---
title: Security & infrastructure
description: How Figure protects your borrowers' data, your branded sites, and the APIs you call.
---

Figure is ISO 27001 certified and SOC 2 compliant, and we routinely undergo third-party audits and penetration testing. The Trust Center has the reports and details behind all of it.

{% trust-center /%}

The Trust Center covers the vendors Figure uses to run its platform. For the services that run in your borrowers' browsers on your sites, and the cookies they set, see [Third parties & cookies](/third-parties).

## How we protect your traffic

Every call to a Figure API and every visit to your Figure-hosted sites goes through the same protected edge before it reaches our services.

- **DDoS protection and a web application firewall.** [Google Cloud Armor](https://cloud.google.com/security/products/armor) absorbs denial-of-service attacks and filters malicious requests at Google's edge.
- **Your domains get the same protection.** Your branded subdomains point at Figure with [CNAME records](/partner-onboarding/domain-configuration), so borrower traffic on a domain like `loans.partnerbank.com` is covered by Cloud Armor and Figure-managed certificates, with nothing for you to run or renew.
- **Encryption in transit and in the payload.** All traffic uses TLS, and API requests that carry borrower data are also [encrypted with JWE](/jwe-data-protection/intro).
- **Known addresses.** Calls from Figure to your systems come from [published IP ranges](/ips), so you can allow-list them.

## Speed and scalability

Figure runs on Google Cloud's global network of data centers. Google Cloud CDN serves content from close to your borrowers, and Google Cloud Load Balancing spreads traffic evenly across our servers.

## Report a vulnerability

We encourage researchers to report security vulnerabilities through our [Vulnerability Disclosure Program](https://vdp.figure.com).