days after the end of the contract; residual copies may remain in backups for a limited period. Daily database backups for at least three months. Security-relevant logs up to 4 years. DPA clause 7.2: after termination of the Services, destruction of all personal data after 90 days unless the customer has requested their return beforehand. Customer Terms: export may be limited by the plan and by the retention settings enabled by the customer. | Security Practices: deletion of customer data on request within up to 90 days; without a request, automatic deletion within 90 days after account termination; export of videos up to 90 days after the end of the contract; residual copies may remain in backups for a limited period. Daily database backups for at least three months. Security-relevant logs up to 4 years. DPA clause 7.2: after termination of the Services, destruction of all personal data after 90 days unless the customer has requested their return beforehand. Customer Terms: export may be limited by the plan and by the retention settings enabled by the customer. | Security Practices: deletion of customer data on request within up to 90 days; without a request, automatic deletion within 90 days after account termination; export of videos up to 90 days after the end of the contract; residual copies may remain in backups for a limited period. Daily database backups for at least three months. Security-relevant logs up to 4 years. DPA clause 7.2: after termination of the Services, destruction of all personal data after 90 days unless the customer has requested their return beforehand. Customer Terms: export may be limited by the plan and by the retention settings enabled by the customer. |
| mixed | mixed | mixed | mixed | |
| Details: Hosting | Security Practices: customer data is currently stored in the EU in AWS data centres in Ireland; operational backups in Ireland, secondary backups in the AWS Frankfurt region. EU-US transfer within AWS based on the SCCs of the AWS DPA; transfer impact assessment at security.synthesia.io/documents. The sub-processor list additionally names providers in the USA, Japan and Singapore. Documentation does not differentiate by plan. | Security Practices: customer data is currently stored in the EU in AWS data centres in Ireland; operational backups in Ireland, secondary backups in the AWS Frankfurt region. EU-US transfer within AWS based on the SCCs of the AWS DPA; transfer impact assessment at security.synthesia.io/documents. The sub-processor list additionally names providers in the USA, Japan and Singapore. Documentation does not differentiate by plan. | Security Practices: customer data is currently stored in the EU in AWS data centres in Ireland; operational backups in Ireland, secondary backups in the AWS Frankfurt region. EU-US transfer within AWS based on the SCCs of the AWS DPA; transfer impact assessment at security.synthesia.io/documents. The sub-processor list additionally names providers in the USA, Japan and Singapore. Documentation does not differentiate by plan. | Security Practices: customer data is currently stored in the EU in AWS data centres in Ireland; operational backups in Ireland, secondary backups in the AWS Frankfurt region. EU-US transfer within AWS based on the SCCs of the AWS DPA; transfer impact assessment at security.synthesia.io/documents. The sub-processor list additionally names providers in the USA, Japan and Singapore. Documentation does not differentiate by plan. |
| list available | list available | list available | list available | |
| Details: Sub-processors |
|
|
|
|
| 8 sources | 8 sources | 8 sources | 8 sources | |
| Details: Sources with retrieval date |
|
|
|
|
Compare Synthesia Basic (free of charge) with another tool
Price and scope
- differs by plan
- 0 EUR/mo
EUR 0 or USD 0 per month (pricing page; no indication whether VAT is included)
- yes
yes (500 credits/month, videos with watermark according to the pricing page)
Contract and data use
- yes
yes (Customer Terms: Data Processing Addendum 'hereby incorporated by reference'; additionally a pre-signed PDF version as of 2026-07-22 for countersignature by email to dpasubmission@synthesia.io; no differentiation by plan)
Provider’s DPA- no
AI Governance Practices: Synthesia does not use customer data (inputs and outputs) for pre-training its AI components; fine-tuning with customer data only on the customer's written instruction. Privacy Policy (effective 2026-10-01): usage information and feedback are processed to improve the platform and models; for avatar creation, facial/voice data (biometric data) are processed with consent, among other things to create the avatar and to fine-tune the model. DPA clause 2.2: no processing 'for any purpose other than providing the Services to Customer'; under clause 3.1, sub-processors must agree equivalent restrictions on use. Explicit exclusion of training in the sub-processor list only in the OpenAI entry. Documentation does not differentiate by plan.
- Security Practices: deletion of customer…
- Security Practices: deletion of customer data on request within up to 90 days; without a request, automatic deletion within 90 days after account termination; export of videos up to 90 days after the end of the contract; residual copies may remain in backups for a limited period. Daily database backups for at least three months. Security-relevant logs up to 4 years. DPA clause 7.2: after termination of the Services, destruction of all personal data after 90 days unless the customer has requested their return beforehand. Customer Terms: export may be limited by the plan and by the retention settings enabled by the customer.
Hosting and sharing
- mixed
Security Practices: customer data is currently stored in the EU in AWS data centres in Ireland; operational backups in Ireland, secondary backups in the AWS Frankfurt region. EU-US transfer within AWS based on the SCCs of the AWS DPA; transfer impact assessment at security.synthesia.io/documents. The sub-processor list additionally names providers in the USA, Japan and Singapore. Documentation does not differentiate by plan.
- list available
- Amazon Web Services EMEA SARL (Luxembourg): hosting, storage, computing power, hosted AI models
- MongoDB Limited (Ireland): production data
- Mux Inc. (USA): video delivery
- StackOne Technologies Ltd (UK): third-party integrations
- Modal Labs, Inc. (USA): computing power for video processing
- ClickHouse, Inc. (USA): analytics for sessions
- Script processing: Google Cloud EMEA (Ireland), IBM United Kingdom, CoeFont (Japan), WellSaid Labs (USA), Microsoft Ireland, Eleven Labs Inc. (USA), DeepL SE (Germany), OpenAI OpCo (USA), Cinder Technologies (USA), Anthropic PBC (USA), Cartesia AI (USA), Exa Labs (USA; web search)
- Asset processing: UAB ConvertAPI (Lithuania), Canva Austria GmbH (Austria; pre-processing for Custom Avatars), Runway AI (USA), Features & Labels (USA), AssemblyAI (USA), LiveKit (USA), ai-coustics GmbH (Germany), BFL GmbH (Germany), BytePlus Pte. Ltd. (Singapore; hosted AI models)
- Other: Intercom R&D Unlimited Company (Ireland), Datadog, Inc. (USA)
- Group companies: Synthesia Inc. (USA), Synthesia B.V. (Netherlands), Synthesia GmbH (Germany), Synthesia ApS (Denmark)
Evidence
- 8 sources
- Pricing (rendered in browser, monthly/annual; EUR when retrieved from Germany, USD in the server-side version)Pricing page, retrieved 18 Oct 2026
- Security Practices (as of 2026-02-03)Trust Center, retrieved 18 Oct 2026
- Data Processing Addendum (PDF as of 2026-07-22, incorporated via Customer Terms)DPA, retrieved 18 Oct 2026
- Subprocessors (as of 2026-10-08)Sub-processor list, retrieved 18 Oct 2026
- Privacy Policy (effective 2026-10-01)Privacy notice, retrieved 14 Oct 2026
- Customer Terms of Service (effective 2026-07-20)Terms and conditions, retrieved 18 Oct 2026
- AI Governance Practices (published September 2024)AI governance, retrieved 14 Oct 2026
- Synthesia Trust Center (Vanta; ISO certificates viewable, SOC 2 and TIA via Request access)Trust Center, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
Third-country transfers
Security Practices: EU–USA transfers within AWS are based on SCCs (AWS DPA). DPA clause 3.1: transfers to sub-processors in countries without an equivalent level of protection only with appropriate safeguards ('such as those pursuant to Articles 46 or 47 UK GDPR'); the DPA itself does not contain standard contractual clauses and names no modules. Privacy Policy (Synthesia Limited, UK; effective 2026-10-01): transfers outside the UK/EEA on the basis of adequacy decisions or standard contractual clauses. The sub-processor list does not state the transfer basis per provider; a 'Transfer Impact Assessment (TIA) - US Processors' is available in the Trust Center only via Request access. The Data Privacy Framework List contains no entry for 'Synthesia' (retrieved 2026-10-18); the EU-US Data Privacy Framework is not mentioned in the Privacy Policy.
- Security Practices (as of 2026-02-03) (Trust Center), retrieved 18 Oct 2026
- Data Processing Addendum (PDF as of 2026-07-22, incorporated via Customer Terms) (DPA), retrieved 18 Oct 2026
- Subprocessors (as of 2026-10-08) (Sub-processor list), retrieved 18 Oct 2026
- Privacy Policy (effective 2026-10-01) (Privacy notice), retrieved 14 Oct 2026
- Synthesia Trust Center (Vanta; ISO certificates viewable, SOC 2 and TIA via Request access) (Trust Center), retrieved 18 Oct 2026
- Data Privacy Framework List (search 'Synthesia') (Register), retrieved 18 Oct 2026
Certifications (as stated by the provider)
Trust Center (certificates publicly viewable): ISO/IEC 27001:2022 (certificate ISMS-SY-081825, A-LIGN, initial certification 2025-08-18, valid until 2028-08-18; scope the entire AI video platform including avatar creation and voice cloning), ISO/IEC 27701:2019 (PIMS-SY-120925, A-LIGN, initial certification 2025-12-09, valid until 2028-08-18), ISO/IEC 42001:2023 (AIMS-SY-091224, A-LIGN, initial certification 2024-09-12, valid until 2027-09-12). SOC 2 Type II 2026: according to the Trust Center update of 2026-07-28, by A-LIGN for the period 2025-04-07 to 2026-06-01 (Security, Availability, Confidentiality, Privacy); report only via Request access. Also UK Cyber Essentials (certificate via Request access).
- Security Practices (as of 2026-02-03) (Trust Center), retrieved 18 Oct 2026
- Synthesia Trust Center (Vanta; ISO certificates viewable, SOC 2 and TIA via Request access) (Trust Center), retrieved 18 Oct 2026
AI Act
Functions: Video generation with AI avatars and synthetic voice, dubbing/translation, Custom Avatars (facial and voice data), interactive avatars, roleplay and survey sessions, API (pricing page, AI Governance Practices).
Provider’s statement: AI Governance Practices (published September 2024): Synthesia considers itself a 'provider' under the EU AI Act when making its AI components available; customers become a 'deployer' when using them. To Synthesia's knowledge, the AI components are not classified as high-risk AI systems when used as intended. Paying customers can embed audio or visual markers for transparency under the EU AI Act; content on the website is labelled as AI-generated 'in accordance with EU AI Act Article 50 requirements'. Customer Terms: the customer obtains all necessary consents, including for the creation of avatars.
Classification (for review, not legal advice): For review: customer typically deployer (Art. 3(4) AI Act). Synthetic videos, avatars and voices touch on labelling obligations under Art. 50; whether and how these apply depends on the use and must be reviewed. According to the Terms, consents for Custom Avatars are the customer's responsibility. Not legal advice.
- Customer Terms of Service (effective 2026-07-20) (Terms and conditions), retrieved 18 Oct 2026
- AI Governance Practices (published September 2024) (AI governance), retrieved 14 Oct 2026
Current notes 2026
DPA as of 2026-07-22, Privacy Policy effective 2026-10-01, sub-processor list 2026-10-08 (new additions include ClickHouse, Exa Labs, BytePlus/Singapore), Customer Terms effective 2026-07-20. The sub-processor list includes many AI and speech providers based in the USA, Japan and Singapore (including OpenAI, Anthropic, ElevenLabs, Cartesia, BytePlus).
Open points of the review
- Transfer basis per US sub-processor not stated in the list; the Transfer Impact Assessment for US processors is available in the Trust Center only via Request access.
- Enterprise price not public (pricing page: 'Custom', 'tailored pricing').
- Differences between plans regarding data protection/retention only hinted at (Customer Terms: export depends on the plan and on retention settings); specific differences not documented.
- SOC 2 report, penetration test, DPIA and product-specific privacy overviews (including Personal Avatars, Roleplay Sessions) only via Request access in the Trust Center.
- Explicit exclusion of training in the sub-processor list only in the OpenAI entry; for the other AI providers only the general purpose limitation in DPA clauses 2.2 and 3.1.
- DPA Schedule 1 excludes the processing of special categories of personal data, while the Privacy Policy mentions biometric data for avatar creation; the relationship is not explained.
Frequently asked questions
Where does Synthesia store data?
mixed (plans: Basic (free of charge), Starter, Pro, Enterprise). According to the provider, as of 18 Oct 2026.
Is there a DPA for Synthesia?
yes in: Basic (free of charge), Starter, Pro, Enterprise. According to the provider, as of 18 Oct 2026.
Does Synthesia use inputs for AI training?
no in: Basic (free of charge), Starter, Pro, Enterprise. According to the provider, as of 18 Oct 2026.
Where is the provider based?
Synthesia Ltd, 20 Triton Street, Regent's Place, 3rd Floor, London NW1 3BF, United Kingdom; group companies in, among others, Germany, the Netherlands, Denmark, USA. According to the provider, as of 18 Oct 2026.
All sources
- 01Pricing (rendered in browser, monthly/annual; EUR when retrieved from Germany, USD in the server-side version)Pricing page · retrieved 18 Oct 2026
- 02Security Practices (as of 2026-02-03)Trust Center · retrieved 18 Oct 2026
- 03Data Processing Addendum (PDF as of 2026-07-22, incorporated via Customer Terms)DPA · retrieved 18 Oct 2026
- 04Subprocessors (as of 2026-10-08)Sub-processor list · retrieved 18 Oct 2026
- 05Privacy Policy (effective 2026-10-01)Privacy notice · retrieved 14 Oct 2026
- 06Customer Terms of Service (effective 2026-07-20)Terms and conditions · retrieved 18 Oct 2026
- 07AI Governance Practices (published September 2024)AI governance · retrieved 14 Oct 2026
- 08Synthesia Trust Center (Vanta; ISO certificates viewable, SOC 2 and TIA via Request access)Trust Center · retrieved 18 Oct 2026
- 09Data Privacy Framework List (search 'Synthesia')Register · retrieved 18 Oct 2026
More tools in Image & design with an EU hosting option (in at least one plan)
- ElevenLabs · Based in: Eleven Labs Inc., 169 Madison Ave #2484, New York, NY 10016, USA
- Figma AI · Based in: Figma, Inc., 760 Market St, Floor 10, San Francisco, CA, USA
All tools in Image & design · Tools with an EU hosting option
Further reading
All tools in the category: Image & design. Figures across all tools: Data report.