Online Whiteboard
FigJam
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Figma, Inc. · www.figma.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
FigJam at a glance
- Vendor
- Figma, Inc.
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates FigJam 3/5, the mean of 6 judges. FigJam is Figma's whiteboard, from Figma, Inc. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
FigJam is Figma's whiteboard, from Figma, Inc. Its strongest judged area is canvas and content at 7, citing an infinite canvas, over 300 ready-made templates, pen and Apple Pencil input on iPad, and AI that sorts stickies into themes and summarises output into action items. Facilitation is the lowest band at 5-6: guests join by link for 24 hours without an account and boards run inside Teams and Zoom, but judges found no public information on an anonymous or private note mode, breakout areas or participant limits. Integrations and export holds at 6, with no public information found on a two-way Jira sync, webhooks or CSV export of notes. Sovereignty and security and deployment span 5-7 — the public-sector judge credited a published sub-processor list, SCCs and the EU Cloud Code of Conduct, while the skeptic weighed stated United States default processing, EU hosting confined to Enterprise, and a Content Training toggle whose default is not stated. Access and administration and pricing transparency range 6-7, with public euro seat prices from €3/mo but unpriced AI credits and unstated Starter limits.
Speaks for it
- Canvas and content scores reach 7, with over 300 ready-made templates plus the option to make your own and AI that summarises output into action items
- Guests join open sessions free for 24 hours with no account, and the board runs inside Microsoft Teams and Zoom
- SCIM provisioning with identity-provider role sync, delegated administration per workspace and an activity-logs REST API are documented
- A published data processing agreement with EU standard contractual clauses and a sub-processor list with locations and fifteen days' change notice is stated
- Per-seat euro prices are public from a Collab seat at €3/mo to an Enterprise Full seat at €90/mo, with free viewers on paid plans
Held against it
- Personal information is transferred to, processed and stored in the United States by default, and EU hosting on AWS in Frankfurt with Dublin backups is documented for Enterprise subscriptions only, starting with core files of Figma and FigJam
- We found no public information on a private or anonymous mode for notes, breakout areas, participant limits or an accessibility statement for participants
- We found no public information on a two-way Jira sync, webhooks, import from Miro or Mural, or CSV export of the notes
- We found no public information on customer-managed keys, an on-premises or dedicated-tenant edition, or which AI providers process board content
- The Starter plan's limits and the price of additional AI credits are not stated, and the captured pages give different figures for the entry price
Best for
- You need a rich workshop and diagramming canvas with over 300 ready-made templates, iPad and Apple Pencil input, and AI that sorts stickies into themes
- You run sessions in Microsoft Teams or Zoom and want outside guests to join for the stated 24 hours without an account
- You manage seats centrally and want SCIM provisioning with identity-provider role sync, consistent sharing settings and delegated administration by workspace
- You want published per-seat euro prices with free viewers on paid plans, letting you price most of a deployment yourself
Avoid if
- Your deployment requires EU processing by default — the captured pages state United States transfer, processing and storage, with EU hosting as an Enterprise-tier option starting with core files of Figma and FigJam
- You need outside collaborators for longer than the stated 24-hour guest window without accounts
- You must pin down a total cost before committing — ask the vendor: the public pages we read do not show it
The scores
| Criterion | Panel median |
|---|---|
| Canvas, templates & content | 3.5 of 5 |
| Workshop facilitation & participation | 3 of 5 |
| Integrations, import & export | 3 of 5 |
| Sharing, permissions & administration | 3 of 5 |
| Security, AI controls & deployment | 3 of 5 |
| European sovereignty | 3 of 5 |
| Pricing transparency | 3.5 of 5 |
Canvas, templates & content
Show reasoningHide reasoning
How this is scored
What can be put on the board and how fast: an infinite canvas, sticky notes, text, shapes and connectors, freehand drawing and pen input, frames and sections, images, files, documents and video embedded on the board, tables, mind maps, diagrams and flowcharts, a template library for workshops, retrospectives and planning, own templates for the organisation, search across boards, performance on large boards, and AI that clusters, summarises or generates content.
0 — Not a whiteboard; there is no shared canvas to put content on.
3 — A shared board with sticky notes, text, shapes and drawing; templates, embeds, diagrams and large boards are basic or not described.
5 — An infinite canvas with sticky notes, shapes and connectors, frames, images and files on the board, a template library for workshops, retrospectives and planning, own templates saved for the team, and the board usable on desktop, browser and tablet with pen input.
8 — Diagrams, mind maps, tables and kanban on the same board, embeds of live documents and video, templates managed centrally for the organisation, search across all boards, documented limits for large boards (objects, participants), and AI that clusters or summarises notes with its data use stated.
10 — A canvas a whole organisation builds on: structured data on the board (cards linked to records, custom fields), smart diagramming with shape libraries for named notations, offline work with conflict-free sync described, board performance at stated scale, and every content type exportable with its structure.
The Workshop Facilitator
I can build the board the evening before from this: an infinite canvas with stickies, shapes and connectors that snap to a grid, pen input and Apple Pencil on the iPad app, over 300 ready-made templates including named retrospective and brainstorm formats, the option to make my own, plus tables, timelines and AI that sorts stickies into themes and summarises output into action items. I found no public information on live document or video embeds, kanban or mind maps, or documented performance limits for very large boards, which keeps it short of the top level. 1 2 3 4 12
The Product Team Lead
An infinite canvas with stickies, drag-and-drop shapes and connectors that snap to the grid, tables, timelines and calendars, plus over 300 ready-made templates including Retrospective and Roadmap planning and the option to make our own, covers our story maps and quarterly planning; AI that sorts stickies into themes, summarises them into action items and generates templates from a prompt is documented with an admin toggle. We found no public information on kanban or mind maps on the board, on frames, on embeds of live documents or video, or on stated limits for very large boards, which keeps it below the top band. 1 2 4 12 13
The Microsoft 365 Admin
The canvas holds what our teams would put on it: stickies, drag-and-drop shapes and connectors that snap to grid, tables and timelines, images and links, over 300 ready-made templates that can be extended with our own, an iPad app with Apple Pencil input, and AI that sorts stickies into themes and summarises output into action items. The AI's data use is addressed through a Content Training toggle in admin settings. We found no public information on documented object or participant limits for very large boards, or on kanban and mind-map views. 1 2 4 10 12 13
The Works Council Member
An infinite canvas with stickies, shapes and connectors that snap to grid, tables, timelines and calendars, pen input on the iPad app, and more than 300 ready-made templates plus the ability to make your own; the AI sorts stickies into themes, summarises output into action items and generates meeting and retrospective templates from a prompt, with content training governed by an admin toggle. What holds it back: we found no public information on documented limits for large boards, and search across boards is only touched indirectly through workspace-level browsing and filtering of files. 1 2 4 12
The Public-Sector Project Lead
An infinite canvas with stickies, drag-and-drop shapes and snap-to-grid connectors, images and links on the board, tables, timelines and calendars, over 300 ready-made templates including retrospectives and roadmap planning plus the option to make our own, pen and Apple Pencil input on the iPad app, and central default libraries plus workspace-level search for the organisation. AI sorts stickies into themes, summarises output into action items and generates templates from a prompt, with a content-training toggle in admin settings describing how customer content is used. We found no public information on documented limits for large boards, kanban or mind maps, or embedded video on the board. 1 2 4 10 12 13 17
The Skeptic
An infinite canvas with stickies, shapes, connectors, tables and snap-to-grid diagramming, over 300 ready-made templates or your own, iPad with Apple Pencil, and AI that sorts stickies into themes and summarises them with its data use stated through an admin content-training toggle. Diagram, flowchart and ER templates number in the hundreds, and Jira tasks and dashboards sit as widgets on the canvas. I found no public information on mind maps or kanban on the board, embedded video, or any stated performance limits for large boards. 1 2 4 10 12 13
Workshop facilitation & participation
Show reasoningHide reasoning
How this is scored
What it takes to run a session on the board: guests who join without an account, a timer, voting and dot voting, a private or anonymous mode for notes, bringing everyone to the facilitator's view (summon, follow), a presentation or frame mode, locking objects, reactions, breakout areas, an agenda or session plan, built-in audio or video or the call apps the board runs inside, participant limits, and accessibility for participants (keyboard, screen reader, contrast).
0 — No real-time collaboration; only one person can work on a board at a time.
3 — Several people edit the same board in real time and see each other's cursors; facilitation tools and guest access are basic or not described.
5 — Guests join by link without an account, a timer, voting, bringing participants to the facilitator's view, a presentation mode through frames, locking objects, and comments with mentions.
8 — A private or anonymous mode for brainstorming, voting with results and export, breakout areas or assigned frames, a session agenda or facilitator panel, the board running inside Teams, Zoom or Webex meetings, participant limits per session stated, and an accessibility statement for the board.
10 — Facilitation that a large event runs on: hundreds of participants per board with stated limits, facilitator controls over who may edit what and when, session recordings or summaries with their data use stated, a published accessibility conformance report (WCAG), and facilitation features documented step by step.
The Workshop Facilitator
Guests join an open session without an account for 24 hours, there is a timer with music, voting and polling with stamps, Spotlight mode and observation mode to pull everyone to my view, reactions, audio and chat inside the file, and the board runs inside both Teams and Zoom. What I could not find: a private or anonymous mode for brainstorming, breakout areas, a session agenda, participant limits per session, an accessibility statement, and whether objects can be locked — and the 24-hour guest window is the stated ceiling. 1 2 3 13 14 15
The Product Team Lead
Open sessions let anyone join for 24 hours with no account, and there is a timer with music, formal voting, stamps and animated emoji reactions, Spotlight to bring participants to one view, observation mode for walkthroughs, live audio, chat and comments, with the board running inside Microsoft Teams and Zoom. We found no public information on a private or anonymous note mode, breakout areas, locking objects, per-session participant limits, or an accessibility statement for participants, which caps it in the middle band. 1 2 3 14 15
The Microsoft 365 Admin
Guests join by link for 24 hours with no account, there is a timer with music, formal voting, stamps and reactions, spotlight to bring everyone to the presenter's view, and audio and live chat inside the file; the board also runs inside Teams and Zoom, which is how our sessions actually happen. We found no public information on an anonymous or private mode for notes, breakout areas, stated participant limits, or an accessibility statement for participants. 1 2 3 14 15
The Works Council Member
Guests join by link for 24 hours without an account, there is a timer with music, formal voting plus stamps, reactions and animated emojis, a spotlight mode to guide participants, and live audio, chat and comments directly in the file, with the board running inside Teams and Zoom including open sessions with no account required. We found no public information on a private or anonymous mode for notes, breakout areas, participant limits per session, or an accessibility statement for participants. 1 2 3 14 15
The Public-Sector Project Lead
Guests join without an account — the vendor states invitees contribute free for 24 hours, no login required — and open sessions run in Zoom the same way; a timer with music, voting, spotlight to bring participants to the facilitator's view, reactions, and built-in audio, live chat and comments are documented, with apps for Microsoft Teams and Zoom. We found no public information on a private or anonymous mode for notes, breakout areas, locking objects, participant limits per session, or an accessibility statement — the accessibility statement and participant limits are items my municipalities' workshops and my accessibility file need. 1 2 3 14 15
The Skeptic
Guests join open sessions for 24 hours with no account, a timer and music, formal voting, stamps and reactions, live audio and chat in the file, Spotlight to bring everyone to the facilitator's view, and the board runs inside Teams and Zoom meetings. I found no public information on a private or anonymous mode for notes, breakout areas, locking objects, a session agenda, participant limits per session, or an accessibility statement for participants. 1 2 3 14 15
Integrations, import & export
Show reasoningHide reasoning
How this is scored
How the board connects to the work around it and whether the content can leave: apps for Teams, Zoom, Webex, Slack and Google or Microsoft files, a two-way sync with Jira, Azure DevOps or other work tools, embedding boards in Confluence, SharePoint or intranets, a documented REST API and webhooks, import from Miro, Mural or other boards and from CSV or images, and export as PDF, image, CSV of the notes or an editable file another tool can open.
0 — No integration and no export of any kind; content can only be viewed on the vendor's board.
3 — Export as image or PDF and a few named integrations; an API, imports and structured export are basic or not described.
5 — Apps for at least Teams or Zoom and Slack, an integration with Jira or another work tool, embedding a board in other tools, export as PDF, image and CSV of the notes, and a documented API.
8 — A two-way sync with Jira or Azure DevOps that keeps cards and issues aligned, a REST API with webhooks covering boards and items, import from other whiteboards documented, an export in an editable or open format, and a marketplace or app framework for extensions.
10 — Integration and exit both complete: an API that can read and write everything the board holds, a full account export in an open format that another tool imports with structure kept, SDKs or an embeddable board for own applications, and the export and deletion on termination documented.
The Workshop Facilitator
Apps for Teams and Zoom are documented, Jira, Asana and GitHub integrations bring tasks and dashboards onto the canvas, export as PNG or SVG plus embedding into Asana and Dropbox Paper is stated, and there is a REST API with a whole plugin and widget ecosystem and a partner programme. For the handover after a workshop the gaps hurt: I found no public information on a CSV export of the notes, import from Miro or Mural, a Slack app, or webhooks, and the Jira connection is named without a documented two-way sync. 1 2 6 13 14 15
The Product Team Lead
Integrations with Jira, Asana and GitHub bring tickets and dashboards onto the canvas as workflow widgets, apps exist for Teams and Zoom, boards export as PNG or SVG and embed into tools like Asana and Dropbox Paper, and there is a documented REST API alongside plugin and widget APIs with a community marketplace. For my core requirement — a retro or planning board landing in Jira without retyping — we found no public information on a two-way sync that writes cards back into issues, on webhooks, on a CSV export of the notes, or on importing boards from Miro or Mural for a tool switch. 1 2 6 13 14 15
The Microsoft 365 Admin
The connectors that matter to a Microsoft shop are there — Teams and Zoom apps, Jira, Asana and GitHub integrations with Jira tasks placed on the canvas — plus embedding into Asana or Dropbox Paper, export as PNG and SVG, and a documented REST API with a plugin and widget framework. We found no public information on a two-way Jira sync, webhooks, import from Miro or Mural, or a CSV export of sticky notes, which I would want for consolidating scattered boards. 1 2 6 13 14 15
The Works Council Member
Export is PNG or SVG with links and embedding into Asana and Dropbox Paper; integrations with Teams, Zoom, Asana, Jira and GitHub are named, Jira tasks and dashboards sit on the canvas as widgets, and a documented REST API sits alongside plugin, widget, embed-kit and SCIM APIs with private plugins and widgets supported. We found no public information on a CSV export of the notes, on import from other whiteboards, or on a stated two-way sync that keeps cards and issues aligned with Jira. 1 2 6 13 14
The Public-Sector Project Lead
Integrations with Asana, Jira and GitHub, workflow widgets that bring Jira tasks and dashboards onto the canvas, apps for Microsoft Teams and Zoom, embedding into Asana or Dropbox Paper, export as PNG, SVG "or format of your choice", and a REST API alongside plugin, widget and SCIM APIs, an embed kit and a partner program for the integration collection. We found no public information on a two-way Jira or Azure DevOps sync, webhooks, import from Miro or Mural, or a CSV export of the notes — exit options matter to procurement. 1 5 6 13 14 15
The Skeptic
Teams and Zoom apps, integrations with Jira, Asana and GitHub, a documented REST API, plugin and widget APIs with private plugins and a community, and embedding into Asana and Dropbox Paper are all evidenced. The documented export is 'a PNG, SVG, or format of your choice' — the pages give no public information on PDF or CSV export of the notes, webhooks, a two-way Jira sync, or import from other whiteboards. 1 6 13 14 15
Sharing, permissions & administration
Show reasoningHide reasoning
How this is scored
Who can see and change a board and how the organisation controls it: sharing by link with expiry and password, guest and external-user rules, roles per board, project and team, default sharing settings set by the admin, single sign-on (SAML, OpenID Connect), user provisioning (SCIM), domain capture and control of shadow accounts, audit logs, content retention and legal hold, transfer of boards when a person leaves, and admin reports.
0 — No accounts or permissions; anyone with a board's address can see and edit it, with no way to restrict it.
3 — Boards are shared with named people or by link with view or edit rights; admin controls, SSO and audit are basic or not described.
5 — Roles per board and per team, link sharing that can be restricted or switched off, guest access controlled by the admin, single sign-on with SAML, a user and board admin console, and boards transferred when a person leaves.
8 — SCIM provisioning, domain capture of existing accounts, sharing policies set centrally (no public links, guests only from allowed domains), audit logs exportable to a SIEM, retention rules and legal hold, data classification labels on boards, and admin roles split by scope.
10 — Administration that a regulated organisation can sign off: every sharing and access setting the admin controls listed with its effect, complete audit trails with a stated retention, eDiscovery and export for investigations, delegated administration across subsidiaries, and every control documented in the help centre.
The Workshop Facilitator
The admin side is documented in depth for bigger clients: SCIM seat management with identity-provider role sync, password-protected links and guest access controls, default teams with consistent sharing settings on Enterprise, dedicated workspaces with administration delegated by workspace, session timeouts, and a Governance+ add-on with IP allowlisting and enforced two-factor. I found no public information on single sign-on with SAML or OpenID Connect, retention rules or legal hold, data classification labels, or transfer of boards when someone leaves; domain capture appears only for education accounts and auditing is evidenced as activity logs reachable through the API. 5 6 7 10 16 17
The Product Team Lead
Enterprise administration is well documented: SCIM seat management with identity-provider role sync, password-protected links, guest access controls, centrally consistent sharing settings with default teams, delegated administration per workspace, and a REST API for activity logs such as file edits and user access. We found no public information on single sign-on being named (SAML or OpenID Connect), domain capture outside education accounts, retention rules and legal hold, exporting audit logs to a SIEM, or transferring a leaver's boards, so it sits below the higher band. 5 6 16 17
The Microsoft 365 Admin
Much of what I need to take control of the shadow accounts is documented: SCIM provisioning with roles synced from our identity provider, password-protected links and guest access controls, Enterprise default teams with consistent sharing settings applied once for everyone, delegated administration by workspace, and activity logs for file edits, page creation and user access available through a REST API. Domain capture is documented only for Figma for Education Enterprise accounts. We found no public information on single sign-on with SAML, retention rules and legal hold, or classification labels on boards. 5 6 7 10 17
The Works Council Member
SCIM provisioning with identity-provider role sync, centrally applied consistent sharing settings on the Enterprise plan, password-protected links, admin-controlled guest access, delegated administration per workspace, granular permissions through teams, and a REST API that surfaces activity logs such as file edits, page creation and user access. We found no public information on single sign-on with SAML, retention rules or legal hold, and domain capture is documented only for Figma for Education Enterprise accounts. 5 6 16 17
The Public-Sector Project Lead
SCIM provisioning with identity-provider role sync, password-protected links, admin-controlled guest access, consistent sharing settings and default teams on Enterprise, workspaces with more granular team permissions, and delegated administration by workspace are documented, and an activity-logs REST API covers file edits, page creation and user access. Domain capture appears only for education Enterprise accounts, and we found no public information on single sign-on with SAML, retention rules and legal hold, classification labels, or transferring boards when a person leaves — without those I cannot yet sign this off with our procurement office. 5 6 7 10 16 17
The Skeptic
SCIM with identity-provider role sync, password-protected links, admin-controlled guest access, Enterprise-wide consistent sharing settings, workspace-level delegated administration, and a REST API for activity logs such as file edits and user access are all documented. I found no public information on the single sign-on method, SAML or OpenID Connect, nor on transferring boards when someone leaves, retention rules, or legal hold. 5 6 10 16 17
Security, AI controls & deployment
Show reasoningHide reasoning
How this is scored
How the content of the boards is protected and where the product can run: encryption in transit and at rest, customer-managed encryption keys, a dedicated or private-cloud tenant and an on-premises edition, AI features that the admin can switch off and that do not train on customer boards, which AI providers process board content, data loss prevention, deletion of boards and accounts with stated periods, and whether individual activity (logins, contributions, time on board) is tracked and shown to managers, with a statement for works councils. Who processes the data and where, and the certifications, are scored under sovereignty.
0 — Content is not protected in transit, or boards are used for the vendor's own purposes by default with no way to opt out.
3 — Encryption is mentioned and the product is described as secure or GDPR-compliant; AI use, deletion and deployment options are basic or not described.
5 — Encryption in transit and at rest stated, AI features that the admin can switch off, a statement that customer content is not used to train AI models, deletion of boards and accounts with a stated period, and a security page describing the measures.
8 — Customer-managed keys or a dedicated tenant, a private-cloud or on-premises edition documented, the AI providers that process board content named with their location, data loss prevention or classification controls, individual activity tracking described with what managers can see, and a statement or template for works council agreements.
10 — Protection that can be verified: client-side or end-to-end encryption for boards with the method published, an on-premises or sovereign-cloud edition with feature parity stated, no AI processing outside the customer's chosen region, a published penetration test summary, and every security and AI control listed with its effect.
The Workshop Facilitator
Encryption in transit and at rest is stated, AI sits behind an admin access toggle with a separate content-training toggle and de-identification steps, customer content is deleted or returned within thirty days at the end of the agreement with self-service deletion before that, and there is a security page, a bug bounty and annual independent audits. An EU hosting option on AWS in Frankfurt with Dublin backups exists for Enterprise customers. I found no public information on customer-managed keys, a dedicated or on-premises edition, which AI providers process board content and where, what managers can see of individual activity, or a works-council statement. 4 8 10 11 19
The Product Team Lead
Encryption in transit (TLS/SSL) and at rest (AES-256 or equivalent) is stated, deletion or return of content within thirty days at contract end plus self-service deletion is in the processing agreement, AI access and Content Training are toggles in admin settings, and a security page and Trust Center describe the measures, with EU data hosting available as an Enterprise option. We found no public information on customer-managed keys, a dedicated tenant or on-premises edition, which AI providers process board content and where, data loss prevention, or a works council statement — the last one matters for me in Germany. 4 8 10 11 18 19
The Microsoft 365 Admin
The AI off-switch I need before legal reads the terms exists — AI features require the admin's AI access toggle, and a separate Content Training toggle governs whether customer content is used to train models, with de-identification stated. Encryption in transit and at rest, deletion or return of all customer content within thirty days, a security page with a bug bounty and FedRAMP authorisation, and a Governance+ add-on with IP allowlisting and enforced 2FA are documented. We found no public information on customer-managed keys, a dedicated or on-premises deployment, where the AI providers process board content, or a statement for works councils. 4 8 10 11 18
The Works Council Member
Encryption in transit and at rest is stated, AI access sits behind an admin toggle and content training behind a separate opt-in, customer content is deleted or returned within thirty days at contract end with self-service deletion before that, and the certification list runs from SOC 2 Type II and ISO 27001 through C5, ISO 42001 and the EU Cloud Code of Conduct, with EU hosting on AWS in Frankfurt and Dublin backups as an Enterprise option. For my §87(1) no. 6 concerns: individual activity such as file edits and user access is captured through the activity-logs API, but what a manager can see of an individual's contributions is not described, and we found no public information on named AI providers, a works-council statement, customer-managed keys or an on-premises edition. 4 5 10 11 18 19
The Public-Sector Project Lead
Encryption in transit (TLS/SSL) and at rest (AES-256), an admin AI-access toggle plus a content-training toggle, deletion or return of all customer content within thirty (30) days with self-service deletion, a trust centre, and a Governance+ add-on with IP allowlisting, network restrictions, enforced 2FA and extended idle session timeouts are documented. EU data hosting on AWS in Frankfurt with backups in Dublin is offered, but only with the Enterprise plan; we found no public information on an on-premises or dedicated-tenant edition, customer-managed keys, the AI providers that process board content, individual activity tracking shown to managers, or a works-council statement — the absence of an on-premises path matters for our state data centre. 4 5 10 11 18 19
The Skeptic
Encryption in transit and at rest, a 30-day delete-or-return period at end of service, an admin AI-access toggle, and a security page with bug bounty and a Governance+ add-on (IP allowlisting, enforced 2FA, session timeouts) are stated. But customer content is used to train AI models when the 'Content Training' toggle is on, the toggle's default state is not stated, and the pages name no AI provider, offer no customer-managed keys, no dedicated tenant, no on-premises or private-cloud edition, and no works-council statement. 4 8 10 11 18
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where boards, files and user data are stored and processed, and who the subprocessors are (hosting, CDN, real-time collaboration servers, AI providers, email, support and payment tools). Independently sourced by the sovereignty pipeline; boards hold personal data of participants and often of customers, so the whole chain counts, not only the database. An on-premises or self-hosted edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (AI features, CDN, real-time servers, email, support, payment) run through non-EU providers without a stated safeguard, or EU residency is an option of the top tier only.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5, SOC 2) stated — or an on-premises edition documented that keeps every board on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor including AI, or an on-premises or open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Workshop Facilitator
All personal information is processed and stored in the United States by default, and the EU option — Frankfurt on AWS with Dublin backups, starting with core Figma and FigJam files — is available only on the Enterprise plan, though migration from the US is offered for Enterprise customers. A data processing agreement with EU standard contractual clauses is published, a sub-processor list with functions and locations is maintained with fifteen days' change notice, and certifications include ISO 27001, SOC 2, C5 and an EU Cloud Code of Conduct seal — but the contracting and processing entity named in that agreement is the US company, with only a German imprint entity in Berlin. EU residency is therefore a top-tier option on a US-default chain with stated safeguards. 9 10 11 18 19
The Product Team Lead
The contracting processor in the data processing agreement is Figma, Inc. of San Francisco, and the privacy policy states personal information is processed and stored in the United States; EU hosting exists only with the Figma Enterprise plan, on AWS with Frankfurt as primary location and Dublin for backups, initially covering the core files of Figma and FigJam. The chain is transparent — a published DPA with Standard Contractual Clauses and Data Privacy Framework certification, a sub-processor list with functions and processing locations, and certifications including ISO 27001, SOC 2 Type II, the German C5 catalogue and the EU Cloud Code of Conduct Level 2 — but with a US entity, US default storage and EU residency tied to the top tier, it does not reach the sovereign end. 9 10 11 18 19
The Microsoft 365 Admin
The privacy policy states that personal information is transferred to, processed and stored in the United States by default, while EU hosting on AWS in Frankfurt with backups in Dublin is documented for Enterprise subscriptions only, starting with core files of Figma and FigJam. A Berlin entity appears in the German imprint, but the data processing agreement names Figma, Inc. as the processor; EU SCCs, a published sub-processor list with locations and a notification subscription, and ISO 27001, C5 and SOC 2 certifications are stated. 9 10 11 18 19
The Works Council Member
The privacy policy states that all personal information is processed and stored in the United States, and EU hosting on AWS in Frankfurt with Dublin backups is an option reserved to Figma Enterprise, rolled out in phases starting with the core files of Figma and FigJam. A data processing agreement with EU standard contractual clauses is published, the sub-processor list names functions and locations with a fifteen-day change notice and an objection remedy, and Figma GmbH in Berlin appears in the imprint — but the processing entity named in the agreement is Figma, Inc. Strong certifications including C5 and the EU Cloud Code of Conduct Level 2 lift this above the minimum, yet the chain stays anchored in a US entity with EU residency as a top-tier option only. 9 10 11 18 19
The Public-Sector Project Lead
The privacy policy states that all personal information is transferred to, processed and stored in the United States, and the data processing agreement names Figma, Inc. as the data importer; EU hosting exists — primary location Frankfurt, backups in Dublin, on AWS — but only for Enterprise subscriptions and starting with the core files of Figma and FigJam. On the other side, the chain is unusually transparent: a published sub-processor list with functions and locations, SCCs (Modules Two and Three) with the Data Privacy Framework, the EU Cloud Code of Conduct compliance level 2 with a seal, and certifications including BSI C5 and ISO 27001, while a Figma GmbH is registered in Berlin. My data protection officer would engage on exactly this split: C5 and a named EU region, but US-entity contracting and US hosting as the default. 9 10 11 18 19
The Skeptic
The privacy policy places all personal information in the United States where the main servers are, and the data processing agreement names Figma, Inc. as processor with SCCs and a published sub-processor list with locations; a German imprint entity exists in Berlin. EU hosting — Frankfurt primary, Dublin backup, on AWS — is documented, but only for Figma Enterprise customers and phased in starting with the 'core files' of Figma and FigJam, leaving the rest of the chain, AI included, unaddressed in EU terms. Certifications including ISO 27001, SOC 2 Type II, C5 and the EU Cloud Code of Conduct seal at level 2 are stated. 9 10 11 19
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user and tier, how guests, viewers and external participants are counted, limits of the free plan (number of boards, objects, members), which features (SSO, SCIM, audit logs, EU data residency, AI credits, on-premises) cost extra, the enterprise tier's price or minimum, annual versus monthly billing, minimum seats and term.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free plan exists, but how cost scales with users, guests or features is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (SSO, EU data residency, guests, AI credits, the enterprise tier) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (members, guests, boards), free-plan limits stated, add-ons and AI credits priced, the on-premises or dedicated edition's cost or licence stated, minimum seats, term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, guest count and feature set, with every add-on, setup, support and AI fee and the cancellation and data-return terms published.
The Workshop Facilitator
Per-seat prices are public across tiers — from a Collab seat at €3/mo up to an Enterprise Full seat at €90/mo and Dev seat at €35/mo on the pricing capture, each with monthly AI credit allotments, free viewers on paid plans, guests free for 24 hours without an account, and a free Starter tier; the marketing pages also state paid plans start at $3 per user per month. What I cannot compute from public pages: the limits of the Starter plan, the price of additional AI credits (offered pay-as-you-go or subscription, unpriced), minimum seats, term and VAT treatment, and AI is free in beta with prices to come. A contact-sales route also appears on the enterprise pages. 1 2 4 5 7 19
The Product Team Lead
Per-seat prices are public and unusually granular — Collab seat €3/mo and Full seat €16/mo with 3,000 AI credits/mo on Professional, Full seat €55/mo on Organization, Full seat €90/mo with 4,250 AI credits/mo and Dev seat €35/mo on Enterprise billed annually — and guests join free for 24 hours while viewers on paid plans need no extra seat. We found no public information on the Starter plan's limits, the price of additional AI credits or the Governance+ add-on, monthly billing for Professional, minimum seats, term or VAT treatment, so the total for a given team setup is not fully derivable from the public pages. 1 4 7 19
The Microsoft 365 Admin
I can price most of this myself: a free Starter plan, Professional at €3/mo per collab seat and €16/mo per full seat, Organization at €55/mo and Enterprise at €90/mo per full seat, each with a monthly AI credit allotment, guests free for 24 hours and viewers free on paid plans; the marketing page also cites paid plans starting at just $3 per user per month. The AI credit add-on's price, the free plan's exact limits, minimum seats and VAT treatment are not stated, and the enterprise page shows a contact-sales approach alongside the published seat prices. 1 2 4 5 7 19
The Works Council Member
The pricing page states per-seat monthly prices with annual billing for the Professional, Organization and Enterprise tiers — from a Collab seat at €3/mo up to an Enterprise Full seat at €90/mo — each with a stated monthly AI credit allotment, plus a free Starter plan, free viewers and comments on paid plans, and purchasable additional AI credits on a pay-as-you-go or subscription basis. We found no public information on the free plan's board limits, the price of additional AI credits, minimum seats or VAT treatment, and the captured pages give different figures in that the enterprise page points to contacting sales while the pricing page states seat prices. 1 5 7 19
The Public-Sector Project Lead
All three tiers are priced publicly in euros per seat with monthly AI credit allotments — Professional at "Full seat €16/mo", "Dev seat €12/mo" and "Collab seat €3/mo"; Organization at €55/mo, €25/mo and €5/mo; Enterprise at "Full seat €90/mo" and "Dev seat €35/mo" — with FigJam included on every seat, viewers free on paid plans and guests free for 24 hours. The captured pages give different figures for the entry point: "$3 per user per month" on the whiteboard page versus the euro seat prices on the pricing page. We found no public information on the Starter plan's limits, the price of additional AI credits or the Governance+ add-on, minimum seats, term or VAT treatment, and EU data hosting requires the Enterprise plan. 1 2 4 7 19
The Skeptic
Seat prices are public and unusually granular — collab, dev and full seats per tier, e.g. 'Full seat €16/mo + 3,000 AI credits/mo' at Professional and 'Full seat €90/mo + 4,250 AI credits/mo' at Enterprise, with viewers free on paid plans and guests free for 24 hours. What a buyer cannot compute: the free plan's limits (stated only as 'Free limited access'), the price of additional AI credits ('pay-as-you-go or subscription', no figure), minimum seats, term and VAT treatment. The captured pages also give different figures for the entry price — 'just $3 per user per month' in USD against the euro seat prices. 2 4 5 7 19
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about FigJam
Is FigJam European?
No. whats-best.ai classifies FigJam as Rest of world.
Where does FigJam store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does FigJam have a free plan?
Yes. FigJam has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to FigJam?
As of 1 Nov 2026, the panel rates Miro (3.5/5), Collaboard (3.5/5) and Klaxoon (3/5) highest among the other 12 Online Whiteboard products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Collaboard (UK / wider Europe). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: FigJam alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity, Hosting location, Hosting options, Data processing agreement. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 6 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (19)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (FigJam) www.figma.com Checked 1 Nov 2026 Details →
- 2 Features page (online whiteboard) www.figma.com Checked 1 Nov 2026 Details →
- 3 Features page (brainstorming) www.figma.com Checked 1 Nov 2026 Details →
- 4 Features page (AI features) www.figma.com Checked 1 Nov 2026 Details →
- 5 Features page (enterprise) www.figma.com Checked 1 Nov 2026 Details →
- 6 API documentation developers.figma.com Checked 1 Nov 2026 Details →
- 7 Pricing page www.figma.com Checked 1 Nov 2026 Details →
- 8 Security / trust page www.figma.com Checked 1 Nov 2026 Details →
- 9 Legal notice www.figma.com Checked 1 Nov 2026 Details →
- 10 Privacy policy www.figma.com Checked 1 Nov 2026 Details →
- 11 Data processing agreement (dpa) www.figma.com Checked 1 Nov 2026 Details →
- 12 Canvas, templates & content — found from sitemap www.figma.com Checked 1 Nov 2026 Details →
- 13 Canvas, templates & content — found from sitemap www.figma.com Checked 1 Nov 2026 Details →
- 14 Integrations, import & export — found from sitemap www.figma.com Checked 1 Nov 2026 Details →
- 15 Integrations, import & export — found from sitemap www.figma.com Checked 1 Nov 2026 Details →
- 16 Sharing, permissions & administration — found from sitemap www.figma.com Checked 1 Nov 2026 Details →
- 17 Sharing, permissions & administration — found from sitemap www.figma.com Checked 1 Nov 2026 Details →
- 18 Security, AI controls & deployment — found from sitemap www.figma.com Checked 1 Nov 2026 Details →
- 19 Security, AI controls & deployment — found from sitemap www.figma.com Checked 1 Nov 2026 Details →