Parent Company
Canva Pty Ltd (Australia)
CLOUD Act Status
⚠ Indirect Exposure
Canadian Data Residency
✗ Not Available
Encryption
✗ Vendor-Managed Only
TIA / PIA Required
Yes — Law 25 & POPA
Incorporation
Australian Pty Ltd, 2012

Is Canva CLOUD Act exposed for Canadian organizations?

Not directly — and this is an important distinction. Canva Pty Ltd is incorporated in Australia and headquartered in Sydney. It was founded in 2013 by Melanie Perkins, Cliff Obrecht, and Cameron Adams. Unlike Adobe and Figma (both US-incorporated), Canva is not a US company and is not directly subject to the CLOUD Act.

However, Canva stores all data in the United States by default. The data sits on AWS infrastructure — a US company that is directly subject to the CLOUD Act. This creates the same "two pathways" problem we see with Monday.com: the vendor itself may not be reachable under the CLOUD Act, but the infrastructure provider is.

Canva offers data residency in the US and EU only — available on Enterprise, Campus, and District plans. No Canadian data residency is available, and notably, no Australian data residency either, despite Canva being an Australian company. Free, Pro, and Teams plan users have no control over data location — everything defaults to the US.

There's an additional sovereignty concern: Canva's AI features ("Magic Studio") involve a partnership with OpenAI, a US company. Design content processed through AI features may be transmitted to OpenAI's US-based infrastructure, adding another US data touchpoint even if you've configured EU data residency.

Regulatory Analysis

▾

CLOUD Act — indirect exposure

Canva Pty Ltd is not a US company. It is incorporated in Australia under Australian law. The CLOUD Act applies to US-based technology companies — Canva is not US-based. A US court cannot directly compel Canva to produce data under the Stored Communications Act.

However, Canva's data sits on AWS (Amazon Web Services), a US company subject to the CLOUD Act. The legal question is whether a US court order directed at AWS could compel production of data that AWS hosts on behalf of a foreign (Australian) company. This is the same analysis that applies to Monday.com (Israeli company on US infrastructure).

🍁
Your Canadian Data
Designs, images, brand assets
under PIPEDA / Law 25
🏢
Canva Pty Ltd
Sydney, Australia
Not a US company
☁️
AWS (US Infrastructure)
US-hosted by default
AWS is CLOUD Act exposed

Data sensitivity — what Canva stores

Canva processes designs, brand assets, images, presentations, and marketing materials. For most organizations, this is less sensitive than customer support data (Zendesk) or project management data (Asana). However, Canva designs may contain: internal communications, unreleased product information, employee photos, confidential presentations, and branded materials with proprietary business information. Organizations using Canva for HR materials or client-facing proposals face higher data sensitivity than a casual assessment might suggest.

Quebec Law 25

Quebec organizations using Canva must complete a Transfer Impact Assessment. Data leaves Quebec and is stored in the US (or EU on Enterprise). The TIA should document Canva's Australian incorporation as a jurisdictional advantage while noting US hosting. Penalties for non-compliance can reach $25 million or 4% of worldwide turnover. Upper Harbour provides compliance-ready TIA documentation starting at $99.

Alberta POPA

Alberta public bodies using Canva must complete a PIA. The OIPC template Section G should document Canva's Australian incorporation and the indirect nature of CLOUD Act exposure. For most design use cases, data sensitivity is lower than tools processing personal information directly — but if Canva is used for HR materials or internal communications, PIA requirements are more stringent. The PIA Research Tool generates these answers automatically.

BC FIPPA

BC public bodies should note Canva's Australian incorporation provides better jurisdictional positioning than US-incorporated alternatives. Data is hosted in the US with no Canadian residency option. Full FIPPA SaaS compliance guide →

AI features and OpenAI

Canva's "Magic Studio" AI features — including text-to-image, background removal, and writing assistance — involve a partnership with OpenAI. For Business and Enterprise accounts, Canva states that content is not used to improve AI features. However, the AI processing itself routes through OpenAI's US-based infrastructure, creating an additional US data touchpoint. For free and individual accounts, AI training opt-out must be configured manually in Privacy Settings.

Canva is one of 753 tools in the Upper Harbour Sovereignty Index. Design tools may seem lower risk than tools processing customer records or employee data — but if your compliance obligations cover Canva, they cover every tool in your stack. Most Canadian organizations use 15–30 SaaS products, and the majority are US-incorporated with higher sovereignty exposure than Canva.

Map your entire SaaS stack to parent jurisdictions and CLOUD Act exposure in 10 minutes.
Map Your Stack →

Alternatives & Comparison

▾

For organizations evaluating design tools through a sovereignty lens:

ToolOwnershipCLOUD ActCDN ResidencyCustomer Keys
CanvaAustraliaIndirectNoNo
Adobe Creative CloudUSExposedAvailableNo
FigmaUSExposedNoNo
PiktochartMalaysiaIndirectNoNo

Based on Upper Harbour Sovereignty Index data. March 2026.

Key finding: Canva has the best sovereignty positioning of any major design platform. Adobe and Figma are both US-incorporated and directly CLOUD Act exposed. Canva's Australian ownership provides a structural jurisdictional advantage. There are no major Canadian-owned design platforms at Canva's scale.

💬 Questions about Canva and Canadian compliance?

We help organizations assess jurisdictional risk across their SaaS stack. Book a call or send us a message.

Book a Call → Email Us →

Technical Architecture

▾

Data storage

Canva stores data on AWS. Default storage location is the United States. Enterprise, Campus, and District plan customers can choose between US and EU data residency — but the setting cannot be changed again until migration completes (which may take 30+ days). No Canadian, Australian, or Asia-Pacific data residency options are available.

Data is processed across multiple countries: Australia, New Zealand, Philippines, United Kingdom, Singapore, Europe, and the United States. Even with EU data residency enabled, processing may occur outside the EU.

Encryption

Canva encrypts data at rest (AES-256) and in transit (TLS/SSL). All encryption keys are managed by Canva — no customer-managed encryption (BYOK/CMK) is available. This is a significant gap compared to what Jira or Monday.com offer in their respective categories.

AI and third-party processing

Canva's AI features ("Magic Studio") are powered through a partnership with OpenAI. Design content processed through AI features may be sent to OpenAI's US-based infrastructure. For Business and Enterprise accounts, content is not used for AI training. Third-party apps available through canva.com/apps are governed by their own privacy policies.

Security posture

Canva maintains ISO 27001 certification, SOC 2 compliance, and conducts annual penetration testing. The company experienced a data breach in May 2019 that exposed data of approximately 139 million users (names, usernames, emails, geographic data, and password hashes). Staff access to customer data follows least-privilege principles with role-based access controls.

IPO implications

Canva is widely expected to pursue an IPO in 2025 or 2026. The appointment of former Zoom CFO Kelly Steckelberg in late 2024 signals IPO preparation. If Canva lists on a US exchange, it would increase US regulatory exposure — though listing alone does not change incorporation jurisdiction. Monitor for any incorporation changes associated with an IPO.

Mitigation Options

▾

Canva's Australian incorporation is the primary sovereignty advantage. Additional steps:

  • Enable EU data residency (Enterprise only): Select EU data residency to move your data off US soil. Combined with Australian ownership, this puts data on European infrastructure controlled by a non-US company — the best available configuration.
  • Disable AI features if sovereignty is critical: Canva's AI features route data through OpenAI (US). Evaluate whether AI features can be disabled organization-wide via Canva Shield.
  • Audit third-party apps: Apps from canva.com/apps are governed by their own privacy policies. Each integration adds a potential data flow to another jurisdiction.
  • Data minimization: Avoid storing sensitive personal information in Canva designs. HR materials with employee photos, internal communications with confidential details, and client-facing proposals with proprietary data all increase sensitivity.
  • Execute the DPA: Canva provides a Data Processing Agreement with Standard Contractual Clauses. Review against Law 25 or PIPEDA requirements.

Bottom line: Canva is the best-positioned major design platform for Canadian sovereignty. The main gaps are US-default hosting, no Canadian data residency, no customer-managed encryption, and the OpenAI partnership. For most organizations, design data is lower-sensitivity than customer support or project management data, making Canva's sovereignty profile acceptable with proper documentation.

Frequently Asked Questions

▾

Is Canva subject to the US CLOUD Act?

Not directly. Canva Pty Ltd is incorporated in Australia and is not a US company. However, data is stored primarily in the US on AWS infrastructure, creating indirect exposure through the US cloud provider — the same analysis that applies to other non-US companies hosting data on US infrastructure.

Does Canva offer Canadian data residency?

No. Canva offers data residency in the US and EU only, available on Enterprise, Campus, and District plans. Free, Pro, and Teams plan users have no control over data location — everything defaults to the US.

Does Canva use my data to train AI?

For Business and Enterprise accounts, Canva states that content is not used to improve AI features. For free and individual accounts, users must opt out via Privacy Settings. Canva's AI features involve a partnership with OpenAI — content processed through Magic Studio may be sent to OpenAI's US infrastructure.

Do I need a TIA for Canva under Law 25?

Yes. Data leaves Quebec and is stored in the US. A TIA is required regardless of Canva's Australian incorporation. Document the Australian ownership as a jurisdictional advantage while noting US hosting and the OpenAI processing pathway.

How does Canva compare to Adobe and Figma for sovereignty?

Canva has the best sovereignty positioning. Adobe and Figma are both US-incorporated and directly CLOUD Act exposed. Canva's Australian ownership provides a structural jurisdictional advantage that neither US competitor offers.

Is Canva safe for Canadian government use?

Canva's Australian incorporation provides better jurisdictional positioning than US alternatives. However, US-hosted data and no Canadian data residency mean a PIA is required. For design work without personal information, Canva's profile is generally acceptable. For designs containing sensitive information, document the residual risks.

Methodology: This assessment is based on Canva's corporate records (ASIC), vendor documentation, published DPA terms, and the Upper Harbour classification methodology. Data verified March 2026. Updated quarterly. Part of the Canadian Technology Sovereignty Index.