Canva
Design · canva.com · last read 2026-10-12
Identity
| Legal entity | Canva Pty Ltd |
|---|---|
| HQ | AU |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | 98450090RD6DF9XD1546 |
| US CLOUD Act reach | Not determined from the sources read |
| Source | canva.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Enterprise only | Enterprise | canva.com | 2026-10-08 |
EU: Organization Admins can choose the European Union as their data residency region, but the organization must be on an Enterprise, Campus, or District plan. The document gives no price for this setting.
Subprocessor chain
15 third parties · 8 of the vendor's own group companies · 18 with a country outside the EEA · all read 2026-10-09
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services, Inc. | US, EU | Platform Hosting, Infrastructure and Canva AI Services |
| Anthropic PBC | US | Canva AI Services |
| Assembled, Inc. | US | Support Management |
| Concentrix Daksh Services Philippines Corporation | PH | Customer Support |
| DeepL GmbH | EU | Translation Services |
| ElevenLabs Inc. | US | Canva AI Services |
| Features & Labels, Inc. | US | Canva AI Services |
| Google LLC | US | Platform Hosting, Infrastructure, Security and Canva AI Services |
| IBEX Global Solutions | US | Customer Support |
| Kaizo Operations B.V. | EU | Support Management |
| MongoDB, Inc. | US | Platform Hosting and Infrastructure |
| Nanonoble Pte. Ltd. | US | Canva AI Services |
| OpenAI, LLC | US | Canva AI Services |
| Snowflake Inc. | US | Platform Hosting and Infrastructure |
| Zendesk, Inc. | US | Support Management |
Canva's own group companies listed as subprocessors (8)
| Company | Country | Purpose |
|---|---|---|
| Canva Austria GmbH | EU, US | Canva and Affinity Photo and Video AI Services |
| Canva Pty Ltd | AU | Support Management |
| Canva Solutions Inc. | PH | Support Management |
| Canva UK Operations Limited | EU | Support Management and Service Provider of Flourish and Canva Charts |
| Canva US, Inc. | US | Support Management and Print Services |
| Leonardo.AI | AU, US | Canva & Affinity AI Services |
| Scene Group Ltd | EU | Service Provider of Cavalry |
| Serif (Europe) Limited | EU | Service Provider of Affinity |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · canva.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK Addendum |
| Transfer mechanism | other |
| Notice of new subprocessors | At least 30 days prior notice by posting details on Canva's subprocessors web page; notification mechanism provided |
| If you object to one | Object on data protection grounds to [email protected] within 10 days of notification; if Canva requires the subprocessor and cannot resolve the objection, customer may terminate the applicable Order Form for affected Services |
| Breach notification | without undue delay |
| Audit | Summary copy of ISO 27001 third-party audit report(s) on request, kept confidential; written audit questions answered at most once per year; SCC Clause 8.9 audit rights exercised through these measures |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
No certification claims transcribed yet.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Canva US, Inc. | Active | non-HR data | 2027-03-30 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Canva US, Inc. | Active | non-HR data | 2027-03-30 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Canva US, Inc. | Active | non-HR data | 2027-03-30 | 2026-10-09 |
| Global LEI Index (GLEIF) | CANVA PTY LTD · CANVA PTY LTD | ISSUED | AU | 2027-05-22 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Canva; Canva Pty Ltd
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Canva; Canva Pty Ltd
- Data Privacy Framework List (US): checked 2026-10-12, 3 entries under Canva; Canva Pty Ltd
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Canva; Canva Pty Ltd
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Canva; Canva Pty Ltd
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Canva; Canva Pty Ltd
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: canva.com, canva.com (security.txt, no Expires field; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| dpa | Public | full | 200 | 2026-10-09 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-09 |
History
Nothing has moved since we started watching this vendor on 2026-10-09. Changes appear here only after a human has reviewed them.