Synthesia
synthesia.io
Automated, point-in-time. Not independently reviewed or approved by TRUSTYCYBER unless expressly stated.
- Vendor discloses an unfavourable answer: Will they train on your data?
- Data retention window not stated
See Before you sign, with what to ask for ↓
Scanned Oct 21, 2026 · Public evidence · Point-in-time
Higher scores indicate stronger, independently supported AI assurance, governance, AI systems, models, data, supply chain and third-party assurance evidence. The score and the decision are related but different: a well-scored vendor can still carry conditions.
Before you sign
Why it matters: Under legitimate interests, Synthesia processes usage information and 'other information you choose to provide' to improve the Platform and underlying technologies and for internal research, expressly to enhance its models' capabilities and safety. This is scoped to Other Information (of which Synthesia is controller), not Customer Data.
What to ask for: Resolve this directly with the vendor before proceeding — this is a confirmed disclosure, not a gap to fill in.
“Name: OpenAI OpCo, LLC Address: 3180 18th St., San Francisco, CA 94110, United States Contact person’s name, position and contact details: Jason Kwon, General Counsel, [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): generating outputs from the inputs provided within the product or within the video, content moderation, text-to-speech conversion. Sub-processor will not use the data for any internal purpose including training of the LLM models”
“To improve our Platform and underlying technologies and for our internal research, we: process the information relating to your use and interaction with the Services, and the performance and quality of the Services resulting from such use Usage information Other information you chose to provide It is in our interest to continuously improve our Platform for Users and enhance our models’ capabilities and safety.”
Why it matters: The public sources scanned do not give a retention period for customer data or prompts/outputs.
What to ask for: Get retention windows, in days, in writing.
“For the creation of an Avatar, Biometric Data is stored and used as long as the Avatar is available on the Platform or as otherwise instructed by our Customer. For authenticating the Avatar submission, Biometric Data is stored and used only until we confirm the results of the samples comparison which usually occurs within few minutes of the submission. After the relevant processing has been completed or where instructed by our Customer, we permanently destroy your Biometric Data, unless otherwise required by law or legal process to retain the data. We require our vendor(s) to similarly delete or destroy Biometric Data.”
“We will retain Customer Data in accordance with Customer’s instructions (including to perform any applicable terms in the Agreement and through Customer’s use of Platform functionality) and as required by applicable law.”
Buyer questionsanswered only from the public evidence scanned, click a row for the answer
✗Will they train on your data?Concern / gap
Under legitimate interests, Synthesia processes usage information and 'other information you choose to provide' to improve the Platform and underlying technologies and for internal research, expressly to enhance its models' capabilities and safety. This is scoped to Other Information (of which Synthesia is controller), not Customer Data.
Requires written confirmation, see Before you sign ↓
“Name: OpenAI OpCo, LLC Address: 3180 18th St., San Francisco, CA 94110, United States Contact person’s name, position and contact details: Jason Kwon, General Counsel, [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): generating outputs from the inputs provided within the product or within the video, content moderation, text-to-speech conversion. Sub-processor will not use the data for any internal purpose including training of the LLM models”
“To improve our Platform and underlying technologies and for our internal research, we: process the information relating to your use and interaction with the Services, and the performance and quality of the Services resulting from such use Usage information Other information you chose to provide It is in our interest to continuously improve our Platform for Users and enhance our models’ capabilities and safety.”
!How long do they keep your data?Ask the vendor
Biometric data for an avatar is kept as long as the avatar is available on the Platform or as the Customer instructs; verification biometrics are kept only until the comparison completes (usually minutes). Data is then permanently destroyed unless law requires retention, and vendors are required to do likewise.
Requires written confirmation, see Before you sign ↓
“For the creation of an Avatar, Biometric Data is stored and used as long as the Avatar is available on the Platform or as otherwise instructed by our Customer. For authenticating the Avatar submission, Biometric Data is stored and used only until we confirm the results of the samples comparison which usually occurs within few minutes of the submission. After the relevant processing has been completed or where instructed by our Customer, we permanently destroy your Biometric Data, unless otherwise required by law or legal process to retain the data. We require our vendor(s) to similarly delete or destroy Biometric Data.”
“We will retain Customer Data in accordance with Customer’s instructions (including to perform any applicable terms in the Agreement and through Customer’s use of Platform functionality) and as required by applicable law.”
!Who else can access your data?Ask the vendor
Anthropic PBC is a named subprocessor generating outputs, including visuals, from inputs provided within the product or video. Unlike the OpenAI entry, no statement is made about whether Anthropic may use the data for training.
Confirm in writing: Ask the vendor to state this in writing before signing.
“Name: Anthropic PBC Address: 548 Market St, PMB 90375, San Francisco, CA 94104 Contact person’s name, position and contact details: [email protected] . Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Generating outputs, including visuals, from the inputs provided within the product or within the video.”
“Name: BytePlus Pte. Ltd. Address: 1 Raffles Quay, #26-10, Singapore 048583 Contact person's name, position and contact details: [email protected] Description of processing: Processes text, audio, and video inputs via hosted generative AI models.”
“Name: Cartesia AI, inc. Address: 450 Alabama St, San Francisco, CA 94110 Contact person's name, position and contact details: Karan Hiremath, [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Text to speech generation and voice synthesis, processing customer script and voice data for creating voice clones and dubbing content.”
“Name: Amazon Web Services EMEA SARL Address: 38 Avenue John F. Kennedy, L-1855, Luxembourg Contact person’s name, position and contact details: Laura Wainwright, AWS account manager [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Web hosting, data storage and compute for video processing services. Scripts, audio, and video data is stored and transmitted for the purpose of video creation. Processes text, audio, and video inputs via hosted generative AI models.”
“Last updated October 8, 2026 Third Party Sub-processors Synthesia uses the third party entities below (each, a “sub-processor”) to process personal data on behalf of Synthesia Customers and in accordance with contract terms between Synthesia and the sub-processor. You can sign-up here to receive email notifications when we add new sub-processors.”
!Where is your data processed?Ask the vendor
Synthesia may transfer personal data outside the UK and EEA, relying on adequacy decisions and standard contractual clauses for countries without an adequacy decision. The subprocessor register places several processors in the US and Singapore.
Confirm in writing: Ask the vendor to state this in writing before signing.
“We rely on standard contractual clauses to transfer personal data as described in this Privacy Policy to countries without an adequacy decision.”
!What happens in a security incident?Ask the vendor
Synthesia says moderation is built in at the point of creation and that audits, incident readiness and continuous improvement sustain trust; the React pillar covers detection, response and correction. No breach-notification timeframe or incident process is published in these documents.
Confirm in writing: Ask the vendor to state this in writing before signing.
“From the beginning, we have built content moderation into the point of creation, not after distribution. When new risks arise, we act in our customers' best interests while taking into account societal risks. Audits, incident readiness, and continuous improvement are how we sustain trust through evidence, not just intent.”
Email to send the vendor11 items to confirm in writing
Hello Synthesia team, We are assessing Synthesia as part of our supplier review. Before we proceed, please confirm the following in writing: 1. Do you use our data (inputs, outputs or uploaded files) to train or improve your models? Please confirm in writing, including any opt-out and whether it applies to every plan. 2. How long do you retain our data, in days, for each type (inputs, outputs, logs and backups), and how is it deleted? 3. Please provide your current, dated subprocessor list and explain how you notify customers of changes. 4. In which countries and regions is our data processed and stored, and can processing be limited to a region we choose? 5. What is your commitment to notify customers of a security incident affecting our data, including the timeframe? 6. Please provide the ISO 42001, 27001 and 27701 certificates (issuer, certificate number, validity and scope statement) and the latest SOC 2 Type II report. 7. Stripe appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data. 8. Microsoft appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data. 9. Atlassian appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data. 10. Google appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data. 11. AWS appears to be involved as a platform provider: confirm whether this dependency exists, and whether it processes customer data. A written reply to each point, or a link to where it is documented, is enough. Where a point is covered by a certification or independent report, please include the certificate number or the report and its date. Thank you,
Key findingsclick a row for the evidence
✓Management-system certifications claimed across AI, security and privacyStrong
Synthesia claims ISO/IEC 42001 certification (stating it was the first generative AI company certified), ISO/IEC 27001:2022, ISO/IEC 27701 and SOC 2 Type II, and ties them to a published Review/Report/React governance framework with named internal ownership for AI security.
An AI management system certified to ISO 42001 alongside 27001/27701 is the strongest structural assurance signal a generative AI vendor can currently point to, and it indicates the vendor can produce audit artefacts on request.
Question for vendor: Please provide the ISO 42001, 27001 and 27701 certificates (issuer, certificate number, validity and scope statement) and the latest SOC 2 Type II report.
“ISO 42001, alongside ISO 27001 and ISO 27701, gave us a lifecycle structure for AI risk management, security, and privacy, treated as continuous processes rather than point-in-time commitments. The 3Rs are the public-facing expression of how that management system operates day to day. We were the first generative AI company certified to ISO 42001, and we intend to stay ahead of where the standards are heading.”
“That’s why I’m proud to announce that we’re now ISO/IEC 27001:2022 certified, the internationally recognized standard for information security management.”
“The platform is SOC 2 Type II certified, ISO 42001 compliant, and GDPR compliant, with Brand Kit for consistent branding, SSO and permission controls, and live collaboration for teams working at scale.”
“For us, governance begins before a product launches and continues through deployment. Every decision is documented, and our controls are updated as both threat models and the underlying technology evolves.”
“Accountability is shared and explicit. Synthesia remains accountable for enterprise outcomes on our platform; that does not get outsourced to vendors.”
✓Detailed, dated subprocessor register with per-provider processing descriptionsStrong
The subprocessor register (updated 8 October 2026) names every infrastructure, script-processing and asset-processing provider with address, contact and a description of what data it processes, and offers change notifications. The OpenAI entry explicitly states that data will not be used for internal purposes including LLM training.
Buyers can see exactly which AI providers sit in the request path for scripts, audio and video and can map their own data flows without asking the vendor.
“Last updated October 8, 2026 Third Party Sub-processors Synthesia uses the third party entities below (each, a “sub-processor”) to process personal data on behalf of Synthesia Customers and in accordance with contract terms between Synthesia and the sub-processor. You can sign-up here to receive email notifications when we add new sub-processors.”
“Name: OpenAI OpCo, LLC Address: 3180 18th St., San Francisco, CA 94110, United States Contact person’s name, position and contact details: Jason Kwon, General Counsel, [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): generating outputs from the inputs provided within the product or within the video, content moderation, text-to-speech conversion. Sub-processor will not use the data for any internal purpose including training of the LLM models”
“Name: Amazon Web Services EMEA SARL Address: 38 Avenue John F. Kennedy, L-1855, Luxembourg Contact person’s name, position and contact details: Laura Wainwright, AWS account manager [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Web hosting, data storage and compute for video processing services. Scripts, audio, and video data is stored and transmitted for the purpose of video creation. Processes text, audio, and video inputs via hosted generative AI models.”
“Name: Anthropic PBC Address: 548 Market St, PMB 90375, San Francisco, CA 94104 Contact person’s name, position and contact details: [email protected] . Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Generating outputs, including visuals, from the inputs provided within the product or within the video.”
!Broad generative AI supply chain with training-use stated for only one providerGap
Customer scripts, audio and video are processed by at least eleven generative AI providers (OpenAI, Anthropic, Google Cloud, Microsoft, Eleven Labs, Cartesia, Runway, fal, BFL, BytePlus, Exa, plus WellSaid, CoeFont and IBM for TTS). Only the OpenAI entry states that the provider will not train on the data. The Responsible AI page promises feature-level mapping of third-party services in the future tense; no such mapping appears in the collected documents.
Voice-cloning and video-generation providers receive biometric-adjacent material (voice and likeness). Without a training-use and retention commitment per provider, a buyer cannot confirm that its people's voices and faces stay out of third-party model improvement. Which features can be disabled to avoid particular providers (for example BytePlus) is also unstated.
Question for vendor: For each generative AI subprocessor, confirm in writing whether customer inputs may be used for model training or improvement, the retention period at the provider, and the processing region; and provide the feature-to-provider mapping referenced on the Responsible AI page.
“Name: BytePlus Pte. Ltd. Address: 1 Raffles Quay, #26-10, Singapore 048583 Contact person's name, position and contact details: [email protected] Description of processing: Processes text, audio, and video inputs via hosted generative AI models.”
“Name: Cartesia AI, inc. Address: 450 Alabama St, San Francisco, CA 94110 Contact person's name, position and contact details: Karan Hiremath, [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Text to speech generation and voice synthesis, processing customer script and voice data for creating voice clones and dubbing content.”
“Name: Anthropic PBC Address: 548 Market St, PMB 90375, San Francisco, CA 94104 Contact person’s name, position and contact details: [email protected] . Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Generating outputs, including visuals, from the inputs provided within the product or within the video.”
“At the same time, some safety properties originate upstream with model providers, and we work closely with them on safety signals, moderation boundaries, and abuse patterns. We will be transparent with customers about which third-party services power which features so they can make informed decisions.”
“Name: OpenAI OpCo, LLC Address: 3180 18th St., San Francisco, CA 94110, United States Contact person’s name, position and contact details: Jason Kwon, General Counsel, [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): generating outputs from the inputs provided within the product or within the video, content moderation, text-to-speech conversion. Sub-processor will not use the data for any internal purpose including training of the LLM models”
!No public commitment that Customer Data is excluded from model trainingGap
The Privacy Policy makes Synthesia a processor of Customer Data acting on instructions, which points to the DPA (not collected) for training terms. Separately, under legitimate interests it uses usage information and 'other information you choose to provide', a category that may include voice, video, image and text inputs to Synthesia's own AI-powered experiences, to improve the Platform and 'enhance our models' capabilities and safety'. Custom avatars involve fine-tuning the AI model on the submitter's biometric data, retained for the life of the avatar.
A buyer reading only the public documents cannot establish that scripts, uploads and avatar material are kept out of model improvement. The controller-side carve-out for AI-experience inputs is an explicit improvement use and its boundary with Customer Data is not drawn in the policy.
Question for vendor: Does the DPA or MSA state that Customer Data (scripts, uploads, Samples, generated videos) is not used to train or improve Synthesia's or any third party's models? Which product interactions fall under 'Synthesia's own AI powered experiences' and can they be disabled at the enterprise tier? Is per-avatar fine-tuning isolated to that customer's avatar?
“Customer Data will be processed by Synthesia in accordance with Customer's instructions, including any applicable terms in the Agreement, and as required by applicable law. As explained above, in general, Synthesia is a processor of Customer Data and the Customer is the controller.”
“To improve our Platform and underlying technologies and for our internal research, we: process the information relating to your use and interaction with the Services, and the performance and quality of the Services resulting from such use Usage information Other information you chose to provide It is in our interest to continuously improve our Platform for Users and enhance our models’ capabilities and safety.”
“This may also include voice, video , image and text inputs provided when interacting with Synthesia's own AI powered experiences.”
“Specifically, your Biometric Data is processed for: Generating your own Avatar; Fine-tuning the AI model to enable it to generate new videos with your Avatar based on the Sample performing a user-provided input; Verifying your identity by comparing Biometric Data extracted from the Sample, to Biometric Data extracted from the Verification Recording;”
“For the creation of an Avatar, Biometric Data is stored and used as long as the Avatar is available on the Platform or as otherwise instructed by our Customer. For authenticating the Avatar submission, Biometric Data is stored and used only until we confirm the results of the samples comparison which usually occurs within few minutes of the submission. After the relevant processing has been completed or where instructed by our Customer, we permanently destroy your Biometric Data, unless otherwise required by law or legal process to retain the data. We require our vendor(s) to similarly delete or destroy Biometric Data.”
“We will retain Customer Data in accordance with Customer’s instructions (including to perform any applicable terms in the Agreement and through Customer’s use of Platform functionality) and as required by applicable law.”
!Certifications, testing and incident handling disclosed at headline level onlyGap
No certificate numbers, issuers, validity dates or scope statements accompany the ISO or SOC 2 claims, and ISO 42001 is described as 'certified' on the Responsible AI page but 'compliant' on product pages. Testing and evaluation is described only as a pre-launch risk-tiered review, and incident handling only as 'incident readiness'; a Security Practices page is referenced but was not collected. All ten domains were assessed as at least partial and none as not_applicable, because Synthesia hosts the full processing chain.
Without scope statements a buyer cannot tell whether the certified management system covers the generative features and the third-party model chain, and the absence of evaluation evidence and a breach-notification commitment leaves two assurance questions open for the contract stage.
Question for vendor: Provide the ISO 42001 statement of applicability and scope, the SOC 2 Type II report, evidence of pre-release safety evaluation or red-teaming for generative features, and the contractual security-incident notification timeframe.
“ISO 42001, alongside ISO 27001 and ISO 27701, gave us a lifecycle structure for AI risk management, security, and privacy, treated as continuous processes rather than point-in-time commitments. The 3Rs are the public-facing expression of how that management system operates day to day. We were the first generative AI company certified to ISO 42001, and we intend to stay ahead of where the standards are heading.”
“The platform is SOC 2 Type II certified, ISO 42001 compliant, and GDPR compliant, with Brand Kit for consistent branding, SSO and permission controls, and live collaboration for teams working at scale.”
“Review is risk-tiered assessment of capabilities and use cases, applied before launch and revisited as threat models change.”
“From the beginning, we have built content moderation into the point of creation, not after distribution. When new risks arise, we act in our customers' best interests while taking into account societal risks. Audits, incident readiness, and continuous improvement are how we sustain trust through evidence, not just intent.”
“How Synthesia built an AI-powered vulnerability management program to scale InfoSec: automating triage, validation, and fixes across SAST and SCA to reduce backlog and ship faster.”
?Technical dependency observed: StripeObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Stripe as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Stripe appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“At the same time, some safety properties originate upstream with model providers, and we work closely with them on safety signals, moderation boundaries, and abuse patterns. We will be transparent with customers about which third-party services power which features so they can make informed decisions.”
“Name: OpenAI OpCo, LLC Address: 3180 18th St., San Francisco, CA 94110, United States Contact person’s name, position and contact details: Jason Kwon, General Counsel, [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): generating outputs from the inputs provided within the product or within the video, content moderation, text-to-speech conversion. Sub-processor will not use the data for any internal purpose including training of the LLM models”
“Name: Anthropic PBC Address: 548 Market St, PMB 90375, San Francisco, CA 94104 Contact person’s name, position and contact details: [email protected] . Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Generating outputs, including visuals, from the inputs provided within the product or within the video.”
“Name: BytePlus Pte. Ltd. Address: 1 Raffles Quay, #26-10, Singapore 048583 Contact person's name, position and contact details: [email protected] Description of processing: Processes text, audio, and video inputs via hosted generative AI models.”
“Name: Cartesia AI, inc. Address: 450 Alabama St, San Francisco, CA 94110 Contact person's name, position and contact details: Karan Hiremath, [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Text to speech generation and voice synthesis, processing customer script and voice data for creating voice clones and dubbing content.”
“Name: Amazon Web Services EMEA SARL Address: 38 Avenue John F. Kennedy, L-1855, Luxembourg Contact person’s name, position and contact details: Laura Wainwright, AWS account manager [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Web hosting, data storage and compute for video processing services. Scripts, audio, and video data is stored and transmitted for the purpose of video creation. Processes text, audio, and video inputs via hosted generative AI models.”
“Last updated October 8, 2026 Third Party Sub-processors Synthesia uses the third party entities below (each, a “sub-processor”) to process personal data on behalf of Synthesia Customers and in accordance with contract terms between Synthesia and the sub-processor. You can sign-up here to receive email notifications when we add new sub-processors.”
?Technical dependency observed: MicrosoftObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Microsoft as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Microsoft appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“At the same time, some safety properties originate upstream with model providers, and we work closely with them on safety signals, moderation boundaries, and abuse patterns. We will be transparent with customers about which third-party services power which features so they can make informed decisions.”
“Name: OpenAI OpCo, LLC Address: 3180 18th St., San Francisco, CA 94110, United States Contact person’s name, position and contact details: Jason Kwon, General Counsel, [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): generating outputs from the inputs provided within the product or within the video, content moderation, text-to-speech conversion. Sub-processor will not use the data for any internal purpose including training of the LLM models”
“Name: Anthropic PBC Address: 548 Market St, PMB 90375, San Francisco, CA 94104 Contact person’s name, position and contact details: [email protected] . Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Generating outputs, including visuals, from the inputs provided within the product or within the video.”
“Name: BytePlus Pte. Ltd. Address: 1 Raffles Quay, #26-10, Singapore 048583 Contact person's name, position and contact details: [email protected] Description of processing: Processes text, audio, and video inputs via hosted generative AI models.”
“Name: Cartesia AI, inc. Address: 450 Alabama St, San Francisco, CA 94110 Contact person's name, position and contact details: Karan Hiremath, [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Text to speech generation and voice synthesis, processing customer script and voice data for creating voice clones and dubbing content.”
“Name: Amazon Web Services EMEA SARL Address: 38 Avenue John F. Kennedy, L-1855, Luxembourg Contact person’s name, position and contact details: Laura Wainwright, AWS account manager [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Web hosting, data storage and compute for video processing services. Scripts, audio, and video data is stored and transmitted for the purpose of video creation. Processes text, audio, and video inputs via hosted generative AI models.”
“Last updated October 8, 2026 Third Party Sub-processors Synthesia uses the third party entities below (each, a “sub-processor”) to process personal data on behalf of Synthesia Customers and in accordance with contract terms between Synthesia and the sub-processor. You can sign-up here to receive email notifications when we add new sub-processors.”
?Technical dependency observed: AtlassianObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Atlassian as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Atlassian appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“At the same time, some safety properties originate upstream with model providers, and we work closely with them on safety signals, moderation boundaries, and abuse patterns. We will be transparent with customers about which third-party services power which features so they can make informed decisions.”
“Name: OpenAI OpCo, LLC Address: 3180 18th St., San Francisco, CA 94110, United States Contact person’s name, position and contact details: Jason Kwon, General Counsel, [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): generating outputs from the inputs provided within the product or within the video, content moderation, text-to-speech conversion. Sub-processor will not use the data for any internal purpose including training of the LLM models”
“Name: Anthropic PBC Address: 548 Market St, PMB 90375, San Francisco, CA 94104 Contact person’s name, position and contact details: [email protected] . Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Generating outputs, including visuals, from the inputs provided within the product or within the video.”
“Name: BytePlus Pte. Ltd. Address: 1 Raffles Quay, #26-10, Singapore 048583 Contact person's name, position and contact details: [email protected] Description of processing: Processes text, audio, and video inputs via hosted generative AI models.”
“Name: Cartesia AI, inc. Address: 450 Alabama St, San Francisco, CA 94110 Contact person's name, position and contact details: Karan Hiremath, [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Text to speech generation and voice synthesis, processing customer script and voice data for creating voice clones and dubbing content.”
“Name: Amazon Web Services EMEA SARL Address: 38 Avenue John F. Kennedy, L-1855, Luxembourg Contact person’s name, position and contact details: Laura Wainwright, AWS account manager [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Web hosting, data storage and compute for video processing services. Scripts, audio, and video data is stored and transmitted for the purpose of video creation. Processes text, audio, and video inputs via hosted generative AI models.”
“Last updated October 8, 2026 Third Party Sub-processors Synthesia uses the third party entities below (each, a “sub-processor”) to process personal data on behalf of Synthesia Customers and in accordance with contract terms between Synthesia and the sub-processor. You can sign-up here to receive email notifications when we add new sub-processors.”
?Technical dependency observed: GoogleObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Google as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Google appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“At the same time, some safety properties originate upstream with model providers, and we work closely with them on safety signals, moderation boundaries, and abuse patterns. We will be transparent with customers about which third-party services power which features so they can make informed decisions.”
“Name: OpenAI OpCo, LLC Address: 3180 18th St., San Francisco, CA 94110, United States Contact person’s name, position and contact details: Jason Kwon, General Counsel, [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): generating outputs from the inputs provided within the product or within the video, content moderation, text-to-speech conversion. Sub-processor will not use the data for any internal purpose including training of the LLM models”
“Name: Anthropic PBC Address: 548 Market St, PMB 90375, San Francisco, CA 94104 Contact person’s name, position and contact details: [email protected] . Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Generating outputs, including visuals, from the inputs provided within the product or within the video.”
“Name: BytePlus Pte. Ltd. Address: 1 Raffles Quay, #26-10, Singapore 048583 Contact person's name, position and contact details: [email protected] Description of processing: Processes text, audio, and video inputs via hosted generative AI models.”
“Name: Cartesia AI, inc. Address: 450 Alabama St, San Francisco, CA 94110 Contact person's name, position and contact details: Karan Hiremath, [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Text to speech generation and voice synthesis, processing customer script and voice data for creating voice clones and dubbing content.”
“Name: Amazon Web Services EMEA SARL Address: 38 Avenue John F. Kennedy, L-1855, Luxembourg Contact person’s name, position and contact details: Laura Wainwright, AWS account manager [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Web hosting, data storage and compute for video processing services. Scripts, audio, and video data is stored and transmitted for the purpose of video creation. Processes text, audio, and video inputs via hosted generative AI models.”
“Last updated October 8, 2026 Third Party Sub-processors Synthesia uses the third party entities below (each, a “sub-processor”) to process personal data on behalf of Synthesia Customers and in accordance with contract terms between Synthesia and the sub-processor. You can sign-up here to receive email notifications when we add new sub-processors.”
?Technical dependency observed: AWSObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on AWS as a platform provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — AWS appears to be involved as a platform provider: confirm whether this dependency exists, and whether it processes customer data.
“At the same time, some safety properties originate upstream with model providers, and we work closely with them on safety signals, moderation boundaries, and abuse patterns. We will be transparent with customers about which third-party services power which features so they can make informed decisions.”
“Name: OpenAI OpCo, LLC Address: 3180 18th St., San Francisco, CA 94110, United States Contact person’s name, position and contact details: Jason Kwon, General Counsel, [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): generating outputs from the inputs provided within the product or within the video, content moderation, text-to-speech conversion. Sub-processor will not use the data for any internal purpose including training of the LLM models”
“Name: Anthropic PBC Address: 548 Market St, PMB 90375, San Francisco, CA 94104 Contact person’s name, position and contact details: [email protected] . Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Generating outputs, including visuals, from the inputs provided within the product or within the video.”
“Name: BytePlus Pte. Ltd. Address: 1 Raffles Quay, #26-10, Singapore 048583 Contact person's name, position and contact details: [email protected] Description of processing: Processes text, audio, and video inputs via hosted generative AI models.”
“Name: Cartesia AI, inc. Address: 450 Alabama St, San Francisco, CA 94110 Contact person's name, position and contact details: Karan Hiremath, [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Text to speech generation and voice synthesis, processing customer script and voice data for creating voice clones and dubbing content.”
“Name: Amazon Web Services EMEA SARL Address: 38 Avenue John F. Kennedy, L-1855, Luxembourg Contact person’s name, position and contact details: Laura Wainwright, AWS account manager [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Web hosting, data storage and compute for video processing services. Scripts, audio, and video data is stored and transmitted for the purpose of video creation. Processes text, audio, and video inputs via hosted generative AI models.”
“Last updated October 8, 2026 Third Party Sub-processors Synthesia uses the third party entities below (each, a “sub-processor”) to process personal data on behalf of Synthesia Customers and in accordance with contract terms between Synthesia and the sub-processor. You can sign-up here to receive email notifications when we add new sub-processors.”
Assurance dimensionsweighted components of one score, not eight separate ratings
Organisation & AI governance15% of the score65
Who owns AI risk: policies, responsible-AI principles, human oversight and administrative controls.
Assessed against ISO 42001 · NIST AI RMF · AIUC-1
“For us, governance begins before a product launches and continues through deployment. Every decision is documented, and our controls are updated as both threat models and the underlying technology evolves.”
“Accountability is shared and explicit. Synthesia remains accountable for enterprise outcomes on our platform; that does not get outsourced to vendors.”
“Yes — all avatars are created with explicit human consent, and the platform applies strict content moderation and ethical guidelines.”
Governance & accountability: vendor-evidenced, not yet independently corroborated.
AI system15% of the score47
What AI the vendor actually runs and where it sits in the product, the map everything else is judged against.
Assessed against ISO 42001 · NIST AI RMF
“Synthesia's AI video generator combines two approaches: avatar-based video for professional presenter-led content, and generative AI video for cinematic clips using models like Veo 3 and Gemini Omni.”
“The free plan includes up to 10 minutes of video per month, access to AI avatars, voiceovers in 140+ languages, and AI asset generation in the AI Playground with models such as Veo 3 and FLUX 3 (as well as AI image generation models like FLUX.2 and Nano Banana Pro).”
“Specifically, your Biometric Data is processed for: Generating your own Avatar; Fine-tuning the AI model to enable it to generate new videos with your Avatar based on the Sample performing a user-provided input; Verifying your identity by comparing Biometric Data extracted from the Sample, to Biometric Data extracted from the Verification Recording;”
How AI features are evaluated before and after release, evals, red-teaming, monitoring.
Assessed against NIST GenAI · NIST AI RMF · ISO 42001
“Review is risk-tiered assessment of capabilities and use cases, applied before launch and revisited as threat models change.”
How changes to models and AI features are controlled and communicated: versioning, notice, rollback.
Assessed against ISO 27001 · ISO 42001
“Changelog Billing API about 1 month ago Interactive Avatar API about 1 month ago Added New Dubbing & Assets APIs 10 months ago”
“Building responsible AI doesn't stop at launch. React is how we maintain safety, respond to new risks, and keep governance current as the platform scales.”
AI system description: vendor-evidenced, not yet independently corroborated.
Model10% of the score40
Which model providers and versions process customer data, and how changes to them are disclosed.
Assessed against NIST GenAI · ISO 42001
“At the same time, some safety properties originate upstream with model providers, and we work closely with them on safety signals, moderation boundaries, and abuse patterns. We will be transparent with customers about which third-party services power which features so they can make informed decisions.”
“Name: OpenAI OpCo, LLC Address: 3180 18th St., San Francisco, CA 94110, United States Contact person’s name, position and contact details: Jason Kwon, General Counsel, [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): generating outputs from the inputs provided within the product or within the video, content moderation, text-to-speech conversion. Sub-processor will not use the data for any internal purpose including training of the LLM models”
“Name: Anthropic PBC Address: 548 Market St, PMB 90375, San Francisco, CA 94104 Contact person’s name, position and contact details: [email protected] . Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Generating outputs, including visuals, from the inputs provided within the product or within the video.”
“The free plan includes up to 10 minutes of video per month, access to AI avatars, voiceovers in 140+ languages, and AI asset generation in the AI Playground with models such as Veo 3 and FLUX 3 (as well as AI image generation models like FLUX.2 and Nano Banana Pro).”
Customer data15% of the score45
Whether customer data trains models, how long it is retained, where it is processed, and how it is protected.
Assessed against ISO 27018 · OAIC APPs · EU AI Act
“Customer Data will be processed by Synthesia in accordance with Customer's instructions, including any applicable terms in the Agreement, and as required by applicable law. As explained above, in general, Synthesia is a processor of Customer Data and the Customer is the controller.”
“To improve our Platform and underlying technologies and for our internal research, we: process the information relating to your use and interaction with the Services, and the performance and quality of the Services resulting from such use Usage information Other information you chose to provide It is in our interest to continuously improve our Platform for Users and enhance our models’ capabilities and safety.”
“This may also include voice, video , image and text inputs provided when interacting with Synthesia's own AI powered experiences.”
“For the creation of an Avatar, Biometric Data is stored and used as long as the Avatar is available on the Platform or as otherwise instructed by our Customer. For authenticating the Avatar submission, Biometric Data is stored and used only until we confirm the results of the samples comparison which usually occurs within few minutes of the submission. After the relevant processing has been completed or where instructed by our Customer, we permanently destroy your Biometric Data, unless otherwise required by law or legal process to retain the data. We require our vendor(s) to similarly delete or destroy Biometric Data.”
“We will retain Customer Data in accordance with Customer’s instructions (including to perform any applicable terms in the Agreement and through Customer’s use of Platform functionality) and as required by applicable law.”
“We rely on standard contractual clauses to transfer personal data as described in this Privacy Policy to countries without an adequacy decision.”
AI supply chain10% of the score60
The named chain of AI and infrastructure providers behind the product, and how it is disclosed.
Assessed against ISO 27001 · ISO 27017
“Last updated October 8, 2026 Third Party Sub-processors Synthesia uses the third party entities below (each, a “sub-processor”) to process personal data on behalf of Synthesia Customers and in accordance with contract terms between Synthesia and the sub-processor. You can sign-up here to receive email notifications when we add new sub-processors.”
“Name: Amazon Web Services EMEA SARL Address: 38 Avenue John F. Kennedy, L-1855, Luxembourg Contact person’s name, position and contact details: Laura Wainwright, AWS account manager [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Web hosting, data storage and compute for video processing services. Scripts, audio, and video data is stored and transmitted for the purpose of video creation. Processes text, audio, and video inputs via hosted generative AI models.”
“Name: BytePlus Pte. Ltd. Address: 1 Raffles Quay, #26-10, Singapore 048583 Contact person's name, position and contact details: [email protected] Description of processing: Processes text, audio, and video inputs via hosted generative AI models.”
“Name: Cartesia AI, inc. Address: 450 Alabama St, San Francisco, CA 94110 Contact person's name, position and contact details: Karan Hiremath, [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Text to speech generation and voice synthesis, processing customer script and voice data for creating voice clones and dubbing content.”
“Name: OpenAI OpCo, LLC Address: 3180 18th St., San Francisco, CA 94110, United States Contact person’s name, position and contact details: Jason Kwon, General Counsel, [email protected] Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): generating outputs from the inputs provided within the product or within the video, content moderation, text-to-speech conversion. Sub-processor will not use the data for any internal purpose including training of the LLM models”
“Name: Anthropic PBC Address: 548 Market St, PMB 90375, San Francisco, CA 94104 Contact person’s name, position and contact details: [email protected] . Description of processing (including a clear delimitation of responsibilities in case several sub-processors are authorised): Generating outputs, including visuals, from the inputs provided within the product or within the video.”
Subprocessors & supply chain: vendor-evidenced, not yet independently corroborated.
Security foundation15% of the score50
How security problems are found, reported and handled: disclosure channels, bug bounty, incident response.
Assessed against ISO 27001 · NIST AI RMF
“From the beginning, we have built content moderation into the point of creation, not after distribution. When new risks arise, we act in our customers' best interests while taking into account societal risks. Audits, incident readiness, and continuous improvement are how we sustain trust through evidence, not just intent.”
“How Synthesia built an AI-powered vulnerability management program to scale InfoSec: automating triage, validation, and fixes across SAST and SCA to reduce backlog and ship faster.”
Independent assurance evidence10% of the score44
Whether claimed certifications and attestations are independently corroborated, checked against official registries and issuing bodies. Which certifications, and what each one does and does not establish, is stated per certificate.
Assessed against ISO 17021-1 · ISO 42006 · ISO 27006-1 · ISO 27008
“ISO 42001, alongside ISO 27001 and ISO 27701, gave us a lifecycle structure for AI risk management, security, and privacy, treated as continuous processes rather than point-in-time commitments. The 3Rs are the public-facing expression of how that management system operates day to day. We were the first generative AI company certified to ISO 42001, and we intend to stay ahead of where the standards are heading.”
“That’s why I’m proud to announce that we’re now ISO/IEC 27001:2022 certified, the internationally recognized standard for information security management.”
“The platform is SOC 2 Type II certified, ISO 42001 compliant, and GDPR compliant, with Brand Kit for consistent branding, SSO and permission controls, and live collaboration for teams working at scale.”
Independent assurance: vendor-evidenced, not yet independently corroborated.
None of the corroborated certifications is AI-specific (ISO/IEC 42001 or AIUC-class) — this assurance is security and data-transfer attestation, not AI-management-system assurance.
Legal & contractual10% of the score60
The contractual backbone a buyer can rely on, terms, DPAs, privacy commitments and regulatory posture.
Assessed against EU AI Act · OAIC APPs
“Customer Terms of Service Agreement with a Customer that signs up to use Synthesia. Learn more Privacy Policy What information we collect at Synthesia, how it's used, and your options as a Customer. Learn more Security Practices We take security seriously at Synthesia in order to protect your organization and its data. Learn more Acceptable Use Policy List of acceptable and unacceptable conduct for your use of the Services and Avatars.”
“Synthesia may share and disclose Customer Data in accordance with a Customer's instructions, including any applicable terms in the Master Subscription Agreement and Data Processing Addendum.”
Legal & contractual transparency: vendor-evidenced, not yet independently corroborated.
Not graded: Agent, not applicable to this scan.
What would strengthen assuranceeach figure is from today's score, resolving one changes the others
Resolving an evidence gap strengthens the dimension it belongs to, and with it the score: 51 → up to 74 with every identified gap resolved.
AI supply chainclick a node to focus it · drag to pan · zoom with the controls
View as list
What you inheritTrustyCyber's AI Shared Responsibility Matrix v1.0
This scan names the vendor’s AI supply chain without assessing the responsibility split, that depends on how you consume the product. Under the common managed models, a deployer inherits 16 of the matrix’s 41 responsibilities from providers, each with named evidence owed.
Map your inherited responsibilitiesAssurance evidence: certifications 4, registry checks and verification ladders, click to view
Described as 'certified' on the Responsible AI page and 'compliant' on product pages; no issuer, certificate number or scope statement published.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Announced via blog (September 2025); no certificate details or scope published.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Named only in passing alongside ISO 42001 and 27001; no explicit certification statement, issuer or scope.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Stated on product pages; report, period and auditor not published.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Sources 12, click to view
Appendix: standards landscape 8, click to view
Where each standard behind this assessment stands today, from TrustyCyber’s continuously maintained standards radar.
Want to go further?
This scan assesses Synthesia at an organisational level. Assurance can vary significantly between products, models and agents, enter the product you’re evaluating to run a deeper AI System Assurance Scan.
Scan a specific product →This automated result is based on publicly available information at the time of scanning. It is not an audit, certification, legal opinion or assurance engagement. Publicly unavailable evidence may materially change the conclusion.
Monitor for changes
Get an email if its TRUSTYCYBER Score, grade or certifications change. One credit per refresh; reading the report always stays free.