Murf

Name: Murf business-data verdict
Item: Murf
Author: Aaron Simmons

Careful

Last checked 10 Nov 2026 · Reviewed by Aaron Simmons, security practitioner · How we decide

Murf's terms require explicit written consent from a person before their recordings are used to train a cloning voice, and they say Murf staff may listen to samples to test quality. The API agreement says Murf will not use customer data to train Murf's or a third party's models. The enterprise API docs repeat that covenant and say zero retention is an opt-in setting, not the default. The November 3, 2023 privacy policy does not itself say studio uploads are excluded from base-model training. Use the API or enterprise terms if that promise is what you need, and do not assume the studio page carries it.

Data-safety checklist

Trains on your data by default

Unknown

The API usage agreement says Murf will not use customer data to train, fine-tune, or develop an artificial intelligence model of Murf or of any third party. The enterprise API docs say text or audio never feeds Murf model training. A cloning voice is, by the terms, a model trained on a consenting speaker's recordings. The privacy policy does not state whether other studio audio is used to train base models.

How to opt out

Steps

Zero retention on the API is opt-in. Murf's enterprise docs say setting encodedAsBase64 to true returns audio inline without object storage. There is no described switch that turns an already-required no-training promise off, because the API agreement states the promise as a contract term. Studio training was not given an opt-out in the privacy policy.

Data retention

What they keep

The privacy policy says Murf generally keeps personal information while the account is open or as needed to provide the services. The API agreement says that when the agreement ends, Murf will return or destroy customer data on written request unless the law requires it to keep the data. Zero retention mode does not store the generated audio.

BAA / HIPAA

Unknown

The privacy policy, terms, API agreement, and enterprise API page we read do not offer a business associate agreement.

Certifications

2 listed

SOC 2 Type II
ISO 27001

Enterprise and admin controls

Controls

The enterprise API page says the service uses the same posture that earned Murf its SOC 2 Type II and ISO 27001 badges, and that customer text or audio is not used for model training. Zero retention is a per-call API setting. Voice cloning requires written consent from the speaker, including a third party, and Murf says it will not share that training audio except with personnel and providers for quality testing.