Skip to content
Docs

Security & infrastructure

How Figure protects your borrowers' data, your branded sites, and the APIs you call.

View as Markdown
On this page· 3 sections

Figure is ISO 27001 certified and SOC 2 compliant, and we routinely undergo third-party audits and penetration testing. The Trust Center has the reports and details behind all of it.

Figure Trust Center

Everything your security and compliance teams need to review Figure, in one place.

Visit the Trust Center
  • ISO 27001:2022
  • SOC 2 Type 2
  • SOC 3
  • CCPA

  • Compliance reports

    Our ISO 27001 certificate and SOC 2 Type 2 and SOC 3 reports.

  • Security controls

    Live status of our controls, policies, and penetration test summaries.

  • Subprocessors

    The vendors that process data for us, like Google Cloud Platform.

Some reports need you to request access on the Trust Center first. Questions? Email security@figure.com.

The Trust Center covers the vendors Figure uses to run its platform. For the services that run in your borrowers' browsers on your sites, and the cookies they set, see Third parties & cookies.

How we protect your traffic#

Every call to a Figure API and every visit to your Figure-hosted sites goes through the same protected edge before it reaches our services.

  • DDoS protection and a web application firewall. Google Cloud Armor absorbs denial-of-service attacks and filters malicious requests at Google's edge.
  • Your domains get the same protection. Your branded subdomains point at Figure with CNAME records, so borrower traffic on a domain like loans.partnerbank.com is covered by Cloud Armor and Figure-managed certificates, with nothing for you to run or renew.
  • Encryption in transit and in the payload. All traffic uses TLS, and API requests that carry borrower data are also encrypted with JWE.
  • Known addresses. Calls from Figure to your systems come from published IP ranges, so you can allow-list them.

Speed and scalability#

Figure runs on Google Cloud's global network of data centers. Google Cloud CDN serves content from close to your borrowers, and Google Cloud Load Balancing spreads traffic evenly across our servers.

Report a vulnerability#

We encourage researchers to report security vulnerabilities through our Vulnerability Disclosure Program.