Privacy facts at a glance
- Jurisdictions
- US · EU · Canada · Philippines · Germany · Belgium · Netherlands · Spain · Singapore · Israel · UK · Indonesia · Malaysia · Australia · India · Brazil
- Subprocessors
- 40
- Retention
- At the end of providing the Figma Platform to Customer, Figma will delete or return all Customer Content within thirty (30) days.
- Breach notification
- Figma must notify Customer without undue delay and, where feasible, within 72 hours after becoming aware of a security breach involving Customer Content.
- Transfer mechanism
- Transfer impact assessments and appropriate transfer mechanisms are in place for cross-border transfers; specific mechanism (e.g., SCCs) not explicitly named in excerpts.
- DPA available
- Yes
- Certifications
- SOC 2 Type 2 · SOC 3 · ISO 27001 · ISO 27017 · ISO 27018 · ISO 27701 · EU Cloud Code of Conduct · C5 · TISAX · CSA CAIQ · FedRAMP
- GDPR addressed
- Yes
Named subprocessors
Amazon Web Services, Inc.
Cloudflare, Ltd.
Datadog, Inc.
Functional Software, Inc. (Sentry)
Snowflake, Inc.
Twilio, Inc. (Segment)
Anthropic PBC
OpenAI, LLC
Google LLC (Vertex)
Microsoft Corporation (Azure)
Zendesk, Inc.
Intercom, Inc.
Tracked documents
Recent changes
Public summary; per-account review history visible to subscribers tracking this vendor.
Track Figma in your workspace.
Get notified when Figma adds a subprocessor, changes retention, updates their DPA, or quietly amends their privacy posture.
Start tracking — 14-day trialNo card required.