Security & data handling
This page is for the people who have to approve Ticket Sync before a team can use it. It describes how the plugin handles credentials and ticket data, and what runs where. For the legal version, see the Privacy Policy.
How it works
Figma plugins run in a sandboxed iframe that cannot call external APIs directly, because the browser's CORS rules block it. Ticket Sync therefore sends its requests through a small proxy service, which forwards them to your ticket tool and returns the response to the plugin.
Your ticket data
- Not stored. Ticket content is held in memory for the duration of a request and forwarded to Figma. There is no database of ticket data, no cache and no backup of it.
- Not analysed. There is no analytics, telemetry, tracking or profiling in the plugin - no third-party SDKs of any kind. The interface loads no third-party content either; even the typeface is bundled into the plugin rather than fetched from a font host.
- Encrypted in transit. Every hop, from the plugin to the proxy and from the proxy to your ticket tool, is HTTPS only.
- Visible in the file. Synced ticket content is written into your Figma file as plain text, so it is visible to everyone with access to that file.
Your credentials
- Access is granted through your tool's own OAuth consent screen, or an API token you create yourself. The plugin never asks for your password.
-
The resulting token is stored on your device in Figma's plugin storage
(
clientStorage), which is scoped to your Figma account and this plugin. It is not written into the design file, so sharing or exporting a Figma file never exposes it. - During the connection handshake the token passes through our database so the plugin can pick it up. It is deleted the moment the plugin collects it, and a scheduled job removes anything older than five minutes.
- The token is sent with each request so your tool can authenticate you. The proxy does not log request headers.
- Disconnecting in the plugin's settings deletes the token from your device.
The proxy
- Each request is rebuilt from scratch on the server before it is sent. Only the URL, method, body and a fixed list of headers survive, so a manipulated client cannot smuggle in other request options.
- Only HTTPS targets are accepted - a plaintext address is rejected outright - and redirects are not followed.
- Requests time out after 15 seconds.
- Only GET, POST and PUT are permitted. The plugin reads your tickets; the only thing it writes back is a link to your Figma file, when you ask it to.
Access control
- The database is not reachable from any client. All access goes through our server code, and the database rules deny direct reads and writes outright.
- OAuth client credentials are held in Google Secret Manager, not in source control or configuration files.
- The plugin is distributed only through the Figma Community, where each release is reviewed by Figma before it goes out.
Where things run
| Component | Provider | Region |
|---|---|---|
| Proxy service | Google Cloud Functions | USA (us-central1) |
| License and connection database | Firebase Realtime Database | EU (europe-west1, Belgium) |
| Website | Firebase Hosting | Global CDN |
| Payments | Paddle.com Market Limited (merchant of record) | United Kingdom |
Permissions the plugin requests
In Figma, the plugin requests access to the current user's identifier, which is used only to check whether a Pro license applies. In your ticket tool, it requests read access to issues and, where you enable the feature, permission to add a link to the ticket. It never requests administrative scopes.
Data processing agreement
Ticket content can contain personal data about your colleagues. For that content your organisation is the controller and we act as a processor. If you need a data processing agreement under Art. 28 GDPR before rolling the plugin out, write to lukas.ticketsync@gmail.com and we will send one.
Reporting a vulnerability
If you find a security issue, please email lukas.ticketsync@gmail.com with enough detail to reproduce it. Reports are acknowledged within three working days. Please give us a reasonable window to fix the issue before disclosing it publicly. Ticket Sync is run by one person, so there is no bug bounty - but genuine reports are taken seriously and credited if you would like that.
Compliance
Ticket Sync is an independent tool and holds no formal attestation such as SOC 2, ISO 27001 or HIPAA, and no Business Associate Agreement is offered. If your work involves regulated data - health, payment or comparable special categories - Ticket Sync is not the right tool for it.