# Security and retention

URL: https://docs.bithuman.ai/deploy/privacy/retention

> How data is protected, how long it is kept, and how it is deleted.

What bitHuman does with data that reaches it; what reaches it in each mode is on [Data flows & privacy](https://docs.bithuman.ai/deploy/privacy).

## Security and access

- **In transit:** encrypted with HTTPS/TLS; WebRTC media uses DTLS-SRTP. Provider keys you connect are encrypted at rest.
- **Access:** organization roles (owner, admin, member), an audit-log API, API-secret rotation with immediate revocation, and scoped runtime and embed tokens so browsers never hold your secret ([Organizations](https://docs.bithuman.ai/api/organizations), [API secrets](https://docs.bithuman.ai/api/api-keys)).
- **Region:** avatars in the bitHuman cloud render in the US.

The overview to share with your team is on bithuman.ai: [security and privacy](https://www.bithuman.ai/security).

## Retention and deletion

Deleting an agent deletes its records, including transcripts, and its model files ([Agents](https://docs.bithuman.ai/api/agents)).

## Your content

bitHuman's [privacy policy](https://www.bithuman.ai/legal/privacy) says: "We do not use your content to train our AI models unless you explicitly opt in." and "We do not sell your personal information." For the EU AI Act, see [our reading of Article 50](https://docs.bithuman.ai/legal/eu-ai-act).