> ## Documentation Index
> Fetch the complete documentation index at: https://docs.talking-avatar.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and privacy

> How your keys, audio, transcripts and payment details are handled.

## Your API keys

* Keys are stored hashed. The full key is shown only once, when you create it.
* Keep keys on your server. Your users' browsers only play the avatar's stream; they never need a key.
* You're responsible for all usage on your keys. If a key may have been exposed, [revoke it](https://docs.talking-avatar.dev/dashboard/api-keys.md#revoke-a-key) straight away.

## Audio and video

| Product | What happens to audio |
| - | - |
| **Realistic Avatars** | Your agent's voice is used only to animate the avatar and stream it to your users. We don't store or record the audio or the resulting video. |
| **Voice Agents** | The caller's audio is used to understand them and generate the agent's replies. The call's transcript is kept for you, the agent's owner, in the dashboard and sent to your post-call webhook. |
| **Open Source** | Everything runs in the browser. Audio never leaves the page. |
| **Demo calls** (website and dashboard **Avatars** page) | Transcribed to improve Talking Avatar, and kept for a short time. |

## Voice agent requests

Every tool request and post-call webhook is signed with the agent's own secret, using [Standard Webhooks](https://www.standardwebhooks.com), so your server can check it came from your agent. See [Verify signatures](https://docs.talking-avatar.dev/api-reference/verify-signatures.md).

Voice agent call pages, including embeds on your site, don't run analytics, session recording or support chat for your callers.

## Payments

Payments are processed by Dodo Payments. Your card details go directly to them; we never see or store your full card number.

## Your responsibilities

* Tell your users they're talking to an AI where the law requires it, and whenever they might otherwise be misled.
* Have a lawful basis, and give any required notice, for personal information your users share with your agents.
* Only send audio you have the rights to use, and only create custom avatars of people who have consented.

## Policies

* [Privacy Policy](https://talking-avatar.dev/privacy)
* [Terms of Service](https://talking-avatar.dev/terms)

Report a security issue to [support@talking-avatar.dev](mailto:support@talking-avatar.dev). For the open-source SDK, see its [security policy](https://github.com/interviewflowai/talking-avatar/blob/master/SECURITY.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.