// Trust & Security Report
Figma AI
by Figma, Inc.
Collaborative interface design and product development platform including Figma Design, FigJam, Dev Mode, Figma Motion, Figma Slides, and AI-powered design tools
Certifications held
13
Maturity
Enterprise
Trains on your data
Yes
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on compliance.figma.com“Policy Figma Change Management Policy Figma Type 2 C5 Attestation Report Figma SOC 2 Type II Report Figma Slides VPAT2.5Rev508 (December 2025) Figma Make VPAT2.5Rev508 (December 2025) Figma ISO IEC 27001:”
Verify on compliance.figma.com“Make VPAT2.5Rev508 (December 2025) Figma ISO IEC 27001:2022 Certificate Figma SOC 3 Type II Report Desktop App VPAT2.5Rev508 (December 2025) SIG Lite Figma - Penetration Test Report Figma - Disaster”
Verify on compliance.figma.com“16 Badges QUICK LINKS Website URL Report a Vulnerability Badges ISO 27001 ISO 27017 ISO 27018 ISO 27701 ISO 42001 SOC 2 Type II SOC 3 SIG CSA FedRAMP Moderate GDPR CCPA EU Cloud Code of Conduct TISAX”
Verify on figma.com“Figma has certified its product and services against ISO/IEC 27001:2022 and ISO/IEC 27018:2019.”
Verify on compliance.figma.com“LINKS Website URL Report a Vulnerability Badges ISO 27001 ISO 27017 ISO 27018 ISO 27701 ISO 42001 SOC 2 Type II SOC 3 SIG CSA FedRAMP Moderate GDPR CCPA EU Cloud Code of Conduct TISAX VPAT C5 Featured”
Verify on figma.com“including the regulations, standards, and frameworks they adhere to. Learn more FedRAMP Authorized FedRAMP (Federal Risk and Authorization Management Program) is a U.S. government program that standardizes s”
Verify on compliance.figma.com“Figma TISAX Assessment Certificate”
Verify on figma.com“Figma implements Standard Contractual Clauses and complies with EU-U.S. Data Privacy Framework. Certified to U.S. Department of Commerce that it adheres to EU-U.S. Data Privacy Framework Principles, UK Extension, and Swiss-U.S. Data Privacy Framework”
Verify on compliance.figma.com“Figma Weave Disaster Recovery Test Figma TISAX Assessment Certificate Figma PCI DSS - AOC-SAQ-A Figma ISO IEC 42001:2023 Certificate Figma Information Security Policy Figma Disaster Recovery Policy Figma”
> Show 1 unconfirmed / not-held certifications
source: figma.comFigma's Acceptable Use Policy explicitly prohibits uploading patient, medical, or protected health information under HIPAA. Standard commercial platform is not HIPAA-compliant. Only Figma for Government offering has FedRAMP certification, not HIPAA certification.
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Offered
Data region
Primary processing in United States. EU data residency option available. International transfers comply with Standard Contractual Clauses and EU-U.S./Swiss-U.S. Data Privacy Framework.
Content training is optional and varies by plan. Starter/Professional: ON by default (admins can opt out). Organization/Enterprise: OFF by default. Education/Government accounts: NEVER. Figma prohibits third-party AI providers from using platform data for model training. Customer content is de-identified and sensitive information is redacted during AI model development. Users can control settings at team (Starter/Professional) or organization (Organization/Enterprise) level.
// Security controls
Encryption in Transit
TLS encryption for data in transit; DNSSEC secure domain name system for Figma for Government
figma.comAuthentication
SAML SSO support (OneLogin, Okta, Microsoft Azure AD), 2FA enforcement, IP allowlisting and network restrictions available
figma.comAccess Controls
Plugins restricted to individual design files; cannot modify Figma interface. Governance+ add-on provides IP allowlisting and network restrictions for enterprise
figma.comIncident Response
Security incident notification within 72 hours per GDPR requirements. Bug bounty program via HackerOne
figma.comAudit & Compliance
Annual independent third-party audits for SOC 2 Type 2 and ISO 27001 compliance verification
figma.com// Products & data scope
Data it handles: Design files, components, prototypes, collaboration data
Core collaborative design platform. Content training available (opt-out on Professional/Starter, opt-in on Enterprise). No HIPAA support.
Data it handles: Brainstorming boards, comments, real-time collaboration data
Online whiteboard with AI tools. Same content training policy as Figma Design. No HIPAA support.
Data it handles: Design specifications, component code references, developer comments
Bridge between design and development. Covered by same security and training policies.
Data it handles: Government agency design files with FedRAMP requirements
FedRAMP Moderate authorized environment. FIPS 140-2 validated. No content training. No HIPAA certification, but designed for government security requirements. Covers Design, FigJam, Dev Mode.
Data it handles: Content uploaded for AI generation, re-design requests, semantic search
Content training settings apply. Education/Government accounts exempt from training. De-identification and sensitive information redaction applied.
Data it handles: Presentations, animations, design iterations, site content
Newer products sharing core platform security model. Same content training and privacy policies apply.
// What to watch
- Content training is ON by default for Starter and Professional plans (not privacy-forward by default, though opt-out is available). Enterprise and Organization plans default to OFF.
- Standard commercial Figma platform explicitly does NOT support HIPAA-regulated data per Acceptable Use Policy. Organizations requiring HIPAA must use alternative tools.
- FedRAMP Moderate certification only applies to Figma for Government offering, not the standard commercial platform.
- ISO 42001:2023 (AI governance) is newly achieved (July 1, 2026) and represents current best practice for AI risk management.
- No evidence of PCI DSS or CSA STAR certifications found. Figma completed CAIQ but this is a self-assessment, not a full certification.
// At a glance
Pricing model
Freemium: Starter (free), Professional, Organization, Enterprise (custom). Content training opt-out/opt-in varies by tier.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Figma, Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-07. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
compliance.figma.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.