Resemble AI

Name: Resemble AI business-data verdict
Item: Resemble AI
Author: Aaron Simmons

Safe

Last checked 10 Nov 2026 · Reviewed by Aaron Simmons, security practitioner · How we decide

Resemble says it does not use customer voice recordings to train general-purpose models, for research, or for aggregated training. Before a voice model is created, it may require the person being cloned to record a spoken consent statement and checks that the statement matches the script. Voice recordings and voice models are kept while the account is active, then for 30 days after it ends, then deleted. Text sent for speech synthesis, and the audio generated from it, are not kept after delivery. This is a reasonable default for ordinary business audio. A business associate agreement was not in the privacy policy or terms we read.

Data-safety checklist

Trains on your data by default

The privacy policy says voice recordings and the resulting model are processed to deliver the custom voice and for no other purpose. Customer voice data is not used to train general-purpose models. The terms say detection media is not used to train models unless the customer opts in in writing. Non-identifiable aggregated data may still be used for internal improvement.

How to opt out

Steps

No opt-out is required for the ban on training general-purpose models on customer voice data. Detection media is excluded unless you opt in in writing. You can ask for deletion of specific content during the contract, and Resemble says it deletes that data within 30 days unless the law requires longer.

Data retention

What they keep

Voice recordings and voice models are kept while the account is active. After the account ends, or on a deletion request, they are kept for a 30-day export window and then permanently deleted. Consent recordings are kept for the life of the associated voice model. Text submitted for synthesis, and the audio generated from it, are not retained after delivery. Unflagged detection audio is discarded after analysis.

BAA / HIPAA

Unknown

The privacy policy and terms we read do not offer a business associate agreement. They do say Resemble is the processor, and the business customer is the controller, for voice cloning, text-to-speech, and detection services.

Certifications

1 listed

Security program described as aligned with SOC 2 Trust Services Criteria and ISO/IEC 27001

Enterprise and admin controls

Controls

The business customer controls instructions for processing and can direct how long flagged meeting media is kept, within the privacy policy's limits. The terms say safeguards include TLS 1.2 or higher, AES-256 at rest, and role-based access, in alignment with SOC 2 and ISO/IEC 27001. They do not link a certificate. Cloning can be blocked until a spoken consent statement matches the required script.