Figma Subprocessors List (September 2026): Changes and History
Figma names 61 subprocessors on its published list. Read from the vendor's own page and re-checked daily.
Last checked September 26, 2026
Official source ↗
Figma subprocessors (September 2026)
| # | Subprocessor | Purpose | Location | Data |
|---|---|---|---|---|
| 1 | Agora, Inc. | In product audio conference and speech to text transcription features | United States | Customer-provided audio content |
| 2 | Amazon Web Services, Inc. | Cloud infrastructure provider | United States (or, for Enterprise plans, the hosting location selected) | Customer Content |
| 3 | Amazon Web Services, Inc. (Bedrock) | Content moderation and safety filtering | United States | Prompt Inputs and Outputs |
| 4 | Automattic Inc. (Akismet) | Content moderation and safety filtering | United States | Prompt Inputs and Outputs |
| 5 | Cloudflare, Ltd. | Web infrastructure | United States | Identifiers associated with Customer accounts and their authorized users (such as name, email address, user ID, IP address) (“Authorized User Data”) |
| 6 | Cloudinary | Cloud Infrastructure Provider | United States | Customer Content containing Image and Video |
| 7 | Datadog, Inc. | Infrastructure monitoring and debugging | United States | Customer Content |
| 8 | Digital Ocean | Ephemeral Processing | United States | Customer Content |
| 9 | Functional Software, Inc. (Sentry) | Application error tracking and monitoring | United States | Customer Content |
| 10 | Castle Global, Inc (Hive) | Content moderation and safety filtering | United States | Media in resources & comments published to Community. Figma AI & Figma Weave Prompt Inputs & Outputs. |
| 11 | Modal Labs, Inc. | Cloud infrastructure provider for customer sandbox environments | United States | Customer prompt inputs and resulting model outputs (“Prompt Inputs and Outputs”) |
| 12 | OpenAI, LLC | Content moderation and safety filtering | United States | Prompt Inputs and Outputs |
| 13 | Snowflake, Inc. | Cloud-based data warehouse | United States | Customer Content |
| 14 | Twilio, Inc. (Segment) | Data analytics | United States | Authorized User Data |
| 15 | Twilio, Inc. | Identity management | United States | Authorized User Data |
| 16 | Anthropic PBC | AI model provider | United States* | Prompt Inputs and Outputs |
| 17 | Cerebras Systems, Inc. | AI model provider | United States* | Prompt Inputs and Outputs |
| 18 | Fireworks.ai, Inc. | AI model provider | United States* | Prompt Inputs and Outputs |
| 19 | Google LLC (Vertex) | AI model provider | United States* | Prompt Inputs and Outputs |
| 20 | Jasper AI, Inc. | AI model provider | United States* | Prompt Inputs and Outputs |
| 21 | Microsoft Corporation (Azure) | AI model provider | United States* | Prompt Inputs and Outputs |
| 22 | Recraft, Inc. | AI model provider | United States* | Prompt Inputs and Outputs |
| 23 | Bria Artificial Intelligence Ltd | Selectable AI model provider | United States | Prompt Inputs and Outputs |
| 24 | BytePlus Sdn. Bhd. | Selectable AI model provider | EU, Indonesia, Malaysia | Prompt Inputs and Outputs |
| 25 | Create Without Limits Technologies Inc. (dba Enhancor) | Selectable AI model provider | EU, Indonesia, Malaysia | Prompt Inputs and Outputs |
| 26 | Eleven Labs Inc. | Selectable AI model provider | United States | Prompt Inputs and Outputs |
| 27 | Features & Labels, Inc. (FAL) | Platform hosting; Selectable AI model provider | United States | Prompt Inputs and Outputs |
| 28 | Freepik, Inc. | Selectable AI model provider | Belgium, Netherlands, Spain | Prompt Inputs and Outputs |
| 29 | Google LLC | AI model provider | United States | Prompt Inputs and Outputs |
| 30 | Kling AI Pte. Ltd. | Selectable AI model provider | Singapore | Prompt Inputs and Outputs |
| 31 | Lightricks Ltda AI, Inc. | Selectable AI model provider | EU, Israel, United Kingdom, United States | Prompt Inputs and Outputs |
| 32 | Luma AI, Inc. | Selectable AI model provider | United States | Prompt Inputs and Outputs |
| 33 | Replicate LLC | Selectable AI model provider | United States | Prompt Inputs and Outputs |
| 34 | Runway AI, Inc. | Selectable AI model provider | United States | Prompt Inputs and Outputs |
| 35 | World Labs Technologies, Inc. | Selectable AI model provider | United States | Prompt Inputs and Outputs |
| 36 | Decagon AI, Inc. | Self-serve automation for customer support inquiries | United States | Requester identity information |
| 37 | Gainsight, Inc. | Public support forum hosting (https://forum.figma.com/) | United States | Requester identity information |
| 38 | Google LLC (Firebase) | Customer push notifications on mobile apps | United States | Recipient identity information |
| 39 | Hex, Inc | Data analytics for support issues | United States | Requester identity information |
| 40 | Intercom, Inc. | Customer service and technical support | United States | Requester identity information |
| 41 | IntouchCX, Inc. | Customer service and technical support | Canada, The Philippines | Requester identity information |
| 42 | PostHog, Inc. | Customer support data analytics | Germany | Requester identity information |
| 43 | Premier Talent Partners | Customer service and technical support | United States | Requester identity information |
| 44 | Pylon Labs, Inc | Customer service and technical support | United States | Requester identity information |
| 45 | SendGrid, Inc. | Customer email notifications | United States | Recipient identity information |
| 46 | Sprinklr, Inc. | Customer service and technical support | United States | Requester identity information |
| 47 | Zendesk, Inc. | Customer service and technical support | United States | Requester identity information |
| 48 | Figma Australia Pty Ltd | — | Australia | — |
| 49 | FIGMA BRASIL LTDA. | — | Brazil | — |
| 50 | Figma Canada Ltd. | — | Canada | — |
| 51 | Figma France SAS | — | France | — |
| 52 | Figma GmbH | — | Germany | — |
| 53 | Figma India Private | — | India | — |
| 54 | Figma International LLC | — | United States, New Zealand | — |
| 55 | Figma Ireland Limited | — | Ireland | — |
| 56 | Figma Japan K.K | — | Japan | — |
| 57 | Figma Singapore Pte. Limited | — | Singapore | — |
| 58 | Figma Korea Ltd. | — | South Korea | — |
| 59 | Vmlapp Sweden AB | — | Sweden | — |
| 60 | Weavy AI Ltd | — | Israel | — |
| 61 | Figma UK Limited | — | United Kingdom | — |
Get an email when Figma changes its subprocessors
ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.
AI and customer data at Figma
What Figma's own documents say, with the sentence each answer comes from.
- Trains AI models on customer data
-
Yes, unless you opt out
“When "Content Training" is toggled on within Customer's administrative user settings, Figma may use Customer Content to maintain, improve, and enhance Figma's products and services by training machine learning and artificial intelligence algorithms and models.”
AI terms, www.figma.com ↗ - Sends customer data to AI model providers
-
Yes
“To service providers Figma uses to provide the Services, including, where AI services are available and enabled, service providers that provide AI services.”
Privacy policy, www.figma.com ↗ - How to opt out
-
Administrative users can toggle 'Content Training' on or off in their organization's settings to control whether Customer Content is used to train Figma's AI models.
“If Customer's "Content Training" toggle is on and an administrative user later toggles it off, new Customer Content and edits added after the date the toggle was turned off will not be used to train AI models.”
AI terms, www.figma.com ↗
Key DPA terms at Figma
What Figma's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?
- Breach notification
-
Within 72 hours
“Figma must notify Customer without undue delay and, where feasible, within 72 hours after becoming aware of a breach of security”
DPA, www.figma.com ↗ - Notice of a new subprocessor
-
15 days ahead
“At least fifteen (15) days before a new Sub-processor begins processing Customer Content, Figma will add the Sub-processor to its sub-processor list”
DPA, www.figma.com ↗ - Transfers outside the EU
-
Standard contractual clauses and the EU–US Data Privacy Framework
“The EU Standard Contractual Clauses ("EU SCCs") will apply to Personal Data in Customer Content that is transferred from the European Economic Area”
“Figma certifies compliance with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework program”
DPA, www.figma.com ↗ - Customer data after the contract ends
-
Deleted within 30 days of the contract ending
“Figma will, as directed by Customer and at Customer's option, delete or return all Customer Content within thirty (30) days”
DPA, www.figma.com ↗ - Audit rights
-
Once a year
“limited to once per year (unless required by a regulator or government authority)”
DPA, www.figma.com ↗
Documents we track for Figma
- AI terms
- checked September 26, 2026 www.figma.com ↗
- DPA
- checked September 26, 2026 www.figma.com ↗
- Privacy policy
- checked September 26, 2026 www.figma.com ↗
- Subprocessor list
- checked September 26, 2026 www.figma.com ↗
- Terms of service
- checked September 26, 2026 www.figma.com ↗
Change history
Tracking since September 26, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.
Figma subprocessors FAQ
- How many subprocessors does Figma use?
- Figma lists 61 subprocessors on its published list, including Agora, Inc., Amazon Web Services, Inc., Amazon Web Services, Inc. (Bedrock), Automattic Inc. (Akismet), and Cloudflare, Ltd. and 56 more.
- Where does Figma process customer data?
- The subprocessors named by Figma are located in United States, United States*, EU, Canada, Germany, and Indonesia and 20 other locations, as stated on its list.
- Does Figma use customer data to train AI models?
- According to its AI terms, Figma uses customer data to train AI models unless customers opt out: “When "Content Training" is toggled on within Customer's administrative user settings, Figma may use Customer Content to maintain, improve, and enhance Figma's products and services by training machine learning and artificial intelligence algorithms and models.”
- How quickly does Figma report a personal data breach to customers?
- According to its DPA, Figma reports a personal data breach to customers within 72 hours: “Figma must notify Customer without undue delay and, where feasible, within 72 hours after becoming aware of a breach of security”
- How much notice does Figma give before adding a subprocessor?
- Figma's DPA gives 15 days' notice of a new subprocessor, the time customers have to object: “At least fifteen (15) days before a new Sub-processor begins processing Customer Content, Figma will add the Sub-processor to its sub-processor list”
- How does Figma transfer personal data outside the EU?
- Figma's DPA relies on standard contractual clauses and the EU–US Data Privacy Framework: “The EU Standard Contractual Clauses ("EU SCCs") will apply to Personal Data in Customer Content that is transferred from the European Economic Area”
- When was Figma's subprocessor list last checked?
- ClauseTrail last checked Figma's subprocessor list on September 26, 2026. Lists are re-checked daily.
- How do I find out when Figma adds or removes a subprocessor?
- ClauseTrail monitors Figma's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.