Canva

canva.com

Canva declares 18 subprocessors, plus 5 of its own affiliates, in its subprocessor list, which we last checked on Nov 10, 2026 (evidence). They include Amazon Web Services, Google Cloud and OpenAI. No published changes since we first read it on Sep 28, 2026. 4 tracked vendors name Canva as a subprocessor, including remove.bg, FullFunnel and Donut.

Includes: remove.bg

Subprocessors CSV · Atom DORA draft CSV what's this? · 

18 third parties, 5 affiliates.

NamePurposeLocationListed since
Amazon Web Services, Inc. Platform Hosting, Infrastructure and Canva AI ServicesUnited States & EU
Anthropic PBC AICanva AI ServicesUnited States
Assembled, Inc. Support ManagementUnited States
Concentrix Daksh Services Philippines Corporation Customer SupportPhilippines
DeepL GmbH Translation ServicesEU
ElevenLabs Inc. AICanva AI ServicesUnited States
Features & Labels, Inc. Canva AI ServicesUnited States
Google LLC Platform Hosting, Infrastructure, Security and Canva AI ServicesUnited States
IBEX Global Solutions Customer SupportUnited States
Kaizo Operations B.V. Support ManagementEU
Leonardo.AI Canva & Affinity AI ServicesAustralia & United States
MongoDB, Inc. Platform Hosting and InfrastructureUnited States
Nanonoble Pte. Ltd. Canva AI ServicesUnited States
OpenAI, LLC AICanva AI ServicesUnited States
Scene Group Ltd Service Provider of CavalryEU
Serif (Europe) Limited Service Provider of AffinityEU
Snowflake Inc. Platform Hosting and InfrastructureUnited States
Zendesk, Inc. Support ManagementUnited States
Canva affiliates (5)
NamePurposeLocationListed since
Canva Pty Ltd Support ManagementAustralia
Canva Austria GmbH Canva and Affinity Photo and Video AI ServicesEU & United States
Canva Solutions Inc. Support ManagementPhilippines
Canva UK Operations Limited Support Management and Service Provider of Flourish and Canva ChartsEU
Canva US, Inc. Support Management and Print ServicesUnited States

Web TechnologiesCSV · Atom

Canva's homepage made 91 requests to 15 domains, 8 services controlled by another company, and 1 domain not identified.

Advertising (3): Reddit, Inc., Microsoft; reviewed: InnovidAnalytics (3): Meta, Cloudflare, LinkedInTag managers (1): Google CloudOther (1): usually detected as Issue trackers: Sentry

8 third parties by category: Advertising 3Analytics 3Tag managers 1Other 1

Third parties 8 · 33 requests
Meta Facebook Pixel 15% of the page's requests 14
Google Cloudsubprocessor Google Sign-in Google Tag Manager 4% of the page's requests 4
Reddit, Inc. Reddit Ads 4% of the page's requests 4
Microsoft Microsoft Advertising 3% of the page's requests 3
Sentry sentry.io 3% of the page's requests 3
Cloudflare Cloudflare Browser Insights cdnjs crypto-js 4.0.0 2% of the page's requests 2
LinkedIn Linkedin Insight Tag 2% of the page's requests 2
Innovid tvsquared.com 1% of the page's requests 1
Unknown 1 · 4 requests

advertisinganalytics.com

First party 1 · 54 requests
Canva Cloudflare HSTS MobX Open Graph Sentry core-js 3.32.2 59% of the page's requests 54

6 tracked companies loaded by the homepage are not in Canva's subprocessor list. A website can use a service without it processing customer data.

Subprocessor of (4)CSV · Atom

4 companies
  • Donut donut.com Content design and creation
  • FullFunnel fullfunnel.co Brand and design assets
  • ParentSquare parentsquare.com Connection between ParentSquare and district staff Canva account. No personally identifiable information is processed or stored.
  • remove.bg remove.bg Support management and communication; Support management and Printing and Distribution Services

Security recordCSV · Atom

What public security catalogs list for Canva, in their words.

Data breaches

  • Canva 137,272,116 accounts Email addresses; Geographic locations; Names; Passwords; Usernames

    In May 2019, the graphic design tool website Canva suffered a data breach that impacted 137 million subscribers. The exposed data included email addresses, usernames, names, cities of residence and passwords stored as bcrypt hashes for users not using social logins.

    Have I Been Pwned

Breach data: Have I Been Pwned (CC BY 4.0), which calls every entry a breach, including data scraped from public pages (evidence)

Service statusCSV · Atom

Aug 14: no incident reportedAug 15: no incident reportedAug 16: no incident reportedAug 17: no incident reportedAug 18: no incident reportedAug 19: no incident reportedAug 20: no incident reportedAug 21: no incident reportedAug 22: no incident reportedAug 23: no incident reportedAug 24: no incident reportedAug 25: no incident reportedAug 26: no incident reportedAug 27: no incident reportedAug 28: no incident reportedAug 29: no incident reportedAug 30: no incident reportedAug 31: no incident reportedSep 1: no incident reportedSep 2: no incident reportedSep 3: no incident reportedSep 4: no incident reportedSep 5: no incident reportedSep 6: no incident reportedSep 7: no incident reportedSep 8: no incident reportedSep 9: no incident reportedSep 10: no incident reportedSep 11: no incident reportedSep 12: no incident reportedSep 13: no incident reportedSep 14: no incident reportedSep 15: no incident reportedSep 16: no incident reportedSep 17: no incident reportedSep 18: no incident reportedSep 19: no incident reportedSep 20: no incident reportedSep 21: no incident reportedSep 22: no incident reportedSep 23: no incident reportedSep 24: no incident reportedSep 25: no incident reportedSep 26: no incident reportedSep 27: no incident reportedSep 28: no incident reportedSep 29: no incident reportedSep 30: no incident reportedOct 1: no incident reportedOct 2: no incident reportedOct 3: no incident reportedOct 4: no incident reportedOct 5: no incident reportedOct 6: no incident reportedOct 7: no incident reportedOct 8: 1 incident (1 major)Oct 9: no incident reportedOct 10: no incident reportedOct 11: no incident reportedOct 12: no incident reportedOct 13: no incident reportedOct 14: no incident reportedOct 15: no incident reportedOct 16: no incident reportedOct 17: no incident reportedOct 18: no incident reportedOct 19: no incident reportedOct 20: no incident reportedOct 21: no incident reportedOct 22: no incident reportedOct 23: no incident reportedOct 24: no incident reportedOct 25: no incident reportedOct 26: no incident reportedOct 27: no incident reportedOct 28: no incident reportedOct 29: no incident reportedOct 30: no incident reportedOct 31: no incident reportedNov 1: no incident reportedNov 2: no incident reportedNov 3: no incident reportedNov 4: no incident reportedNov 5: no incident reportedNov 6: no incident reportedNov 7: no incident reportedNov 8: no incident reportedNov 9: no incident reportedNov 10: no incident reportedNov 11: no incident reported

90 days agotoday

  • 1 incident in 90 days
  • 1 major or critical
  • 37 min typical time to resolve
  • 37 min longest major
BeganIncidentImpactLasted
Some users may have issues using Canvamajor37 min
Some users may have issues with payments in Canvamajor1 h 3 min
Some users may have issues using Canvamajor19 min
Some users may have issues downloading video designsmajor8 h 51 min
Users may have issue with Signup/Login via Microsoftminor6 h 38 min
Some users may have issues using Canvaminor1 h 13 min
Some users may experience issues with formulas in downloaded Sheetsminor18 h 24 min
Users may experience errors uploading mediamajor1 h 50 min

Incidents per month

0 4 8 Dec 2025: 2 incidents (2 critical) · typical time to resolve 3 h 25 min Jan 2026: 4 incidents (3 major, 1 minor) · typical time to resolve 3 h 40 min Feb 2026: 0 incidents Mar 2026: 3 incidents (2 critical, 1 major) · typical time to resolve 38 min Apr 2026: 8 incidents (2 critical, 3 major, 1 minor, 2 no impact stated) · typical time to resolve 1 h 11 min May 2026: 8 incidents (6 major, 2 minor) · typical time to resolve 1 h 7 min Jun 2026: 8 incidents (5 major, 3 minor) · typical time to resolve 50 min Jul 2026: 8 incidents (4 major, 4 minor) · typical time to resolve 6 h Aug 2026: 0 incidents Sep 2026: 0 incidents Oct 2026: 1 incident (1 major) · typical time to resolve 37 min Nov 2026: 0 incidents Dec 2025Jan 2026Feb Mar Apr May Jun Jul Aug Sep Oct Nov

critical major minor no impact stated

As Canva's status page reports its own incidents (scheduled maintenance left out), read every few hours since (evidence)

Incidents reported by Canva's subprocessorsCSV · Atom

85 reported incidents in the last 30 days, by 5 of the vendors Canva lists as subprocessors.

A subprocessor list names a company, not the service an incident touched. This does not show that Canva was involved.

DateCompanyIncidentImpactLasted
ElevenLabsScribe v3 Live outage major1 h 53 min
AnthropicElevated errors on Fable 52 and Mythos 52 no impact stated1 min
OpenAIIncorrect cost data in Costs API exports no impact stated2 h 20 min
OpenAIElevated Errors On API minor42 min
OpenAIElevated ChatGPT Conversation Errors minor52 min
OpenAIElevated errors with image generation minor1 h 49 min
AnthropicDegraded performance for Claude Fable 5.1 minor26 min
SnowflakeINC20000337 minor2 h 5 min
SnowflakeINC20000336 minor3 h 20 min
ElevenLabsChoppy audio on Agent conversations using Eleven v4 Turbo minor—
ElevenLabsChoppy audio on Agent conversations using Eleven v4 Turbo minor—
OpenAIElevated error rates with some U.S. business Mastercards no impact stated3 days
OpenAIChatGPT Work and Dots Errors minor13 h 6 min
OpenAIElevated error rates across paid ChatGPT plans minor1 h 54 min
ElevenLabsIntermittent Sign in issue no impact stated2 h 30 min
OpenAIFile upload errors in ChatGPT minor4 h 52 min
SnowflakeINC20000321 minor3 h 25 min
OpenAIElevated errors with search in Dots, ChatGPT Work, and certain ChatGPT thinking experiences minor1 h 35 min
OpenAIElevated errors for GPT Image 2 API image edits minor4 h 1 min
ElevenLabsElevenCreative - Image & Video - Degraded performance minor1 h 42 min
SnowflakeINC20000319 minor21 h 27 min
AnthropicElevated errors affecting the Google Calendar connector minor3 h 46 min
AnthropicElevated errors affecting the Gmail connector minor1 h 48 min
AnthropicElevated errors for Claude Sonnet 5.5 major41 min
OpenAI6.1 Sol Degraded Model Performance minor1 h 17 min

And 60 more. All of them: CSV · Who is around them.

Federal contractsCSV · Atom

By funding agency. UEI TZ8JGM4GJX35 · checked Nov 5, 2026 · snapshot

AgencyPrime awardsObligatedSubawardsSubaward totalYears
Smithsonian Institution 2$289.4K——2024–2025
U.S. Fish and Wildlife Service Department of the Interior1$39.5K——2024
Executive Office of the President new 1$20.0K——2026
Drug Enforcement Administration Department of Justice5$8.0K——2024–2026

All 9 records

Prime awards and subawards reported by prime contractors. Purchases through a reseller name the reseller, not the vendor.

ChangesCSV · Atom

See the list as we read it on any date: Time machine

None since tracking began.

Rating badge for Canva's site

Canva transparency rating

It updates with the rating.

<a href="https://thirdpartyindex.com/vendors/canva"><img src="https://thirdpartyindex.com/badge/canva.svg" alt="Canva transparency rating on Third Party Index" height="20"></a>
[![Canva transparency rating on Third Party Index](https://thirdpartyindex.com/badge/canva.svg)](https://thirdpartyindex.com/vendors/canva)