// Trust & Security Report
Canva Social
by Canva Pty Ltd
Canva Social is a social media design and content management feature within the Canva design platform. Includes social media content creation tools, content planner with scheduling, Magic Write AI caption generation, and brand kit management.
Certifications held
8
Maturity
Enterprise
Trains on your data
Yes
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on trust.canva.com“to our security documentation and audit reports through the portal. Compliance SOC 2 Type 2 ISO/IEC 27001 PCI DSS EU-US DPF GDPR CCPA DSA VPAT Canva is reviewed and trusted by Expedia Group Salesforce T”
Verify on trust.canva.com“documentation and audit reports through the portal. Compliance SOC 2 Type 2 ISO/IEC 27001 PCI DSS EU-US DPF GDPR CCPA DSA VPAT Canva is reviewed and trusted by Expedia Group Salesforce T-Mobile Stripe Airbnb”
Verify on trust.canva.com“Get access Bulk download LEGAL Cyber Insurance REPORTS Pentest Report REPORTS PCI DSS REPORTS SOC 3 Report REPORTS Security & Privacy Overview SELF-ASSESSMENTS HECVAT Full SELF-ASSESSMENTS VSA Full SELF”
Verify on canva.com“We have introduced tools and processes to ensure we comply with GDPR requirements.”
Verify on trust.canva.com“Canva's Trust & Security Portal displays compliance information for CCPA (California Consumer Privacy Act).”
Verify on trust.canva.com“Canva displays Digital Services Act (DSA) compliance on its trust portal.”
Verify on trust.canva.com“Canva's Trust & Security Portal includes VPAT (Voluntary Product Accessibility Template) compliance documentation.”
Verify on trust.canva.com“download LEGAL Cyber Insurance REPORTS Pentest Report REPORTS PCI DSS REPORTS SOC 3 Report REPORTS Security & Privacy Overview SELF-ASSESSMENTS HECVAT Full SELF-ASSESSMENTS VSA Full SELF-ASSESSMENTS CAIQ”
> Show 2 unconfirmed / not-held certifications
source: canva.comNo public evidence of HIPAA compliance found on Canva's trust center or security pages. While Canva holds healthcare/medical templates, no BAA (Business Associate Agreement) or HIPAA compliance documentation is publicly available.
source: trust.canva.comNo public evidence found on vendor domain. ISO 42001 is an emerging standard and Canva has not published any certification in this area as of July 2026.
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Offered
Data region
AWS data centers (primary US-based). Backups stored in geographically-separated location. Data transfers internationally protected with GDPR Standard Contractual Clauses and EU-US Data Privacy Framework.
Free and Pro users: Canva analyzes user content and activity to train AI algorithms and models. Users can opt-out in privacy preferences under 'AI personalization settings'. Business, Enterprise, and Education accounts: Customer content is NOT used for AI training by default, and this setting cannot be enabled. Education students have explicit carve-out: student user content will not be used for AI training.
// Security controls
Encryption in Transit
TLS 1.2 or higher for all data transmitted between customers and Canva application over public networks
canva.comData Centers
Amazon Web Services (AWS) with auto-scaling, multiple availability zones, 24x7 monitoring and support
canva.comBackup & Disaster Recovery
Backups stored in geographically-separated location from primary data centers
canva.comSecurity Governance
Chief Security Officer, Chief Privacy Officer, Chief Data Officer, and Information Security Committee (meets quarterly)
canva.comAI Safety Framework
Canva Shield: Safe, fair, and secure AI with indemnification for eligible enterprise customers in case of IP claims from AI-generated content
canva.com// Products & data scope
Data it handles: User content (designs, videos, images), user metadata, usage analytics, search queries
Social media content creation and planning tool. Features include drag-and-drop design, 30-second video/Reels creation, Brand Kit management, content scheduling and auto-posting, Magic Write AI captions, background removal, and analytics integration. Available on Free, Pro, Teams, Business, and Enterprise plans.
Data it handles: User designs, templates, media library, collaboration data, team/organization data
Broader design platform that includes social media tools. Free tier, Pro subscription, Teams subscription, Business, and Enterprise tiers each with different compliance and data handling practices.
// What to watch
- AI training default differs by plan tier: free/pro users' content is used for AI training (opt-out available), while enterprise/education users have explicit protection. Ensure AIFOXX displays this distinction clearly.
- There is no evidence of HIPAA compliance. Canva is not HIPAA-certified and does not appear to offer BAAs; users in healthcare should not rely on Canva for HIPAA-regulated content.
- ISO 42001 (AI governance): Not certified. Emerging standard not yet widely adopted.
- Trust center returns 403 access errors on some pages (canva.com/trust/compliance), but public documentation and newsroom statements confirm certification status.
- compare.trains_on_data recorded as: Varies by plan: Free/Pro/Teams yes (with opt-out); Business/Enterprise/Education no
// At a glance
Pricing model
Freemium (free with limited features) + subscription tiers (Pro, Teams, Business, Enterprise)
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Canva Pty Ltd's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.canva.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.