Data flows & privacy
More ▾
What reaches bitHuman in each deployment mode: where the avatar renders, where the conversation runs, what usage reports carry, and what bitHuman stores.
Two things decide what leaves your hardware: where the avatar renders, and where the conversation runs. This page answers both for each mode.
By mode
| Question | bitHuman cloud | Your servers | On the device |
|---|---|---|---|
| The avatar renders | on bitHuman’s servers, in the US | on your Mac or Linux machines; its audio and video stay there | in your app on the device, or in the browser tab (render=local) |
| The conversation runs | on bitHuman’s voice service, or with the providers whose keys you connect | where you choose: the CLI’s local conversation brain, your own services, or bitHuman’s | where your app chooses; with the web embed, on bitHuman’s servers |
| Usage reports | none: bitHuman runs the session | usage only, no audio, video, images or conversation text | the same as your servers |
| Transcripts at bitHuman | stored with the agent | none stored | none stored |
| Your API secret | on your server; browsers get scoped embed tokens | on your machine | held by your app on the device |
Fully offline runs on Linux PCs and terminals with no required reconnection; it is arranged through sales.
What leaves your hardware
Pick a mode to see where each kind of data goes. Rows marked Reaches bitHuman are what crosses from your hardware to bitHuman.
- Reaches bitHuman
- Stays on your hardware
- Your choice of services
- Comes from bitHuman
- At bitHuman
bitHuman cloud
- PortraitReaches bitHumanuploaded once to the bitHuman cloud, where the avatar is created
- Avatar model fileAt bitHumanstays in the bitHuman cloud, where the avatar renders, in the US
- Live audioReaches bitHumanreaches bitHuman to run the session, encrypted in transit
- Avatar videoComes from bitHumanrendered by bitHuman and streamed to your viewer
- TranscriptsAt bitHumankept with the agent; deleting the agent deletes them
- Knowledge and personaAt bitHumanyour persona lives with the managed agent; deleting the agent deletes its records
- Provider keysReaches bitHumanencrypted at rest when you connect them
- API secretStays on your hardwareon your server; browsers get scoped embed tokens
- Usage reportsAt bitHumanbitHuman meters the session it runs: active session time, talking or idle
Your servers
- PortraitReaches bitHumanuploaded once to the bitHuman cloud, where the avatar is created
- Avatar model fileComes from bitHumandownloads once, then renders on your machine
- Live audioYour choice of servicesgoes where the conversation runs: nowhere with the CLI's local conversation brain, or to your services or bitHuman's
- Avatar videoStays on your hardwarestays on your machine
- TranscriptsStays on your hardwarenone stored at bitHuman
- Knowledge and personaYour choice of serviceswhere the conversation runs; any OpenAI-compatible model works, including one in your own network
- Provider keysYour choice of servicesstay with the services you run
- API secretStays on your hardwareon your machine; checked when a session starts
- Usage reportsReaches bitHumanreach bitHuman, with no audio, video, images or conversation text
On the device
- PortraitReaches bitHumanuploaded once to the bitHuman cloud, where the avatar is created
- Avatar model fileComes from bitHumandownloads once; on Android, usage reporting is then the only traffic
- Live audioYour choice of servicesgoes to the voice and language services your app uses; with your own, bitHuman receives none
- Avatar videoStays on your hardwarerenders on the device; bitHuman never receives it
- TranscriptsStays on your hardwarenone stored at bitHuman
- Knowledge and personaYour choice of servicesstays with your app and the services it uses
- Provider keysYour choice of servicesstay with your app and the services it uses
- API secretStays on your hardwareheld by your app; checked when a session starts
- Usage reportsReaches bitHumanusage metering only, never audio, video or conversation text
CPU only (no GPU)
- PortraitReaches bitHumanuploaded once to the bitHuman cloud, where the avatar is created
- Avatar model fileComes from bitHumandownloads once, then renders on your machine
- Live audioYour choice of servicesgoes where the conversation runs: nowhere with the CLI's local conversation brain, or to your services or bitHuman's
- Avatar videoStays on your hardwarerenders on the PC's CPU and stays there
- TranscriptsStays on your hardwarenone stored at bitHuman
- Knowledge and personaYour choice of serviceswhere the conversation runs; any OpenAI-compatible model works, including one in your own network
- Provider keysYour choice of servicesstay with the services you run
- API secretStays on your hardwareon your machine; checked when a session starts
- Usage reportsReaches bitHumanreach bitHuman, with no audio, video, images or conversation text
Fully offline
- PortraitReaches bitHumanuploaded once to the bitHuman cloud, where the avatar is created
- Avatar model fileStays on your hardwareruns on the machine; creating the avatar happens online first
- Live audioStays on your hardwarestays on the machine, off the internet
- Avatar videoStays on your hardwarestays on the machine
- TranscriptsStays on your hardwarestay on the machine
- Knowledge and personaStays on your hardwareagreed with sales for your site
- Provider keysStays on your hardwareagreed with sales for your site
- API secretStays on your hardwarearranged through sales, for Business & Enterprise
- Usage reportsStays on your hardwaremetered on the machine; no required reconnection
Web embed, render=local
- PortraitReaches bitHumanuploaded once to the bitHuman cloud, where the avatar is created
- Avatar model fileComes from bitHumanthe avatar's web bundle downloads to the browser
- Live audioReaches bitHumanreaches bitHuman: the conversation runs on bitHuman's servers
- Avatar videoStays on your hardwarerenders in the visitor's tab with WebGPU
- TranscriptsAt bitHumanthe conversation runs on bitHuman's servers
- Knowledge and personaAt bitHumanyour persona lives with the managed agent
- Provider keysReaches bitHumanencrypted at rest when you connect them
- API secretStays on your hardwarenever in the browser: the embed uses scoped tokens
- Usage reportsAt bitHumanbitHuman meters the session: active session time, talking or idle
Usage reports never contain audio, video, images or conversation text.
Rendering on your hardware
When the avatar renders on your hardware, its audio and video stay there. When the avatar renders in your app on the device and you use your own voice and language services, bitHuman receives usage metering only, never audio, video or conversation text. On Android, after the one-time model download, the only network traffic is usage reporting.
With the web embed, the conversation runs on bitHuman’s servers, even when the avatar renders in the tab (render=local).
The conversation
- The local conversation brain: with the CLI’s local conversation brain (
BITHUMAN_LOCAL=1), speech recognition, the language model and the voice run on the machine; audio, transcripts and generated speech never leave it. The session still reports usage online. - Your own model: a managed agent works with any OpenAI-compatible language model endpoint, including one in your own network (Providers).
- Your own stack: the Swift and Android SDKs take any 16 kHz mono speech your pipeline produces and return frames.
Usage reports
Self-hosted and on-device sessions check your credential when they start and report usage while they run. Usage reports contain no audio, video, images or conversation text. Self-hosted and on-device sessions store no transcript at bitHuman.
Creating an avatar
Avatar creation from a portrait happens in the bitHuman cloud; the finished avatar model then runs on your devices. The portrait is uploaded for that step, in every mode.
Security and access
- In transit: encrypted with HTTPS/TLS; WebRTC media uses DTLS-SRTP. Provider keys you connect are encrypted at rest.
- Access: organization roles (owner, admin, member), an audit-log API, API-secret rotation with immediate revocation, and scoped runtime and embed tokens so browsers never hold your secret (Organizations, API secrets).
- Region: avatars in the bitHuman cloud render in the US.
Retention and deletion
Deleting an agent deletes its records, including transcripts, and its model files (Agents).
Your content
bitHuman’s privacy policy says: “We do not use your content to train our AI models unless you explicitly opt in.” and “We do not sell your personal information.” For the EU AI Act, see our reading of Article 50.