DesignGuard AI
Start free

Security & trust

Your design system, not our data.

DesignGuard reads your Figma files and repositories to find drift — that only works if you can trust exactly what it can touch. Here is how access, credentials, and activity are protected, stated plainly.

Figma tokens are encrypted and never shown again

Saved Figma personal access tokens are encrypted at rest with AES-GCM and only ever displayed masked. One-time tokens are used for a single import and never persisted. Tokens are never echoed back to the browser.

Repository access is scoped and short-lived

The GitHub integration uses a GitHub App with repository-scoped installation grants you control. Installation tokens are generated per job, expire quickly, and are never stored. Webhook payloads are verified with SHA-256 signatures.

Passwords and sessions are hashed, cookies are locked down

Passwords are stored as bcrypt hashes. Session tokens are random secrets stored only as SHA-256 hashes server-side, delivered as httpOnly, Secure cookies — never readable by page JavaScript.

Enterprise sign-in: SAML SSO and SCIM provisioning

Enterprise workspaces can enforce sign-in through your identity provider (Okta, Azure AD, Google Workspace) and auto-provision or deprovision access with SCIM.

Auditable by design

Workspace activity is recorded in security and audit logs, with SIEM webhook export available on Enterprise plans, so your security team can watch DesignGuard the same way it watches everything else.

The demo never touches your data

The guided demo workspace runs entirely on simulated sample data. It makes no external calls to Figma or GitHub and requests no tokens — explore everything before connecting anything.

What we don't do.

  • We never write to your Figma files without an explicit action from you — audits and imports are read-only.
  • We never push to your repositories directly — Code Connect changes arrive as pull requests your team reviews.
  • We never train AI models on your designs or code. Cross-workspace pattern suggestions use only anonymized, allowlisted generic vocabulary (like “size” or “disabled”) that can never contain your content.
  • We don't request broader GitHub scopes than the repositories you select.

Have a security question?

We're an early-stage product and we answer security questionnaires personally. Ask us anything — architecture, data flow, or a walkthrough with your security team.

Ask a questionExplore the demo