also searched as: is canva safe · is canva safe to use · was canva hacked · canva security breach · is canva secure · is canva a safe website · is canva com safe
Yes for most people: Canva keeps designs private by default, says it holds SOC 2 and ISO 27001, and has had one confirmed breach, in 2019. Check two settings: the AI toggles, whose default Canva does not state, and ad sharing, which runs until you opt out.
Use it if you make posts, flyers and slides, and you check Privacy controls before your first upload.
Be careful if an unexpected Canva share email leads to a sign-in page, because attackers send real Canva notifications.
Skip it if your child is under 13 and their school does not run Canva for Education, since regular Canva does not allow them.
sources checked 2026-10-13 · by dan scutaru
| what we checked | what we found |
|---|---|
| Who owns it | Canva Pty Ltd, Australia Registered in Sydney; US users contract with its subsidiary, Canva US, Inc. source |
| Breach | 2019, up to 139 million profiles Names, emails and hashed passwords taken; about 4 million passwords were cracked by January 2020 and reset. source |
| Certifications | SOC 2 Type II, ISO 27001 Canva's own claim; it says designs are encrypted with AES-256 at rest. source |
| Used to train AI | Per your privacy toggles Free and Pro can switch it off; Business, Teams, Enterprise and Education content is never used. source |
| Sold or shared | Shared with ad partners Email, location and usage go to partners such as Facebook, Google and LiveRamp; US users can opt out. source |
| Age limit | 13+, younger only via school Canva for Education is listed by iKeepSafe as COPPA Safe Harbor and FERPA certified. source |
| Scam abuse | Documented since 2020 Cofense (2020) and IRONSCALES (2026) found phishing pages hosted in shared designs. source |
One confirmed breach. On May 24, 2019 an attacker took names, emails, cities and bcrypt-hashed passwords for up to 139 million users; Canva says designs, stored separately, were not touched. By January 2020 about 4 million passwords had been cracked, and Canva reset all unchanged ones.
The school breach in the news in May 2026 was Canvas, Instructure's learning platform. Different company.
Canva Pty Ltd, registered in Sydney, Australia. Its trust page says your data is stored in the United States and processed by staff in Australia, the Philippines and four other regions. The clause people miss: sign up with your employer's email domain and Canva may give your employer's admin control of the account and every design in it.
Only as far as your privacy toggles allow, and Canva does not say where they start. Until October 2025 its terms said your content was used only if you "opt-in"; the current terms dropped that word. A March 2025 test by The Phoblographer found the usage toggle already on in a new account. Business, Teams, Enterprise and Education content is never used.
The likelier risk is the share button. IRONSCALES documented an attacker who built a free design linking to a fake login page and shared it, so the email really came from Canva and passed SPF, DKIM and DMARC. A design asking for your Microsoft or bank password is the tell.
Yes. Its iPhone app, sold by Canva Pty Ltd, averages 4.9 stars from over 3.5 million US ratings. Scammers borrow its name.
That Canva does not sell your data to ad networks for their own marketing, but shares your email and usage with them to target ads. US users can opt out. Its Google Play label says "No data shared with third parties".
Mostly. Ads, packaging and printed material for resale are allowed; library elements in a logo or trademark, or sold on their own, are not. You own AI output unless it edits library content.
For K-12 students in a teacher's Canva for Education class, yes: no ads, no AI training on their work. Outside a school account, under-13s are not allowed.