// Trust & Security Report
Canva Pty Ltd
Canva Social is a social media design and content management feature within the Canva design platform. Includes social media content creation tools, content planner with scheduling, Magic Write AI caption generation, and brand kit management.
Certifications held
7
Maturity
Enterprise
Trains on your data
Yes
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on trust.canva.com“Canva has attained SOC2 Type II compliance, which demonstrates that the company has undergone independent audits of its security controls.”
Verify on canva.com“Canva is ISO 27001 certified. Canva will maintain an ISO 27001 certification, undergoing periodic external surveillance and recertification audits to ensure that its Information Security Management System (ISMS) meets the requirements of this standard.”
Verify on trust.canva.com“Canva's Trust & Security Portal displays ISO/IEC 27001, PCI DSS, EU-US DPF, GDPR, CCPA, DSA, and VPAT compliance documents.”
Verify on canva.com“Canva has introduced tools and processes to ensure it complies with GDPR requirements. Additionally, Canva meets globally recognized security standards, including SOC 2 Type II, ISO 27001, and GDPR.”
Verify on trust.canva.com“Canva's Trust & Security Portal displays compliance information for CCPA (California Consumer Privacy Act).”
Verify on trust.canva.com“Canva displays Digital Services Act (DSA) compliance on its trust portal.”
Verify on trust.canva.com“Canva's Trust & Security Portal includes VPAT (Voluntary Product Accessibility Template) compliance documentation.”
> Show 2 unconfirmed / not-held certifications
source: canva.comNo public evidence of HIPAA compliance found on Canva's trust center or security pages. While Canva holds healthcare/medical templates, no BAA (Business Associate Agreement) or HIPAA compliance documentation is publicly available.
source: trust.canva.comNo public evidence found on vendor domain. ISO 42001 is an emerging standard and Canva has not published any certification in this area as of July 2026.
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Offered
Data region
AWS data centers (primary US-based). Backups stored in geographically-separated location. Data transfers internationally protected with GDPR Standard Contractual Clauses and EU-US Data Privacy Framework.
Free and Pro users: Canva analyzes user content and activity to train AI algorithms and models. Users can opt-out in privacy preferences under 'AI personalization settings'. Business, Enterprise, and Education accounts: Customer content is NOT used for AI training by default, and this setting cannot be enabled. Education students have explicit carve-out: student user content will not be used for AI training.
// Security controls
Encryption in Transit
TLS 1.2 or higher for all data transmitted between customers and Canva application over public networks
canva.comData Centers
Amazon Web Services (AWS) with auto-scaling, multiple availability zones, 24x7 monitoring and support
canva.comBackup & Disaster Recovery
Backups stored in geographically-separated location from primary data centers
canva.comSecurity Governance
Chief Security Officer, Chief Privacy Officer, Chief Data Officer, and Information Security Committee (meets quarterly)
canva.comAI Safety Framework
Canva Shield: Safe, fair, and secure AI with indemnification for eligible enterprise customers in case of IP claims from AI-generated content
canva.com// Products & data scope
data: User content (designs, videos, images), user metadata, usage analytics, search queries
Social media content creation and planning tool. Features include drag-and-drop design, 30-second video/Reels creation, Brand Kit management, content scheduling and auto-posting, Magic Write AI captions, background removal, and analytics integration. Available on Free, Pro, Teams, Business, and Enterprise plans.
data: User designs, templates, media library, collaboration data, team/organization data
Broader design platform that includes social media tools. Free tier, Pro subscription, Teams subscription, Business, and Enterprise tiers each with different compliance and data handling practices.
// What to watch
- AI training default differs by plan tier: free/pro users' content is used for AI training (opt-out available), while enterprise/education users have explicit protection. Ensure AIFOXX displays this distinction clearly.
- HIPAA: No evidence of compliance. Canva is not HIPAA-certified and does not appear to offer BAAs. Users in healthcare should not rely on Canva for HIPAA-regulated content.
- ISO 42001 (AI governance): Not certified. Emerging standard not yet widely adopted.
- Trust center returns 403 access errors on some pages (canva.com/trust/compliance), but public documentation and newsroom statements confirm certification status.
// At a glance
Pricing model
Freemium (free with limited features) + subscription tiers (Pro, Teams, Business, Enterprise)
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Canva Pty Ltd's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.canva.com