Figma vs Penpot

Figma

Team libraries published across teams, shared colour, text, grid and effect styles, and an agent that builds full component sets on our real tokens and variables — with variants for sizes, states and themes — give me the design-system backbone a twelve-office brand needs. Versioned library releases, prototype transitions and conditional logic, token export in a documented format and in-editor accessibility checks are not described on the pages we read, which keeps it below the top band.

Penpot

Components are published as libraries shared and synced across the team, with variants, built-in design tokens covering colour, typography and spacing with themes, CSS Grid and Flex layouts, and prototypes with transitions, overlays and branching flows — a design system genuinely managed in the tool. For the top level I would want token export in a documented format, per-component usage analytics and contrast checks in the editor, and the pages show contrast checking only through a community Colour Contrast plugin.

Figma

Free viewers can comment with mentions and even copy CSS, iOS and Android code and export assets, while Dev Mode is documented with code panels and, on Professional, an MCP server — handoff my developers can actually use. Version history with restore, branching before changes reach the main file and any audit log of access are not described on the captured pages, so it clears the middle band but not the governed one.

Penpot

Real-time co-editing, comments alongside code output in the inspect tab, sharing part or all of a file beyond the team, invitations with roles and permissions, and unlimited viewers on the free plan cover the working-together basics well. Developers get an inspect mode with real HTML, CSS and SVG output free of charge, a documented API with access tokens, plugins and an MCP server, plus autosave versions and file recovery windows. We found no public information on branching or review of changes before the main file, named integrations with issue trackers, or an audit log of access.

Figma

A central kit is there: shared libraries and fonts published across teams, shared colour and text styles, community templates, and an agent that turns a logo into colour palettes, typography pairings and brand assets. But the governance I run daily — locked templates non-designers can fill, brand guidelines published in the tool, licence and expiry metadata on every stock asset, approval workflows and asset versioning — is not described on any page we read, so my twelve offices would still be trusted to behave.

Penpot

Share Libraries put colours, typographies and components at any team member's fingertips for brand-specific designs, templates are browsable from a panel inside the app, libraries can be shared across the organisation, and community submissions pass a review before publication. Beyond that, I found no public information on locked templates that keep non-designers inside the rules, guidelines published in the tool, or any licence, owner and expiry metadata on assets — the first thing I need on every stock image my twelve offices touch.

Figma

The terms state that we retain all rights in our content and give a 30-day electronic retrieval window after termination, with deletion possible thereafter, and SVG, PNG and CSS export plus an export panel for marked assets is documented. An open or documented file format, bulk export of a team's files and an API that reads full file structure are not described on the captured pages, and the privacy policy states processing and storage in the United States.

Penpot

The terms name the customer as sole owner of uploaded content, files are based on open standards (SVG, CSS and HTML) with an open.penpot format, single files can be downloaded, and a Figma exporter sits in their GitHub repository. Self-hosting is documented to an unusual depth — Docker, Kubernetes with a Helm chart, OpenShift, Rancher, TrueNAS, Elestio, even air-gapped — with self-hosted deployments continuing to run and data access maintained through the open-source licence. We found no public information on round-trip export without loss, and the terms put backup and reconstruction squarely on the customer.

Figma

The AI terms answer my first two questions: customer content trains the models only while the Content Training toggle is on in admin settings, and input and output remain customer content in which we retain all right, title and interest — which is what lets a generated image go on a trade-fair stand, at our own risk, since Figma warrants nothing about the output and accepts no liability for its use. We found no public information on which models or providers run the AI features, where they process, content labelling, per-asset stock licences or any indemnity.

Penpot

AI appears as an open MCP server, the promise to integrate any agent, any LLM and any AI tooling, and community plugins such as Rapid Prototyping with AI by ramby.ai, which turns a text description into shapes on a fine-tuned OpenAI model with no guarantee. On my trade-fair question — may a generated image be used commercially — I found no public statement on output rights, training on customer files, or admin controls over AI features; the privacy policy only says metadata, not file contents, is analysed. All AI rights questions land on third-party plugin terms rather than on the vendor.

Figma

The terms are entered with Figma, Inc. under California law with San Francisco venue, and the privacy policy states that all personal information is transferred to, processed and stored in the United States, where the headquarters and main servers are, with no EU residency option stated. A published data processing addendum with Standard Contractual Clauses and a Berlin imprint entity soften this slightly, but we found no public information confirming EU hosting, an EU contracting option, or the locations of the named sub-processors.

Penpot

The contracting entity is proven European — Kaleidos Subsidiary S.L., Max Aub 5, Madrid, tax ID B24967721 — with Spanish governing law, Madrid courts, a published data processing agreement, and hosting regions including EU to choose from. Self-hosting on private cloud, on-premise or air-gapped infrastructure gives full control over where design data lives. We found no public information on the named infrastructure behind the EU region, subprocessor locations (Google Analytics and PostHog appear with purposes only), or where AI features are processed.

Figma

Every plan and seat type is priced publicly — Starter free, and Professional, Organization and Enterprise each with full, dev and collab seats and their monthly AI credit allowances — alongside free viewers who comment without a seat, daily proration and quarterly invoicing for added seats, and Governance+ admin and compliance tools named as Enterprise-only. Taxes are stated as excluded from fees, and both credit purchase options, their monthly expiry and the 30-day price-change notice are published, though the per-credit pay-as-you-go rate itself did not appear on the pages we read.

Penpot

Prices are public and in USD — Professional at $0 user/month, Unlimited at $7 editor/month with a cap on $175 per month no matter the team size, Enterprise at $25 member/month, Private Server at $50k year — with storage, team-size and viewer limits, autosave version windows, self-hosting sizing guidance and self-host support plans all stated. Single sign-on and IP whitelisting are tied to Enterprise, cancellation is immediate per the terms, and non-profit, education and open-source discounts are signposted. We found no public information on VAT treatment or on how and when added seats are billed.