SOC 2

SOC 2 is a security and compliance audit framework that evaluates how a service manages controls for security, availability, confidentiality, processing integrity, and privacy.

How SOC 2 applies to avatar APIs

SOC 2 is an audit framework for how a service organisation manages controls around security, availability, confidentiality, processing integrity and privacy. Buyers often ask for it during procurement.

For avatar APIs, SOC 2 matters because the provider may handle live audio, video, transcripts, prompts, logs and customer data. The audit gives buyers a structured way to assess whether those systems are operated with appropriate controls.

A concrete example: an enterprise security team reviewing an avatar vendor may ask for a SOC 2 report before allowing the product to process customer-support conversations.

SOC 2 is not the same as being compliant with every industry regulation. It is one piece of the security review, alongside data retention, access controls, subprocessors, regional processing and product-specific safeguards.

What Anam ships

Anam's Cara-4 model delivers expressive real-time avatars with around 150 ms server-side avatar-generation latency once a session is running, across 70+ languages. Builders use JavaScript and Python SDKs or integrations for LiveKit, Pipecat, ElevenLabs Agents, Agora, and VideoSDK. Bring any AI stack including OpenAI, Claude, Gemini, Mistral, Groq, Deepgram, Cartesia, or custom providers. The platform supports WebRTC delivery, SOC 2 Type II, HIPAA, zero data retention, and regional data residency. Sessions stream low-latency audio and video to browsers and native apps.

Explore the real-time avatar API →

Related terms

Data residency

Data residency is the control over the geographic region where user data is processed and stored, which matters when avatar sessions include audio, video, transcripts, prompts, or logs.

PII redaction

PII redaction is the process of removing or masking personally identifiable information from transcripts, logs, and stored records so avatar systems retain less sensitive user data.

Customer support agent

A customer support agent is an interactive avatar configured to answer customer questions, retrieve approved help content, check account context, and route complex issues to the right workflow.

Avatar API

An avatar API is a developer interface for creating, configuring, and streaming interactive digital characters inside an application, so products can start live avatar sessions, pass user input to an agent, and return spoken video responses in real time.

Frequently asked questions

What does SOC 2 mean for an avatar API?

SOC 2 means an independent auditor has reviewed the company's controls for areas such as security, availability, confidentiality, processing integrity, or privacy.

Does SOC 2 make an avatar product automatically compliant?

No. SOC 2 is an audit report on controls, not a blanket compliance guarantee. Buyers still need to review data flows, contracts, retention, and their own obligations.

Why do enterprise buyers ask avatar vendors for SOC 2?

Avatar sessions can involve voice, video, transcripts, and customer context. SOC 2 gives security and procurement teams a structured way to evaluate how that data is protected.

What should teams review besides SOC 2?

Review the DPA, subprocessors, encryption, access controls, data retention, residency options, logging, incident response, and how session recordings or transcripts are handled.

Last updated: 17th July 2026 · Reviewed quarterly.

← Back to glossary