Figma Plugin Security
Print for Figma runs as an official plugin embedded within Figma’s own application. All plugins, including Print for Figma, are reviewed and approved by the Figma team before being published. Because plugins run directly from Figma’s servers, they benefit from the additional layers of security that the Figma platform provides:- SOC 2 Type 2
- SOC 3
- Cloud Security Alliance (CSA) STAR: Level 1
- ISO/IEC 27001:2013
- ISO/IEC 27018:2019
- EU Cloud Code of Conduct (COC): Level 2
Plugins are third-party scripts or applications that extend the functionality of Figma design and FigJam. Plugins are only visible to the person who ran it and cannot be interacted with by other users in the same file.Figma plugins by default can access only the user ID and avatar of the user who runs the plugin, and only the layers in the file in which the plugin is opened. Further, none of this data can leave your Figma file unless it is sent to an approved network endpoint. These endpoints must be publicly displayed by the plugin developer for transparency. Network security is described in more detail in the Data section of this page.
- Source: Figma
| Figma plugins can ✅ | Figma plugins cannot ❌ |
|---|---|
| Only be run by an explicit user action | Run by themselves |
| Show UI in a single plugin-specific dialog | Access anything when they aren’t running |
| Read any data in your Figma document | Access data from any files other than the file they were run in |
| Modify any data in your Figma document | Access information about your organization. |
| Communicate with approved network endpoints | Change Figma’s UI outside of the plugin UI dialog |