HeyGen

HeyGen generates video of a presenter who never stood in front of a camera. You either pick one of the stock avatars, 500+ on the free plan and 700+ on paid, or train a custom one from your own footage or a single photo, then give it a script and it speaks with lip-sync the vendor describes as phoneme-level across 175+ languages and dialects.

There are three ways in, and they matter for who should buy it. AI Studio is a text-based editor where the script is the interface: you type, and tone, gesture and pacing follow the words. Video Agent goes further and takes a single prompt to a finished multi-scene video, with the motion elements left editable afterwards. Video Translation is a separate path that takes existing footage or a YouTube link and re-voices it in another language with the original speaker's cloned voice.

Video Agent is what makes this an agent rather than a tool: its documented mode is fire-and-forget, with scripting, avatar selection, scene composition and rendering all happening without a checkpoint.

The self-serve ladder runs Free at $0, Creator at $29, Pro at $49 and Business at $149 a month, with Enterprise quoted by sales. Paying yearly drops those to $24, $41 and $119 a month, billed as $288, $488 and $1,428 up front. The vendor states the yearly totals but prints no savings percentage anywhere on the pricing page.

What each plan actually buys is credits: 600 on Creator, 1,000 on Pro, 1,500 on Business. How many credits a given video consumes is not published, which is the single biggest gap in the rate card. Pro's "Customizable monthly usage" means you can buy a larger pool than the default.

There are meters beside the plan meter. The API has its own credits and its own pricing page behind the app. The docs note that an API key is charged 1 API credit per avatar look while an OAuth or MCP call takes the method's standard price from workspace credits, and that OAuth requests including MCP are rounded up per request "so their effective cost can be higher". Individual jobs can carry their own rate: filler word removal is documented at $0.30 per source minute with a one-minute minimum. Exceeding the plan volume moves you to a la carte rates under section 7(b) of the terms.

Two price facts a buyer meets late: seats on Business cost $20 each per month on top of the $149, and the free plan's output is licensed for "personal, non-commercial, and internal evaluation purposes" only, so a free account cannot legally be used to make a client video even though it will render one.

The v3 REST API at api.heygen.com covers video creation, templates with variables, instant and professional voice cloning, text to speech, translation, lipsync, AI clipping and batches of up to 100 jobs. Completion arrives either by polling or by signed webhooks: HMAC-SHA256 over the raw body, a 10-second window to answer with a 2xx, and retries with exponential backoff for up to 24 hours. A one-off callback_url on the create call works when a persistent endpoint is overkill.

More unusual is the hosted MCP server at mcp.heygen.com/mcp/v1/. It needs no API key and nothing installed: the client authenticates by OAuth and the agent then calls roughly eighty tools covering nearly the whole API surface. The vendor states it is available on all HeyGen plans and bills from the plan's existing credits rather than a separate developer account, with one documented exception, that free-tier MCP access cannot call the avatar-looks endpoint.

Two practical constraints sit on that server. It uses domain whitelisting, so a custom agent on an unlisted domain has to request access first. And the v1 and v2 endpoints are supported only until 31 October 2026, so anything built on the older API has a migration ahead of it.

HeyGen publishes an unusually specific security page: SOC 2 Type II certification, annual third-party penetration testing with reports released on request, AES-256 at rest and TLS 1.2 or higher in transit, Cloudflare DDoS protection, a SIEM, and a named Data Protection Officer based in Europe. Compliance claims extend to GDPR, CCPA, the EU-US Data Privacy Framework and the EU AI Act, with a subprocessor list on a separate security portal.

The gating is where buyers should look twice. Multi-factor authentication is on every tier, but SAML single sign-on begins at Business, and SCIM provisioning, enforced team-member 2FA and the audit log are all marked Enterprise-only in the plan comparison table. A company that needs an audit trail is therefore a sales conversation, not a checkout.

No uptime commitment is published. The security page claims redundant systems and automatic failover, but no percentage appears anywhere on the site.

The security page is clear that enterprise data is held out of training by default and that everyone else can opt out by emailing the privacy team, and that subprocessors are contractually barred from training on customer data.

The terms of service, accepted by every user, read differently. By uploading content you grant HeyGen a licence to use it "to operate, improve, promote and provide the Services and to develop new services and products, including to train or otherwise improve or modify our artificial intelligence and machine learning models", and that grant is described as "royalty-free, transferable, sublicensable, worldwide and irrevocable" and is stated to survive termination. The privacy policy sits between the two, listing model training as a legitimate-interest purpose with opt-out by email.

So the opt-out is real and documented, but it is an opt-out from a default that the contract words broadly, and it is exercised by email rather than a setting. For a buyer uploading a founder's face and voice, that is the paragraph to put in front of counsel. The biometric angle is explicit too: the privacy policy says some features "require us to process parts of faces or bodies within a video or photo, and this may include face imagery".

It fits a marketing, enablement or L&D team that needs the same message as video in many languages and does not want a studio booking for each one. The translation path, the brand glossary, SCORM export and LMS integrations on Business all point at that buyer, and so do the n8n, Make, HubSpot and Zapier integrations listed on the same tier.

It fits a developer differently, as a rendering backend: batch endpoints, templates with declared variables and webhooks are the shape of per-viewer personalized video at volume.

It does not fit anyone who needs the data to stay outside the United States: there is one region and no choice of it. It does not fit a self-hosting requirement, since nothing runs on customer infrastructure on any tier. It does not fit a buyer who needs an audit log or SCIM below Enterprise. And it does not fit a budget that must be fixed in advance, because the credit cost of a video is not published and several surcharges sit outside the plan meter.

The operator is HeyGen Technology, Inc. of 12130 Millennium Drive, Suite 300, Los Angeles, and the arbitration clause names Los Angeles County, California. Its claims of 1,000,000+ users, a Forbes AI 50 place and 4.8 of 5 on G2 rest on its own pages.