Security

Last updated: 6 October 2026

Framyy works inside your design files. Here is what it reads, where it writes, who can make it act, and where your data lives.

Your concept stays untouched

• The design concept is only read. Framyy never writes to it.
• Changes go only into the design-system file you point Framyy at. Before writing, the service checks every target; a target it cannot identify as part of your design system is treated as unsafe and is not written.
• Components that come from a connected library are never modified.

You stay in control of every change

• Files are changed only by the Framyy plugin that you run inside Figma yourself. While the plugin is closed, nothing is written.
• Every change is reported — including changes the service could not make, with the reason.
• Figma's version history lets you restore any earlier version of a file.

The plugin acts only for you

• The plugin you download from Framyy carries a key that is personal to you. Keep your copy to yourself.
• A command is applied only in the file where the plugin is open, and the service checks that it is the right file.
• Each command is handed to one open plugin window at a time, and only that window can report it done.
• An outdated plugin is refused with a clear message instead of running old logic.

Figma access

If you connect Figma, it is done through Figma's own sign-in (OAuth). The access token is read-only: it lets Framyy read the files you point it at, nothing more. You can revoke it at any time in your Figma account settings (Connected apps); stored tokens are deleted when your account is deleted.

Accounts and sign-in

• Access is by invitation only during the pilot.
• After you sign in, the service sets one strictly necessary session cookie. It is not used for tracking and is not shared with anyone.

Encryption and hosting

• All traffic to Framyy is encrypted in transit (HTTPS/TLS).
• Our server is hosted in the European Union (Frankfurt) by Render. Your data is stored there.
• Access tokens are kept on our server and are never exposed to other users. Access to the server is restricted to the operator.

AI processing

To analyse your design files, Framyy uses an AI model provided by Anthropic (United States). When an analysis runs, the relevant parts of the files you point Framyy at — such as layer names, text, structure and rendered images — are sent to Anthropic's API for processing. Your account data and access tokens are never sent to Anthropic.

No tracking

• No analytics, no advertising pixels, no third-party trackers. We do not sell your data.
• This website loads nothing from other servers: fonts, scripts, video and sound are all served from framyy.com.

For the full picture of what data we keep and why, see our Privacy Policy and Terms & Conditions.