The Figma plugin is run directly from Figma's own servers, and runs inside of a your Figma file, which means that it inherits all of the security and infrastructure of the Figma platform, which exceed industry standards for data protection and security:

• SOC 2 Type 2
• SOC 3
• Cloud Security Alliance (CSA) STAR: Level 1
• ISO/IEC 27001:2013
• ISO/IEC 27018:2019
• EU Cloud Code of Conduct (COC): Level 2

There's no additional software that needs to be installed to use the Figma plugin, as Figma plugins run as a built-in part of Figma's own native functionality, and all Figma plugins easily accessibile and can be instantly run from inside any Figma file, or via the official Figma Community ecosystem inside of the Figma app.

If your organization is already approved to use Figma, then you already have access to Figma plugins.

How Pitchdeck works

The Pitchdeck Figma plugin helps users turn their Figma frames into a slide deck.

Pitchdeck is designed to be privacy and security focused, so any "Share" URLs that are generated are password protected by default, and encrypt image uploads with AES-256.

Any uploads and cloud storage services used by the Pitchdeck Plugin and Pitchdeck Web App are hosted on Google Cloud (the same infrastructure that Google hosts all of its own products with), via Google Firebase.

As per the Privacy and Security in Firebase, all Firebase services (aside from App Indexing) have successfully completed the ISO 27001 and SOC 1, SOC 2, and SOC 3 evaluation process, and some have also completed the ISO 27017 and ISO 27018 certification process.

What Pitchdeck does and doesn't do

Pitchdeck uses the Figma Plugins API to export Figma design to presentations and create a password-protected URL that you can share with any stakeholders for viewing outside of the Figma app, or you can also download the presentation directly to your computer as PPTX or PDF file.

Pitchdeck does

• Allow users to optionally generate password protected URLs to share presentations with their stakeholders (without needing a Figma account).
• Encrypt image uploads with AES-256.
• Log anonymous visit analytics (for your own use) for presentations uploaded to the Pitchdeck Web App, and analytics can optionally be turned off per custom share link if needed.
• Allow users to export their presentation designs from Figma to a PDF file.
• Allow users to export their presentation designs from Figma to a PPTX file.
• Automatically deletes URL/uploads if not accessed for 180 days.
• Download any exported PDF and PPTX files directly to the user's computer.

Pitchdeck does not

• Make any password-protected "Uploaded" URLs created via the plugin publicly accessible or indexed by any search engines.
• Collect or store any personal information (Figma plugins cannot access any private information about Figma projects, Figma teams or Figma users).

How Figma plugins work

Figma plugins are written in HTML/CSS/Javascript, and are run in a tightly controlled sandbox environment inside of the main Figma application.

Figma plugins can only do whatever Figma allows them to do inside the permissions of the Figma Plugins API, and importantly, plugins don't have any access to personal information about the Figma user running the plugin.

What Figma plugins can and can't do

As per the article on Figma plugin security, there are a limited number of things that Figma plugins can do, and many more things that they can't do:

Figma plugins can

• Only be run by an explicit user action
• Show UI in a single plugin-specific dialog
• Read any data in your Figma document (e.g. a “find layer by name” plugin)
• Modify any data in your Figma document (e.g. a “rename selected layers” plugin)
• Communicate with any server over the internet (e.g. an “import from service X” plugin)

Figma plugins cannot

• Run by themselves
• Get information about the project or team that owns the file
• Access anything when they aren’t running
• Access data from any files other than the file they were run in
• Change Figma’s UI outside of the plugin UI dialog