Figma
Design · figma.com · last read 2026-11-09
At a glance
- Is Figma GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Figma itself publishes, each answer linked to its source and the date we read it.
- Does Figma have a data processing agreement (DPA)?
- Yes. Figma publishes a data processing agreement at figma.com. It gives 15 days' notice before a new subprocessor is added. It commits to telling you of a personal data breach within 72 hours. Source and date
- Does Figma have a SOC 2 report?
- Figma states SOC 2 Type 2 on its own page, but does not say there how to get a report. In Figma's words: “Figma has an SOC 2 Type 2 report that shows our commitment to protecting customer data through robust security, availability, and confidentiality controls.” We read this on 2026-10-04. Source and date
- Is Figma ISO 27001 certified?
- Figma states ISO/IEC 27001 (2022 edition, as Figma names it) on its own page, but does not say there how to get the certificate. In Figma's words: “Figma has certified its product and services against ISO/IEC 27001:2022 and ISO/IEC 27018:2019.” We read this on 2026-10-04. Source and date
- Where is Figma's trust center?
- Figma publishes a page it calls “Trust Center” at compliance.figma.com. Some of its documents sit behind a request or sign-in: the page says “Get Access”. The page mentions SOC 2, ISO 27001, a penetration test, subprocessors and security questionnaires. We read it on 2026-11-03. Source and date
- Does Figma use your data to train AI models?
- For consumer plans (Figma Starter and Professional plans): customer content used for AI training by default; team admins can opt out. For business plans (Figma Organization and Enterprise plans): content training off by default; organization admins can turn it on. For business plans (Figma for Education (K-12) and Figma for Government): no data from these accounts used for model training. Source and date
- Does Figma offer zero data retention?
- For every plan (Figma AI): third-party model providers required to delete inputs and outputs after processing. Source and date
- How does Figma transfer personal data out of the EU?
- Figma's agreement relies on the EU standard contractual clauses, the EU-U.S. Data Privacy Framework and the UK transfer addendum. Figma, Inc. is on the official Data Privacy Framework List (status: Active). Source and date
- Does Figma offer EU data residency?
- An EU location exists but only on the enterprise tier. Plan it needs: Enterprise. Source and date
- Who are Figma's subprocessors?
- Figma lists 50 third-party subprocessors; 48 of them name at least one processing country outside the EEA. We last read the list on 2026-10-26. We have recorded 2 changes to it, the latest on 2026-10-26. Source and date
- How do you report a security vulnerability to Figma?
- Figma publishes a security.txt at figma.com naming https://hackerone.com/figma. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | Figma, Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | US |
| EU contracting entity | — |
| LEI | 254900273Q0J4Z65HU28 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | figma.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Figma data residency
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Enterprise only | Enterprise | help.figma.com | 2026-09-18 |
EU: Page states the Figma Data Residency Solution 'is only available to customers on the Figma Enterprise plan'. Published data - anything made generally available via the internet - is outside the scope of the solution.
The same question for every vendor: where SaaS vendors store EU data.
Figma's subprocessor list names AWS for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
Subprocessor chain
50 third parties · 15 of the vendor's own group companies · 48 with a country outside the EEA · all read 2026-10-26
| Subprocessor | Country | Purpose |
|---|---|---|
| Agora, Inc. | US | In product audio conference and speech to text transcription features |
| Amazon Web Services, Inc. | US | AI model provider |
| Amazon Web Services, Inc. | US | Cloud infrastructure provider |
| Amazon Web Services, Inc. (Bedrock) | US | Content moderation and safety filtering |
| Anthropic PBC | US | AI model provider |
| Automattic Inc. (Akismet) | US | Content moderation and safety filtering |
| Bria Artificial Intelligence Ltd | US | Figma Weave: Selectable AI model provider |
| BytePlus Sdn. Bhd. | EU, ID, MY | Figma Weave: Selectable AI model provider |
| Castle Global, Inc (Hive) | US | Content moderation and safety filtering |
| Cerebras Systems, Inc. | US | AI model provider |
| Cloudflare, Ltd. | US | Web infrastructure |
| Cloudinary | US | Cloud Infrastructure Provider |
| Create Without Limits Technologies Inc. (dba Enhancor) | US | Figma Weave: Selectable AI model provider |
| Datadog, Inc. | US | Infrastructure monitoring and debugging |
| Decagon AI, Inc. | US | Self-serve automation for customer support inquiries |
| Digital Ocean | US | Ephemeral Processing |
| Eleven Labs Inc. | US | Figma Weave: Selectable AI model provider |
| Features & Labels, Inc. (FAL) | US | Figma Weave: Platform hosting; Selectable AI model provider |
| Fireworks.ai, Inc. | US | AI model provider |
| Freepik, Inc. | BE, NL, ES | Figma Weave: Selectable AI model provider |
| Functional Software, Inc. (Sentry) | US | Application error tracking and monitoring |
| Gainsight, Inc. | US | Public support forum hosting (https://forum.figma.com/) |
| Google LLC | US | Figma Weave: AI model provider |
| Google LLC (Firebase) | US | Customer push notifications on mobile apps |
| Google LLC (Vertex) | US | AI model provider |
| Hex, Inc | US | Data analytics for support issues |
| Intercom, Inc. | US | Figma Weave: Customer service and technical support |
| IntouchCX, Inc. | CA, PH | Customer service and technical support |
| Jasper AI, Inc. | US | AI model provider |
| Kling AI Pte. Ltd. | SG | Figma Weave: Selectable AI model provider |
| Lightricks Ltd. | EU, IL, GB, US | Figma Weave: Selectable AI model provider |
| Luma AI, Inc. | US | Figma Weave: Selectable AI model provider |
| Microsoft Corporation (Azure) | US | AI model provider |
| Modal Labs, Inc. | US | Cloud infrastructure provider for customer sandbox environments |
| OpenAI, LLC | US | AI model provider |
| OpenAI, LLC | US | Content moderation and safety filtering |
| PostHog, Inc. | DE | Figma Weave: Customer support data analytics |
| Premier Talent Partners | US | Customer service and technical support |
| Pylon Labs, Inc | US | Customer service and technical support |
| QuiverAI, Inc. | US, EU | AI model provider |
| Recraft, Inc. | US | AI model provider |
| Replicate LLC | US | Figma Weave: Selectable AI model provider |
| Runway AI, Inc. | US | Figma Weave: Selectable AI model provider |
| SendGrid, Inc. | US | Customer email notifications |
| Snowflake, Inc. | US | Cloud-based data warehouse |
| Sprinklr, Inc. | US | Customer service and technical support |
| Twilio, Inc. | US | Identity management |
| Twilio, Inc. (Segment) | US | Data analytics |
| World Labs Technologies, Inc. | US | Figma Weave: Selectable AI model provider |
| Zendesk, Inc. | US | Customer service and technical support |
Figma's own group companies listed as subprocessors (15)
| Company | Country | Purpose |
|---|---|---|
| Figma Australia Pty Ltd | AU | Technical and operational support |
| FIGMA BRASIL LTDA. | BR | Technical and operational support |
| Figma Canada Ltd. | CA | Technical and operational support |
| Figma France SAS | FR | Technical and operational support |
| Figma GmbH | DE | Technical and operational support |
| Figma India Private | IN | Technical and operational support |
| Figma International LLC | US, NZ | Technical and operational support |
| Figma Ireland Limited | IE | Technical and operational support |
| Figma Japan K.K | JP | Technical and operational support |
| Figma Korea Ltd. | KR | Technical and operational support |
| Figma Singapore Pte. Limited | SG | Technical and operational support |
| Figma UK Limited | GB | Technical and operational support |
| Figma, Inc. | EU, US | Technical and operational support |
| Vmlapp Sweden AB | SE | Technical and operational support |
| Weavy AI Ltd | IL | Technical and operational support |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · figma.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK Addendum |
| Transfer mechanism | other |
| Notice of new subprocessors | At least 15 days before processing begins; added to sub-processor list and written notice to customers subscribed to notifications |
| Notice of new subprocessors | Prior notice of Sub-processor changes (EU SCCs Clause 9 Option 2); notice period as set out in Section 3 (Sub-processors) of the Addendum |
| If you object to one | Written objection on reasonable data protection grounds during notice period; parties discuss alternatives in good faith; if unresolved, Figma may proceed and Customer's sole and exclusive remedy is to terminate the affected Order |
| If you object to one | Written objection on reasonable data-protection grounds during the Sub-processor Notice Period; parties discuss alternatives in good faith; if unresolved, Figma may proceed and customer's sole remedy is to terminate the affected Order by written notice |
| Obligations passed to subprocessors | written agreements with each Sub-processor imposing data protection obligations consistent with the Addendum; Figma remains liable for Sub-processor failures |
| Breach notification | without undue delay and, where feasible, within 72 hours |
| Deletion when the service ends | At the end of service, as Customer directs, delete or return all Customer Content within 30 days; may retain only to the extent required by Data Protection Law, subject to the confidentiality and processing restrictions |
| Getting your data back | At Customer's option at the end of service, Figma returns all Customer Content within 30 days |
| Requests from data subjects | Reasonable and timely assistance to Customer in responding to individuals' rights requests, where Customer cannot fulfil them itself using the platform's self-service functionality; no handling stated for requests sent directly to Figma |
| Audit | Customer audit at customer's cost only if reports are insufficient; during business hours, 45 days' written notice, once per year (unless regulator requires), under confidentiality |
| Audit | Summaries of third-party certifications and audit reports on written request at reasonable intervals, subject to confidentiality; annual independent third-party audits at Figma's expense |
| Processing on your instructions | only in accordance with documented Customer Instructions, or to comply with Figma's obligations under applicable laws |
| Confidentiality of staff | persons authorized to process Customer Content subject to written or statutory obligations of confidentiality |
| Security measures | appropriate technical and organizational measures to protect security, confidentiality, integrity and availability of Customer Content |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Which version applies
We found no version number or date in the agreement as we read it.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
AI and your data
What Figma's own pages state about the data you send its AI products, plan by plan. Compared with other vendors on AI vendors and your data.
| Plans | Term | What the page says | Source | Observed |
|---|---|---|---|---|
| All plans Figma AI | Zero data retention | With its model providers third-party model providers required to delete inputs and outputs after processing | figma.com | 2026-11-02 |
| All plans Figma AI | Model providers | Amazon Web Services, Inc. | figma.com | 2026-10-29 |
| All plans Figma AI | Model providers | Amazon Web Services, Inc. (Bedrock) | figma.com | 2026-10-29 |
| All plans Figma AI | Model providers | Anthropic PBC | figma.com | 2026-10-29 |
| All plans Figma AI | Model providers | Cerebras Systems, Inc. | figma.com | 2026-10-29 |
| All plans Figma AI | Model providers | Fireworks.ai, Inc. | figma.com | 2026-10-29 |
| All plans Figma AI | Model providers | figma.com | 2026-11-02 | |
| All plans Figma AI | Model providers | Google LLC (Vertex) | figma.com | 2026-10-29 |
| All plans Figma AI | Model providers | Jasper AI, Inc. | figma.com | 2026-10-29 |
| All plans Figma AI | Model providers | Microsoft Corporation (Azure) | figma.com | 2026-10-29 |
| All plans Figma AI | Model providers | OpenAI | figma.com | 2026-11-02 |
| All plans Figma AI | Model providers | QuiverAI, Inc. | figma.com | 2026-10-29 |
| All plans Figma AI | Model providers | Recraft, Inc. | figma.com | 2026-10-29 |
| Consumer Figma Starter and Professional plans | Training on your data | Used unless you opt out customer content used for AI training by default; team admins can opt out | figma.com | 2026-11-02 |
| Business Figma Organization and Enterprise plans | Training on your data | Not used unless you opt in content training off by default; organization admins can turn it on | figma.com | 2026-11-02 |
| Business Figma for Education (K-12) and Figma for Government | Training on your data | Not used no data from these accounts used for model training | figma.com | 2026-11-02 |
| Business Figma Enterprise with Governance+ (AI hosting controls enabled) | Model providers | Amazon Bedrock | help.figma.com | 2026-10-29 |
| Business Figma Enterprise with Governance+ (AI hosting controls enabled) | Model providers | Amazon SageMaker | help.figma.com | 2026-10-29 |
Assurance
Does Figma have a SOC 2 report?
Figma states SOC 2 Type 2 on its own page, but does not say there how to get a report. We read this on 2026-10-04.
- Claimed “Figma has an SOC 2 Type 2 report that shows our commitment to protecting customer data through robust security, availability, and confidentiality controls”
Source: figma.com, 2026-10-04
Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.
Is Figma ISO 27001 certified?
Figma states ISO/IEC 27001 (2022 edition, as Figma names it) on its own page, but does not say there how to get the certificate. We read this on 2026-10-04.
- Claimed “Figma has certified its product and services against ISO/IEC 27001:2022 and ISO/IEC 27018:2019.”
Source: figma.com, 2026-10-04
On the same list Figma also names ISO/IEC 27017, ISO/IEC 27018 and ISO/IEC 27701. Each standard's page says how it relates to ISO/IEC 27001.
Of the 122 vendors in this registry whose own pages state ISO/IEC 27001, 16 link to the certificate, 43 say it is available on request, and 63 state it without saying how to get it. A certificate names the certification body, the scope and the expiry date: those are the three things to check.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| C5 Cloud Computing Compliance Criteria Catalogue · C5 | Claimed | — | figma.com | 2026-10-04 |
| Consensus Assessments Initiative Questionnaire (CAIQ) · CAIQ | Claimed | — | figma.com | 2026-10-04 |
| EU Cloud Code of Conduct · EUCloudCoC | Claimed | — | figma.com | 2026-10-04 |
| FedRAMP Authorized · FedRAMP | Claimed | — | figma.com | 2026-10-04 |
| ISO/IEC 27001:2022 · ISO27001 | Claimed | its product and services | figma.com | 2026-10-04 |
| ISO 27017 · ISO27017 | Claimed | — | figma.com | 2026-10-04 |
| ISO/IEC 27018:2019 · ISO27018 | Claimed | its product and services | figma.com | 2026-10-04 |
| ISO 27701 · ISO27701 | Claimed | — | figma.com | 2026-10-04 |
| ISO 42001 · ISO42001 | Claimed | — | figma.com | 2026-10-04 |
| ISO/IEC 42001:2023 · ISO42001 | Claimed | its AI management system | figma.com | 2026-10-04 |
| SOC 2 Type 2 · SOC2T2 | Claimed | security, availability, and confidentiality controls that align with the AICPA Trust Services Criteria | figma.com | 2026-10-04 |
| SOC 3 · SOC3 | Claimed | security, availability, and confidentiality controls that align with the AICPA Trust Services Criteria | figma.com | 2026-10-04 |
| TISAX | Claimed | — | figma.com | 2026-10-04 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Figma, Inc. | Active | HR data, non-HR data | 2027-07-22 | 2026-10-05 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Figma, Inc. | Active | HR data, non-HR data | 2027-07-22 | 2026-10-05 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Figma, Inc. | Active | HR data, non-HR data | 2027-07-22 | 2026-10-05 |
| EU Cloud Code of Conduct (GDPR Art. 40) | Figma, Inc. (figma.com) · Figma, Inc. | adherent | Level 2 | 2027-08-14 | 2026-10-09 |
| FedRAMP Marketplace (US) | Figma for Government · Figma | FedRAMP Authorized | Moderate | — | 2026-10-04 |
| Global LEI Index (GLEIF) | FIGMA, INC. · FIGMA, INC. | ISSUED | US-DE | 2027-01-17 | 2026-10-08 |
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under Figma; Figma Ireland Limited; Figma, Inc.
- ISO 27001 on the basis of IT-Grundschutz (BSI, Germany): checked 2026-11-09, no entry under Figma; Figma Ireland Limited; Figma, Inc.
- CISPE Data Protection Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Figma; Figma Ireland Limited; Figma, Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under Figma; Figma Ireland Limited; Figma, Inc.
- Data Privacy Framework List (US): checked 2026-11-09, 3 entries under Figma; Figma Ireland Limited; Figma, Inc.
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under Figma; Figma Ireland Limited; Figma, Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, 1 entry under Figma; Figma Ireland Limited; Figma, Inc.
- FedRAMP Marketplace (US): checked 2026-11-09, 1 entry under Figma; Figma Ireland Limited; Figma, Inc.
- GPAI Code of Practice signatories (European Commission): checked 2026-11-09, no entry under Figma; Figma Ireland Limited; Figma, Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under Figma; Figma Ireland Limited; Figma, Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Figma (SaaS) | — | Service only | unknown | figma.com | 2026-09-18 |
| Figma desktop app | 6 months | Declared | unknown | help.figma.com | 2026-10-11 |
Vulnerability reporting: hackerone.com (security.txt, expires 2027-10-21; read 2026-10-17)
How other vendors publish theirs: security.txt across the registry.
Documents
Where is Figma's trust center?
Figma publishes a page it calls “Trust Center” at compliance.figma.com. Some of its documents sit behind a request or sign-in. The page mentions SOC 2, ISO 27001, a penetration test, subprocessors and security questionnaires. We read it on 2026-11-03. Open compliance.figma.com
- Name “Trust Center”
- Request step “Get Access”
Source: compliance.figma.com, 2026-11-03. Read from the page's text, without a model; every vendor's trust center.
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| ai | Public | full | 200 | 2026-10-29 |
| ai-2 | Public | full | 200 | 2026-11-02 |
| ai-3 | Public | full | 200 | 2026-10-29 |
| dpa | Public | full | 200 | 2026-10-09 |
| lifecycle | Public | full | 200 | 2026-10-11 |
| subprocessors | Public | full | 200 | 2026-10-26 |
| tia | Public | full | 200 | 2026-10-20 |
History
| Detected | What moved | Why | Source |
|---|---|---|---|
| 2026-10-26 | Subprocessors added Lightricks Ltd.; QuiverAI, Inc. Subprocessors removed Lightricks Ltda AI, Inc. Subprocessors location changed Create Without Limits Technologies Inc. (dba Enhancor): EU, ID, MY -> US | the vendor changed it | figma.com |
| 2026-10-05 | Subprocessors added Automattic Inc. (Akismet); Cloudinary | the vendor changed it | figma.com |
| 2026-09-18 | Note rewritten | we read a better page | help.figma.com |
Every reviewed change across the registry, newest first: vendor changes.