// Trust & Security Report
Canva for Education
by Canva Pty Ltd
Canva is a web-based design platform offering free design tools for education tier (teachers & students), plus paid consumer and enterprise tiers (Pro, Teams, Business, Enterprise). Canva for Education is the free tier for K-12 and higher education.
Certifications held
7
Maturity
Enterprise
Trains on your data
Yes
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on trust.canva.com“to our security documentation and audit reports through the portal. Compliance SOC 2 Type 2 ISO/IEC 27001 PCI DSS EU-US DPF GDPR CCPA DSA VPAT Canva is reviewed and trusted by Expedia Group Salesforce T”
Verify on canva.com“Audit: Customer acknowledges that Canva is regularly audited against ISO 27001 standards by independent third party auditors.”
Verify on canva.com“We have introduced tools and processes to ensure we comply with GDPR requirements.”
Verify on canva.com“Canva for Education is certified compliant with FERPA. Canva has signed the National Data Privacy Agreement and State-level addenda.”
Verify on canva.com“Canva for Education's privacy policies are designed to meet responsibilities under the Family Educational Rights and Privacy Act (FERPA) and the Children's Online Privacy Protection Act (COPPA) and its compliance has been certified by iKeepSafe”
Verify on trust.canva.com“Get access Bulk download LEGAL Cyber Insurance REPORTS Pentest Report REPORTS PCI DSS REPORTS SOC 3 Report REPORTS Security & Privacy Overview SELF-ASSESSMENTS HECVAT Full SELF-ASSESSMENTS VSA Full SELF”
Verify on trust.canva.com“download LEGAL Cyber Insurance REPORTS Pentest Report REPORTS PCI DSS REPORTS SOC 3 Report REPORTS Security & Privacy Overview SELF-ASSESSMENTS HECVAT Full SELF-ASSESSMENTS VSA Full SELF-ASSESSMENTS CAIQ”
> Show 2 unconfirmed / not-held certifications
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Offered
Data region
Multi-region (US, Australia, Singapore, EU, UK, Philippines, New Zealand). Enterprise customers can set preferred data residency. AWS-hosted infrastructure.
For free and Pro users: AI training is enabled by default but users can opt out in privacy settings. For Teams, Business, Enterprise, and Education accounts: Content is NOT used to train AI and this cannot be turned on. Education users specifically: student content is never used for AI training.
// Security controls
// Products & data scope
Data it handles: Student designs, collaboration data. Student personal data NOT used for AI training.
Free for verified teachers and students. K-12 and higher education. FERPA/COPPA certified. No AI training on student content. LMS integrations with Google Classroom, Canvas, Blackboard, Schoology, D2L, Moodle, Microsoft Teams.
Data it handles: User designs and metadata. AI training opt-out available in privacy settings.
Free tier with basic design tools
Data it handles: User designs and metadata. AI training opt-out available in privacy settings.
Paid individual tier
Data it handles: Team/organizational designs. NOT used for AI training (cannot be enabled). SSO, SCIM, role-based access, audit logs.
Paid team/organizational tiers with enterprise features including data residency preference
// At a glance
Pricing model
Freemium (Free education tier; Free/Pro individual tiers; Teams/Business/Enterprise organizational tiers)
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Canva Pty Ltd's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.canva.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.