Emailify Security

Emailify runs as an official plugin inside of Figma's own app, which are reviewed and approved by the Figma team.

The Figma plugin is run directly from Figma's own servers, and runs inside of a your Figma file, which means that it inherits all of the security and infrastructure of the Figma platform, which exceed industry standards for data protection and security:

  • SOC 2 Type 2
  • SOC 3
  • Cloud Security Alliance (CSA) STAR: Level 1
  • ISO/IEC 27001:2013
  • ISO/IEC 27018:2019
  • EU Cloud Code of Conduct (COC): Level 2

There's no additional software that needs to be installed to use the Figma plugin, as Figma plugins run as a built-in part of Figma's own native functionality, and all Figma plugins Accessibile and can be instantly run from inside any Figma file, or via the official Figma Community ecosystem inside of the Figma app.

If your organization is already approved to use Figma, then you already have access to Figma plugins.

How Emailify works ​

The Emailify Figma plugin helps users design and export production ready HTML from Figma.

Standard Emailify design, preview, code generation, and local export processing happens inside the Figma plugin. Data leaves the plugin only when you choose an optional network feature, such as a built-in email-platform integration, automatic image hosting, or a webhook.

If you decide to use a built-in platform integration or automatic image hosting, image assets may be stored and linked via the Backblaze B2 storage CDN service.

What Emailify does and doesn't do ​

Emailify uses the Figma Plugins API to help users compress their images, and download them directly to their computer.

Emailify doesn't rely on an external server for its standard local image-compression and code-generation paths. Optional upload, platform, webhook, AI, and localization workflows have their own network boundaries and run only when you choose them.

Files created by Emailify's standard local export workflows are generated directly in the plugin and downloaded to the user's own computer.

Emailify does ​

  • Allow users to design emails in Figma via tools in the plugin.
  • Allow users to export their Figma designs to HTML, and download them directly to your computer.
  • Allow users to optionally upload their exported HTML emails to their own email marketing platform account (for example, MailChimp, Klaviyo, Salesforce, etc) directly via their official APIs.
  • Allow users to optionally automatically host the images in their emails.
  • Allow users to generate PDF previews from their email designs.
  • Download any exported files directly to the user's computer.

Emailify does not ​

  • Upload HTML or image data from your Figma file during standard local design and export processing. Optional email-platform, image-hosting, webhook, AI, and localization features send only the data required for the workflow you choose.
  • Store HTML or images from standard local exports. Optional hosting workflows can store submitted assets in their respective services.
  • Use cloud storage for standard local exports. Optional image-hosting workflows can use cloud storage to make assets available to the selected destination.
  • Read unrelated Figma files, private team data, or document content outside the file and workflows made available to the running plugin.

How Figma plugins work ​

Figma plugins are written in HTML/CSS/Javascript, and are run in a tightly controlled sandbox environment inside of the main Figma application.

Figma plugins can only do whatever Figma allows them to do inside the permissions of the Figma Plugins API, and importantly, plugins don't have any access to personal information about the Figma user running the plugin.

What Figma plugins can and can't do ​

As per the article on Figma plugin security, there are a limited number of things that Figma plugins can do, and many more things that they can't do:

Figma plugins can ​

  • Only be run by an explicit user action
  • Show UI in a single plugin-specific dialog
  • Read any data in your Figma document (for example, a “find layer by name” plugin)
  • Modify any data in your Figma document (for example, a “rename selected layers” plugin)
  • Communicate with any server over the internet (for example, an “import from service X” plugin)

Figma plugins cannot ​

  • Run by themselves
  • Get information about the project or team that owns the file
  • Access anything when they aren’t running
  • Access data from any files other than the file they were run in
  • Change Figma’s UI outside of the plugin UI dialog

Figma account administrators at your company can configure an allowlist of plugins that are allowed inside the organization. This can be used to prevent untrusted Figma plugins from being run in any file in that organization.