Figma compliance, certifications and attestations

An auditor's report on security, availability, confidentiality, processing integrity and privacy controls.

Type IIVendor page

A public summary of a SOC 2 examination, readable without an NDA.

HeldVendor page

A certified information security management system.

HeldVendor page

Cloud-specific security controls on top of ISO 27001.

HeldVendor page

Protection of personal data in public clouds acting as processors.

HeldVendor page

A certified privacy information management system extending ISO 27001.

HeldVendor page

A certified AI management system: how a company governs the AI it builds or uses.

HeldVendor page

A listing in the CSA STAR for AI program.

Level 1CSA STAR RegistryAI-CAIQ

Authorization to sell a cloud service to US federal agencies.

ModerateFedRAMP MarketplaceFigma for Government

Self-certification under the EU-US Data Privacy Framework, with UK and Swiss extensions where noted.

HeldData Privacy Framework ListEU-US, UK extension, Swiss-US; non-HR data and HR data. Figma, Inc.

Adherence to the GDPR code of conduct for cloud processors.

HeldCSA STAR Registry and vendor pagePartner entry in the STAR Registry

A listing in the Cloud Security Alliance STAR Registry.

Level 1CSA STAR RegistryCAIQ

An attestation against Germany's Cloud Computing Compliance Criteria Catalogue.

HeldVendor page

An assessment shared through the German automotive industry's exchange.

HeldVendor page