Security and data handling
Figaf runs where you choose, and your integration data stays with you.
Figaf works with your integration content, your messages and your test data. This page sums up where that data lives, what Figaf can see and how we keep the application secure.
Where Figaf runs
- SAP BTP Cloud Foundry, our recommended setup, with SAP’s user management for access
- Docker, in your own infrastructure
- A local PC, for a proof of concept or to generate reports
- Figaf Cloud, where Figaf hosts the application, but not your data
See how to install Figaf.
Security in the application
Figaf protects its users against cross-site request forgery (CSRF) and sends a Content Security Policy, so the browser only runs the application’s own code.
When Figaf runs code against real data, such as Groovy scripts with your test cases, it uses your own Cloud Integration tenant. No data is processed outside your Figaf instance or Cloud Integration.
Your questions about data and security
Where is my data?
Your data stays with you. On SAP BTP, Docker or a local PC, it is stored in a PostgreSQL database that you operate. With Figaf Cloud, Figaf hosts the application, but not your data.
What data is sent to Figaf?
Figaf receives usage information, such as the first time you use a function, and the hashed names of the ICOs and iFlows you use with each feature. Beyond that, no data is sent to Figaf automatically.
Does Figaf train AI models on our data?
No. Figaf does not have access to your data, so we cannot train models on your content.
How strong is Figaf’s app security?
Figaf is penetration tested periodically by an external company. The architecture was found robust, with no traces of data loss and no open security threats.
If a security threat is found, it is handled as a high-priority ticket and fixed with a patch right away.
How are incidents reported?
Since we do not host your private data, a leak is not likely.
We check our dependencies, and if there is something major, like log4j in 2021, or a problem in our code, we inform our users and provide a workaround.
Security advisories
When we find a security issue, we fix it, release a patch and tell our users. Past advisories:
How we handle personal data is described in our privacy policy. The license terms are in the EULA.
Questions from your security team?
30 minutes with someone who has done this before.
