Skip to main content

File Exchange

If you need to exchange files with Figure, whether that is one-way or bi-directional, we have a few options on how this can be done.

Partner-Hosted Storage Solution Required

Private Label Data Export files can only be delivered to a storage solution hosted by the partner. Figure does not host the storage solution for you. All reports are also available for download from Lead Portal.

Data Export files must be encrypted. Please see Data Encryption for more information.

Use this order for new integrations:

  1. Partner-hosted Google Cloud Storage (recommended)
  2. Partner-hosted AWS S3
  3. SFTP only if object storage is not an option

SFTP is not recommended. Google Cloud Storage and AWS S3 offer improved reliability and simpler lifecycle management.

For dataset sharing, keyless S3 access patterns, or other models still being expanded, see Other sharing options and contact us.

Direction of transfer​

Figure delivers files to you (for example Data Export): you host the destination. See Partner-hosted GCS, S3, or SFTP below.

You deliver files to Figure: we can host the destination (Figure-hosted GCS, S3, or SFTP), or you can grant us access to storage you host.

Google Cloud Storage​

Partner-hosted GCS bucket​

You provide a Google Cloud Storage bucket. Figure writes to it using a GCP service account.

Grant Figure access on the bucket (or a prefix). Use roles/storage.objectAdmin, or a tighter custom role that can create, list, and delete objects on that prefix. Figure will provide the service account email during onboarding.

The bucket must not be public.

What Figure needs from you​

  • Bucket name
  • Optional prefix / directory
  • Confirmation that the Figure service account is granted on the bucket (or prefix)

Figure-hosted GCS bucket​

Figure provides a bucket. You access it with a GCP service account your organization provides.

For more information about how to upload and download with Google Cloud Storage buckets, please visit the linked Google documentation.

What Figure needs from you​

  • The email address of your GCP service account

What you will need from Figure​

  • The name of the GCS bucket

AWS S3​

Partner-hosted S3 bucket​

You provide an S3 bucket. Figure writes to it using AWS credentials coordinated during onboarding.

What Figure needs from you​

  • Bucket name
  • Optional prefix / directory
  • AWS access credentials for that bucket (or a scoped IAM user / role that can write to it), exchanged through a secure channel — not email or tickets

Least-privilege on the bucket or prefix is preferred (s3:PutObject, s3:GetObject, s3:ListBucket, and s3:DeleteObject as needed).

Prefer GCS when you can

If your organization can host a GCS bucket, that path uses IAM grants instead of exchanging AWS access keys. See Partner-hosted GCS bucket.

If you need cross-account AssumeRole with an ExternalId, a bucket policy that grants a Figure principal without exchanging keys, or another keyless pattern, that is not the default self-serve path yet. See Other sharing options and contact us to discuss early adoption.

Figure-hosted S3 bucket​

Figure provides an S3 bucket. You access it with an IAM role or credentials that you provide.

For more information about how to upload and download with S3 buckets, please visit the linked AWS documentation.

What Figure needs from you​

  • The full ARN of your AWS role, or the credentials you will use to access the bucket

What you will need from Figure​

  • The name of the S3 bucket

File-exchange IP addresses​

Use these addresses if you allowlist Figure for file delivery (including SFTP). They are separate from the API egress ranges on Domains and IP addresses.

Test

34.74.146.222
35.243.240.143

Production

104.196.137.78
34.23.229.110

SFTP​

Partner-hosted SFTP​

You provide an SFTP server. Figure authenticates with a username and an SSH key (preferred).

What Figure needs from you​

  • Server hostname (e.g., sftp.partner.com or 172.168.10.1)
  • Username
  • Authentication: Figure will provide a public SSH key for you to install. Password authentication is a fallback only if your server cannot use SSH keys.
  • Destination directory (if desired)
  • Confirmation that the file-exchange IP addresses are allowlisted

Figure-hosted SFTP​

Figure provides an SFTP server that you access via username and SSH keys.

Figure's SFTP server is for delivering files to Figure only. Read access is not supported.

What Figure needs from you​

  • Your public SSH key
  • The IP address or range from which you will be accessing Figure's SFTP server

What you will need from Figure​

  • The SFTP server address, which is sftp.figure.com
  • The username assigned to your organization

Other sharing options​

The methods above are the standard path. The options below are on our roadmap or available by arrangement. Contact us if you want to be an early adopter:

  • Cross-account IAM role assumption with an ExternalId (your role trusts a Figure principal; short-lived credentials)
  • Granting a Figure AWS principal on your S3 bucket policy without exchanging long-lived access keys
  • Google Analytics Hub (BigQuery dataset sharing)
  • AWS Data Exchange

These are not self-serve on this page. Until arranged, use the standard GCS, S3, or SFTP setup above.

Environments and testing​

Figure has separate test and production file-exchange destinations. Do not mix test and production credentials, buckets, or allowlists.

For Data Export:

To validate an integration before go-live, use the test environment. If you need a sample file that matches the production schema with dummy data, ask your Figure contact or email partner-help@figure.com.

FAQ​

Does Figure need our AWS access keys?​

For the standard partner-hosted S3 path, yes — we coordinate AWS credentials during onboarding over a secure channel. Prefer partner-hosted GCS when you can avoid exchanging AWS keys. Keyless or AssumeRole-with-ExternalId patterns: contact us (early adopter).

Does Figure's uploader run in AWS? Does it use an execution role in our account?​

Figure's platform runs on Google Cloud. We do not run in your AWS account and do not use an execution role inside your account for the standard path.

Can Figure assume a role in our account using an ExternalId?​

Not as the default self-serve path today. If your security team requires AssumeRole with an ExternalId, contact us — we are expanding support and can discuss early adoption.

Do you currently support cross-account IAM role access instead of long-lived access keys?​

It is not the default documented path yet. Some partners have used role-based access by arrangement. If that is a requirement, contact us to be an early adopter. GCS remains the keyless-friendly recommended option.

What egress IP ranges does file delivery use?​

See File-exchange IP addresses. API traffic uses a different list: Domains and IP addresses.

Is there a non-production environment? Can you provide sample or dummy data?​

Yes. Test and production are separate. Data Export test files use a test_ prefix. For a schema-matched sample with dummy data, contact your Figure representative or partner-help@figure.com.

What is the expected file delivery cadence? Full snapshot or delta?​

For Data Export, Figure delivers full snapshots on a configurable schedule (default tables are on Data Export). Cadence for other file exchanges is agreed during onboarding.

Unsupported methods​

Figure does not currently support file transfers to Azure or via FTP(S).