Skip to main content
ShadowAI Defense GitHub
← All services

Canva · Productivity

Canva AI (Magic Studio)

Allow Enterprise Enterprise tier: Available DPA: Yes

Network signatures

Domains: canva.com, www.canva.com

API endpoints: api.canva.com

SNI patterns: *.canva.com

Client signatures

Process names: Canva.exe (Windows), Canva.app (macOS)

Mobile apps: Canva iOS; Canva Android

Risk profile (1–5)

  • Data exfiltration: 3
  • IP loss: 3
  • Output quality (hallucination / legal): 2
  • Integration risk (OAuth, extensions, agentic): 2

Data egress concerns

  • Brand kit assets (logos, fonts, color palettes) uploaded to Canva are stored on vendor infrastructure
  • Design templates for internal communications may contain sensitive organizational charts or financial data
  • Magic Write text generation receives document context that may include confidential content
  • Magic Eraser and background removal process images through cloud AI pipelines
  • Shared design workspaces may expose internal materials to unauthorized collaborators

Training-use default

Canva states that Enterprise plan content is not used for AI training. Free and Pro tier content handling should be verified against current terms. Magic Studio features route through third-party AI providers whose policies also apply.

Applicable detection rules

References