“EU data residency” is not a complete security review. Synthesia’s Security Practices document, last updated February 3, 2026, describes a multi-tenant software-as-a-service system and states that customer data is stored in Ireland, with operational backups there and secondary backups in Frankfurt. It also discusses transfer protection relating to the United States. This is a vendor declaration about a dated service configuration, not an external audit of every data movement.
What the documentation actually establishes
A procurement team must distinguish where customer data is stored from where a service subprocesses it, where support agents may access it, what happens during retention and how backups are deleted. Synthesia points customers toward a separate security portal for documents such as its SOC 2 report. A public policy statement does not provide the full report or authorize us to claim a particular current attestation scope, penetration-test outcome or per-customer data processing arrangement.
How a producer would use it
Classify materials before upload: public marketing scripts, confidential employee training, customer information and regulated personal data may have very different handling requirements. Ask for the signed data-processing agreement, applicable subprocessors, retention/deletion schedule, cross-border-transfer measures and role-based access model. For employee avatars, record identity consent and offboarding procedures separately from the generic cloud storage location.
Failure cases and human review
Generated videos can be shared beyond the original team, and exporting an MP4 creates a copy outside the platform’s account controls. A strong internal process includes an owner, approved audience, expiration/review date and a documented method for revoking access to live projects. A product’s security badge or marketing summary should not be substituted for a documented technical and legal risk assessment.
When this workflow makes sense
This guide is most useful for enterprise buyers preparing a questionnaire and legal review. The public source supports specific policy claims as of the stated date; it does not establish every plan’s residency choice or legal compliance in a particular jurisdiction. Obtain updated contractual documents for an actual purchase, and coordinate specialized privacy-law analysis with AI 11 rather than claiming universal compliance.
Production checklist
- Request DPA, current subprocessors and security-portal report
- Separate storage region from processing and support access
- Document avatar and employee consent management
- Apply role-based controls to exported files
- Reverify dated policy at procurement approval
Documentation and public product announcements describe vendor-supported workflows; this article does not claim access to a paid account, independent video tests or measured output quality. Confirm availability, rights and generation costs for the exact model, account tier and region immediately before production. For cross-vendor rankings, use the AI 09 evidence methodology; for voice and music products, consult AI 05; for dated prices, use the AI 10 registry.
Sources & Further Reading
- Synthesia, Security Practices, February 3 2026 (checked 2026-10-25)