Data

Figma and the GDPR: AI training, data location and DPA

Professional: Trains on your data unless you switch it off. EU hosting only on higher plans · DPA on request.

Vendor: Figma, Inc.Design, images and videoChecked on How we check

Verdict

Is Figma GDPR compliant?

Professional

Business

Trains on your data unless you switch it off

EU hosting only on higher plans · DPA on request

Price: €16 / mo

No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.

Training

Does Figma train on your data?

Trains on your data by default?

Checked

Trains on your data unless you switch it off.

Yes. On Starter and Professional, content training is on by default: Figma may use customer content, de-identified and aggregated, to train its AI models until an admin turns it off

Source: figma.comSection 'Managing AI settings'Second source: figma.comChecked on

Switch-off

How do you turn off AI training in Figma?

How to switch training off

Checked

You can switch the training off.

Yes. A team admin turns off the Content training setting; new content and edits after that date are not used, but earlier content may already have been used

Source: figma.comSections 'Training Figma AI' and 'Controlling AI Settings' (effective 24 Jun 2026)Second source: figma.comChecked on

Location

Where does Figma store your data?

Where data is stored by default

Checked

United States (AWS); a different hosting location can only be selected on Enterprise plans

Source: figma.comRow 'Amazon Web Services, Inc.' ('United States (or, for Enterprise plans, the hosting location selected)')Checked on

EU hosting on this plan

Checked

EU hosting only on higher plans.

Not on Professional: choosing the hosting location is only for Enterprise plans

Source: figma.comRow 'Amazon Web Services, Inc.'Checked on

Contract

Does Figma sign a data processing agreement?

Data processing agreement (DPA)

Checked

DPA on request.

Yes. Figma's DPA (last updated 30 Mar 2026) forms part of the agreement covering use of the Figma Platform

Source: figma.comOpening paragraphChecked on

Processors

Who else handles Figma data?

Sub-processors (companies that handle the data for them)

Checked

52 listed.

Public. 52 rows: 15 hosting and infrastructure, 9 AI model providers (including Anthropic, OpenAI, Google, Microsoft and AWS), 15 for the Figma Weave AI product, 13 for support; plus 15 Figma companies; nearly all in the US

Source: figma.comPage 'Figma Sub-processors' (last updated 22 Sep 2026)Second source: figma.comChecked on

Retention

How long does Figma keep your data?

How long data is kept

Checked

Customer content is kept for the term; at the end, Figma deletes or returns it within 30 days at the customer's choice

Source: figma.comSection 5 'Deletion and Return of Customer Personal Data'Checked on

Security

Which certifications and admin controls does Figma have?

Security certifications

Checked

SOC 2 Type 2 and SOC 3; ISO/IEC 27001:2022, 27017, 27018:2019, 27701 and 42001; BSI C5; TISAX; EU Cloud Code of Conduct; CSA; FedRAMP Authorized

Source: figma.comCompliance sectionsChecked on

Admin controls for AI

Checked

Partly: admins can turn off content training, but the switch that turned AI features off was removed on 24 Jul 2025 except on Enterprise (teams that turned AI off during the beta stay off)

Source: figma.comSection 'Managing AI settings' (paragraph on the beta setting)Checked on

Price

What does Figma cost?

Price, as shown in Germany

Checked

€16 / mo.

EUR 16 per full seat/month billed annually, including 3,000 AI credits a month; VAT basis not stated

Source: figma.comPlan card 'Professional' with 'Annual' selectedChecked on

Alternatives

Figma alternatives that don't train on your data

Other design, images and video tools whose business plan doesn't train on your data and includes a DPA.

The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.

Tool · PlanVerdictYour five rules
  • Canva

    Business · €170 / user / yr

    Doesn't train on your dataEU hosting only on higher plans · DPA on request

    ✓✕✓✓✓

  • remove.bg

    monthly subscription · See details

    Doesn't train on your dataEU hosting not documented · DPA in the terms

    ✓?✓✓✓

  • Synthesia

    Pro · $89 / mo

    Doesn't train on your dataNo EU hosting · DPA on request

    ✓✕✓✓✓

  • VEED

    Business · See details

    Doesn't train on your dataData in the EU by default · DPA in the terms

    ✓✓✓?✓

  • Gamma

    Business · €35 / user / mo

    Doesn't train on your dataEU hosting not documented · DPA in the terms

    ✓?✓✓✕

If no plan gives you the training default or data location you need, the tool may not be the right fit. We design and build what your team is missing around your own rules, and keep it running after launch.

See what we build

Need something your tools can't do?

We design and build what your team is missing, around the way you already work and the data rules you set.

Book a callServices