Source: https://www.bithuman.ai/security

# Security and privacy, by architecture

Render the avatar on your own hardware and its audio and video stay there. This page lists what reaches bitHuman in each mode.

[Contact sales](https://www.bithuman.ai/enterprise?topic=security#contact) [Deployment options](https://www.bithuman.ai/deployment)

## What leaves your building

- ### bitHuman cloud
  **Portrait**
  Uploaded once to create the avatar (Reaches bitHuman)
  **Live audio**
  Reaches bitHuman, encrypted in transit (Reaches bitHuman)
  **Avatar video**
  Rendered by bitHuman, streamed to you (Reaches bitHuman)
  **Usage reports**
  Metered by bitHuman (Reaches bitHuman)
- ### Your servers
  **Portrait**
  Uploaded once to create the avatar (Reaches bitHuman)
  **Live audio**
  Goes where the conversation runs (Your services)
  **Avatar video**
  Stays on your machine (Stays on your hardware)
  **Usage reports**
  No audio, video or conversation text (Reaches bitHuman)
- ### On the device
  **Portrait**
  Uploaded once to create the avatar (Reaches bitHuman)
  **Live audio**
  Goes to your app's voice services (Your services)
  **Avatar video**
  Renders and stays on the device (Stays on your hardware)
  **Usage reports**
  Usage metering only (Reaches bitHuman)
- ### Fully offline
  **Portrait**
  Uploaded once to create the avatar (Reaches bitHuman)
  **Live audio**
  Stays on the machine (Stays on your hardware)
  **Avatar video**
  Stays on the machine (Stays on your hardware)
  **Usage reports**
  Metered on the machine (Stays on your hardware)

With the web embed, the conversation runs on bitHuman's servers, even when the avatar renders in the tab.

[Every data flow, in the docs](https://docs.bithuman.ai/deploy/privacy)

## Controls

- ### [Encrypted in transit](https://docs.bithuman.ai/deploy/privacy)
  Connections use HTTPS (TLS); WebRTC encrypts real-time audio and video in transit (DTLS-SRTP).
- ### [Roles and audit log](https://docs.bithuman.ai/api/organizations)
  Organization roles, an audit-log API, and secret rotation that revokes the old secret immediately.
- ### [Deletion](https://docs.bithuman.ai/api/agents)
  Deleting an agent deletes its records, including transcripts, and its model files.
- ### [No stored transcripts](https://docs.bithuman.ai/deploy/privacy)
  Sessions that render on your hardware store no transcript at bitHuman.
- ### [Created in the cloud](https://docs.bithuman.ai/deploy/privacy)
  Creating an avatar from a portrait happens in the bitHuman cloud, in every mode.

## Compliance starts with where the data goes

GDPR and CCPA obligations follow the data, so we start with architecture.

In on-device, self-hosted and offline deployments, customer conversations stay in systems you already govern, and your existing programs apply.

[Privacy policy](https://www.bithuman.ai/legal/privacy)

## Questions

**Does bitHuman train on our data?**

Your photo is used to build your own avatar. If you need a written answer about model training for your organization, contact us.

## Start a security review

[Contact sales](https://www.bithuman.ai/enterprise?topic=security#contact) [Build an app](https://www.bithuman.ai/developers)