Is Figma AI safe for work?
Low risk · 16Figma · Design · facts (high-confidence)
Figma AI is low-risk for default at-work use (16/100): it trains on your data unless you opt out, and holds SOC 2 Type II.
16
Low risk
Watch out: Figma holds SOC 2 Type II and ISO 27001, and content training defaults off on Organization and Enterprise (on for Starter and Professional unless an admin turns it off). The gap is HIPAA: the AUP bars PHI and no BAA is offered.
Data and compliance facts
- Trains on consumer-tier data
- Opt-out
- Trains on business-tier data
- No
- Training opt-out available
- Yes
- SOC 2 Type II
- Yes
- ISO 27001
- Yes
- ISO 42001 (AI management)
- Unverified
- GDPR Data Processing Addendum
- Yes
- HIPAA BAA
- Unverified
- EU data residency
- Yes
- SSO / SAML
- Yes
- Data retention
- No fixed window for AI inputs and outputs (third-party model providers store data temporarily or not at all); customer content deleted or returned within 30 days of contract termination.
- Safer tier
- Enterprise (content training off by default, EU residency, SSO and SCIM, governance controls); Organization also defaults training off
Why it scores 16 out of 100
- +16Trains on your data. Training is on by default on the consumer tier; you must find and set the opt-out.