Strata Design System Figma plugin

Effective date: October 28, 2026. Operator: Charisol. Contact: support@charisol.io. Website: https://strata.charisol.io.

This policy describes what the Strata Design System Figma plugin reads, where that data goes, how long Charisol keeps it, and how you can delete it. A Charisol account is required to connect the plugin.

What the plugin reads

The plugin reads the Figma file that is open only after you run it. It reads that file's nodes, text, styles, variables, components, prototype links, and team-library data used by the file. It then exports images and SVGs from that file on your device.

The plugin does not ask for your Figma password. Sign-in is a device code that you approve in a browser at https://strata.charisol.io/plugin/connect.

Where data is sent

Charisol operates both destinations in AWS us-east-1. The plugin does not send design-file bytes to any other host.

Charisol API

https://api-production-charisol-design-system-be.aws.charisol.io

This is the production Charisol API. The plugin sends:

a device-login code
a bearer plugin token
a request for your project list
SHA-256 hashes of exported assets
file names, content types, and file sizes
an upload id and an upload-complete notice

Design-file bytes are not sent to this API.

Charisol project bucket

https://production-charisol-design-system-be-project-data.s3.us-east-1.amazonaws.com

This is a private Amazon S3 bucket. The plugin uploads directly with a presigned PUT URL. The plugin sends:

manifest.json, which contains the node structure, text, styles, variables, components, and prototype links from the open file
the exported images and SVGs from that file

The bucket is not public. Access is limited to members of that Charisol project and to Charisol operators.

How long data is kept

The presigned upload URL expires after 1 hour. That is the upload window, not the storage period.

An upload that does not finish is tagged strata-plugin=pending and deleted after 7 days.

A finished snapshot is kept until the project owner deletes the project in Charisol. Deleting the project deletes the plugin-uploads and figma-snapshots objects for that project, and the inventory, job, and artifact records that point at them.

A plugin token is stored as a hash. It lasts 90 days from last use. Each use extends that period. Device codes expire after 10 minutes.

How you can delete data

Revoke a plugin token from the Connected Plugins section on your Charisol profile. Logging out of the plugin also removes the token stored in the plugin on that computer.

Delete a project in Charisol to delete the snapshot and unfinished uploads stored for that project. Email support@charisol.io if you need help deleting data.

What Charisol does not do

Charisol does not sell design data. The plugin does not show advertisements.