← All features

Platforms and setup

Your data stays with you

Your security team will not approve a tool that copies integration content, messages and test data into someone else's cloud.

Figaf works with your integration content, your messages and your test data. That data is stored where you choose to run Figaf, in a database you operate, and Figaf as a company does not have access to it. This matters to security teams, data protection officers and IT managers who have to approve the tool.

How it works

• Where Figaf runs. You can run Figaf on SAP BTP Cloud Foundry, the recommended setup with SAP’s user management for access, as Docker in your own infrastructure, or on a local PC for a proof of concept or to generate reports.
• Your own database. On SAP BTP, Docker or a local PC, your data is stored in a PostgreSQL database that you operate.
• Figaf Cloud. With Figaf Cloud, Figaf hosts the application, but not your data.
• Code runs on your tenant. When Figaf runs code against real data, such as Groovy scripts with your test cases, it uses your own Cloud Integration tenant. No data is processed outside your Figaf instance or Cloud Integration.
• AI on your own key. AI features such as the Figaf Bot, vibe coding and AI search use your own OpenAI or SAP AI key. Data goes directly to the AI provider, only when you enable the feature, and the Figaf team cannot read your queries. Figaf does not train AI models on your content, because it has no access to it.
• What Figaf receives. Figaf receives usage information, such as the first time you use a function, and the hashed names of the ICOs and iFlows you use with each feature. Beyond that, no data is sent to Figaf automatically.
• Application security. Figaf protects users against cross-site request forgery (CSRF) and sends a Content Security Policy, so the browser only runs the application’s own code. The application is penetration tested periodically by an external company.

Business value

• Easier security approval. Integration content, payloads and partner data stay inside infrastructure you already govern, which makes the tool simpler to approve for security and data protection.
• Compliance with your own policies. Production test data, which can include payroll or financial content subject to GDPR or SOX rules, stays in systems under your control.
• Lower breach exposure. Since Figaf does not host your private data, a leak through Figaf is not likely.
• Control over AI use and cost. AI features are off until you enable them, run on your own key, and are paid directly to the provider.
• No lock-in of your data. Your data is in your own database and your own SAP systems, so it stays available to you whatever you decide about the tool.

Good to know

• When a security issue is found, it is handled as a high-priority ticket and fixed with a patch, and users are informed. Past advisories are listed on the security page.
• See how to install Figaf for the deployment options.

Learn more

• Security and data handling
• FAQ: data privacy and security
• Get started with Figaf