Canva
- Rank
- Score
- 41/149
- 49 out of 100
Canva, Inc. is an Australian software company founded in Perth in 2013 by Melanie Perkins, Cliff Obrecht and Cameron Adams and headquartered in Sydney. It runs a graphic design platform with AI features for presentations, social media and video, and in 2024 it acquired the AI image generation startup Leonardo AI.
Is Canva AI safe?
Canva AI scores 49 out of 100 and ranks 41 of 149. Its strongest category is Privacy, and its weakest category is Transparency.
How is Canva AI scored?
Canva AI is scored out of 100 on Safety (25%), Transparency (25%), Security (25%), and Privacy (25%). See how we score.
Compare
No problems found in 1 public record. That is not proof.
Safety framework
Average used24.4This outside rating doesn't cover this company, so the average of the companies it covers is used.
Pre-release testing
0Points for each confirmed yes.
- No
Was the model tested for dangerous capabilities, such as biological, chemical or cyber risks?
Company claim0/50No document found - No
Did an outside organisation test the model before release?
Company claim0/50No document found
Safety test results
Average used74.1This outside rating doesn't cover this company, so the average of the companies it covers is used.
Incident record
70This check counts only when a source covers the company. With no events it holds the pillar, which is not proof of a clean record. Each recorded event takes points off the pillar, and serious or recent ones count most. Allegation checks, regulator actions and open investigations use half the severity load. AI Incident Database and AIAAIC Repository, last 24 months.
No events
AllegationAI Incident Database (opens in a new tab) · 12 Nov 2026
Protecting children
50Points for each confirmed yes.
- No
Does the model card report child-safety tests or safeguards?
Company claim0/50No document found - Yes
Does the privacy policy set a minimum age, or say the service is not directed at children?
Company claim50/50“The Service and our content are not directed at children.”
canva.com privacy policy (opens in a new tab) · 23 Oct 2026
Model documentation
0Points for each confirmed yes.
- No
Does the model card describe what the model can do?
Company claim0/25No document found - No
Does the model card report test results?
Company claim0/25No document found - No
Does the model card state the model's limitations?
Company claim0/25No document found - No
Does the model card describe safety safeguards?
Company claim0/25No document found
Training-data disclosure
Average used29.9This outside rating doesn't cover this company, so the average of the companies it covers is used.
Independent transparency index
Average used40.7This outside rating doesn't cover this company, so the average of the companies it covers is used.
Transparency reports
Average used25This outside rating doesn't cover this company, so the average of the companies it covers is used.
Public safety commitments
0Average of the commitments signed.
- No
Has it signed the EU code of practice for general-purpose AI?
Company claim0/100European Commission (opens in a new tab) · 14 Oct 2026 - No
Did it sign only the safety and security chapter?
Company claim0/50European Commission (opens in a new tab) · 14 Oct 2026 - No
Has it signed the Frontier AI Safety Commitments (Seoul 2024)?
Company claim0/100Frontier AI Safety Commitments (opens in a new tab) · 14 Oct 2026
No problems found in 1 public record. That is not proof.
Security programme and certifications
67Points for each confirmed yes.
- Yes
Is there a way to report security flaws, such as a bug bounty?
Company claim34/34“Canva (bug bounty)”
bugcrowd.com (opens in a new tab) · 2 Nov 2026 - No
Does it state it holds a SOC 2 Type II report?
Company claim0/33canva.com security page (opens in a new tab) · 20 Oct 2026 - Yes
Does it state it holds ISO 27001 certification?
Company claim33/33“Canva has attained SOC2 Type II compliance and is ISO 27001 certified.”
canva.com security page (opens in a new tab) · 20 Oct 2026
Software vulnerabilities
Not enough dataData breaches
70This check counts only when a source covers the company. With no events it holds the pillar, which is not proof of a clean record. Each recorded event takes points off the pillar, and serious or recent ones count most. Allegation checks, regulator actions and open investigations use half the severity load. Confirmed data breaches, last 36 months.
No events
Independent sourceHave I Been Pwned (opens in a new tab) · 12 Nov 2026
Clear privacy policy
100Points for each confirmed yes.
- Yes
Does the privacy policy say what personal data is collected?
Company claim20/20“We may ask for certain information when you register for a Canva account or interact with us (such as a username, your first and last names,…” MoreLess
“We may ask for certain information when you register for a Canva account or interact with us (such as a username, your first and last names, birthdate, phone number, profession, physical and e-mail address).”
canva.com privacy policy (opens in a new tab) · 23 Oct 2026 - Yes
Does the privacy policy say whether your data is used to train AI?
Company claim20/20“For Service improvement (including analytics and machine learning): We may analyze your activity, content, media uploads and related data in…” MoreLess
“For Service improvement (including analytics and machine learning): We may analyze your activity, content, media uploads and related data in your account to provide and customize the Service, including generating and storing that data as Memories, and to train our algorithms, models and AI products and services using machine learning to develop, improve and provide our Service.”
canva.com privacy policy (opens in a new tab) · 23 Oct 2026 - Yes
Does the privacy policy say how long data is kept?
Company claim20/20“Following termination or deactivation of your user account, Canva will retain your profile information and User Content for a commercially r…” MoreLess
“Following termination or deactivation of your user account, Canva will retain your profile information and User Content for a commercially reasonable time, and for as long as we have a valid purpose to do so.”
canva.com privacy policy (opens in a new tab) · 23 Oct 2026 - Yes
Does the privacy policy say who your data is shared with?
Company claim20/20“We share your information with Canva affiliates and third-party service providers for the purpose of providing the Service to you, to facili…” MoreLess
“We share your information with Canva affiliates and third-party service providers for the purpose of providing the Service to you, to facilitate Canva’s legitimate interests or if you consent.”
canva.com privacy policy (opens in a new tab) · 23 Oct 2026 - Yes
Does the privacy policy explain your privacy rights?
Company claim20/20“Individuals in certain countries, including the European Union, United Kingdom, and Brazil have the right to: Request access to their inform…” MoreLess
“Individuals in certain countries, including the European Union, United Kingdom, and Brazil have the right to: Request access to their information; Request that we correct inaccuracies in their information; Request that their information be deleted or that we restrict access to it; Request a structured electronic version of their information; and Object to our use of their information.”
canva.com privacy policy (opens in a new tab) · 23 Oct 2026
Training-data defaults
50100 if training is opt-in only, 50 if you can opt out, 0 if neither.
- Not found
Is your data used for training only if you opt in?
Company claim0/100canva.com privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Can you stop your data being used for training?
Company claim50/50“Summary: You have control over whether Canva analyzes your data to build and improve AI features.”
canva.com privacy policy (opens in a new tab) · 23 Oct 2026
Export and delete your data
100Points for each confirmed yes.
- Yes
Can you get a copy of your data?
Company claim50/50“Individuals in certain countries, including the European Union, United Kingdom, and Brazil have the right to: Request access to their inform…” MoreLess
“Individuals in certain countries, including the European Union, United Kingdom, and Brazil have the right to: Request access to their information; Request that we correct inaccuracies in their information; Request that their information be deleted or that we restrict access to it; Request a structured electronic version of their information; and Object to our use of their information.”
canva.com privacy policy (opens in a new tab) · 23 Oct 2026 - Yes
Can you delete your data?
Company claim50/50“Individuals in certain countries, including the European Union, United Kingdom, and Brazil have the right to: Request access to their inform…” MoreLess
“Individuals in certain countries, including the European Union, United Kingdom, and Brazil have the right to: Request access to their information; Request that we correct inaccuracies in their information; Request that their information be deleted or that we restrict access to it; Request a structured electronic version of their information; and Object to our use of their information.”
canva.com privacy policy (opens in a new tab) · 23 Oct 2026
Privacy fines
Not enough dataIndependent privacy ratings
Average used52.9This outside rating doesn't cover this company, so the average of the companies it covers is used.
Risk governance
Average used26.6This outside rating doesn't cover this company, so the average of the companies it covers is used.
Regulator actions
Not enough dataCourt judgments
Not enough dataPrivacy contact and complaints
100Points for each confirmed yes.
- Yes
Is there a privacy contact, such as an email or a data protection officer?
Company claim50/50“The EDPO and EDPO UK can both be contacted at privacy@edpo.com.”
canva.com privacy policy (opens in a new tab) · 23 Oct 2026 - Yes
Does it tell you that you can complain to a regulator?
Company claim50/50“If we are unable to resolve your request, or if you are concerned about a potential violation, you also have the option to report the issue…” MoreLess
“If we are unable to resolve your request, or if you are concerned about a potential violation, you also have the option to report the issue or make a complaint to the data protection authority in your jurisdiction.”
canva.com privacy policy (opens in a new tab) · 23 Oct 2026
Score history
Newest first. Only days when the score changed are listed.
2 Nov 2026
Score 49
Method 2 Nov 2026
-1
1 Nov 2026
Score 50
Method 28 Oct 2026, update 2
-2
28 Oct 2026
Score 52
Method 28 Oct 2026, update 2
-8 · combines both 28 Oct updates (28 Oct 2026 - Update 1 and 28 Oct 2026 - Update 2)
23 Oct 2026
Score 60
Method 21 Oct 2026
+2
21 Oct 2026
Score 58
Method 21 Oct 2026
-2
20 Oct 2026
Score 60
Method Not recorded
-