Canva DIGITAL

Request ID: 08fdf8f5-a347-4e7b-900e-409370f4acc1 Evidence date: 7 October 2026 Target: Canva and controlled Canva-group businesses

Canva’s FY25 Anti-Slavery Statement identifies Canva Pty Ltd and Canva UK Operations Ltd as wholly owned subsidiaries of Canva Australia Holdings Pty Ltd; Canva Australia Holdings Pty Ltd is wholly owned by Delaware-incorporated Canva, Inc., which the statement identifies as the ultimate parent of the Canva group.¹ Canva’s procurement page says North American customers contract with Canva US, Inc., UK customers with Canva UK Operations Ltd, and all other customers with Canva Pty Ltd.²

Entity, group and ownership frame

The April 17, 2026 Canva subprocessor disclosure identifies Canva Austria GmbH, Canva Pty Ltd, Canva Solutions Inc., Canva US, Canva UK Operations Ltd, Leonardo.AI, Scene Group Ltd and Serif (Europe) Limited as Canva-group subprocessors, with stated processing locations outside Israel.³ The legal-group statement separately records subsidiaries under Canva Pty Ltd in the Philippines, Hong Kong, China, New Zealand, Japan, Korea, Singapore, Germany and Australia, and Canva Spain Operations under Canva UK Operations Ltd.¹

Canva announced its acquisition of Pexels and Pixabay on 17 May 2019 [pre-2020].⁴ Canva says it acquired Kaleido in 2021 and incorporated its technology into Canva’s product stack; Flourish also joined Canva in 2021.^{5, 6} Canva’s 2024 review records Affinity joining in March 2024 and Leonardo.Ai being acquired in July 2024.⁷ no public evidence identified in this acquisition review that those named acquisitions were Israeli-origin companies.^{4, 5, 7, 6}

Canva’s 2025 Impact Wrap says co-founders Melanie Perkins and Cliff Obrecht committed the vast majority of their equity, described as 30% of Canva, to the Step Two social-impact mission.⁸

At investor level, Square Peg says it first partnered with Canva in 2012 at seed stage.⁹ Its June 2024 investor letter reports a partial secondary sale of Canva during the first half of 2024; its December 2024 letter still names Canva among its four largest positions and records Canva among the year’s secondary transactions.^{10, 11} Square Peg’s June 2026 investor letter continues to discuss Canva among its existing portfolio companies, and Canva remains on Square Peg’s current portfolio page.^{12, 9} Square Peg’s current philosophy says it invests across Australia/New Zealand, Israel and Southeast Asia and names Fiverr, Aidoc and Tomorrow.io among its Israeli portfolio relationships.¹³ Those are Square Peg investments; no public evidence identified that Canva directs or controls those portfolio companies.^{10, 11, 9, 13} No current Square Peg percentage holding or Canva-specific governance right was identified in the reviewed primary sources.^{10, 11, 9, 12}

Blackbird stated on 25 August 2026 that it remains Canva’s largest investor shareholder “by a large margin,” without disclosing a current percentage.¹⁴ A Blackbird article dated 12 December 2021 [historical] said Blackbird then owned almost 15% of Canva and that Rick Baker was then one of four Canva board members; those figures are not treated as current 2026 disclosures.¹⁵ Canva’s own May 2024 Canva Create recap described Bob Iger as a “Canva Board Member” at that time.¹⁶ No reviewed Canva primary source established Iger’s appointment date or confirmed his board continuation through 7 October 2026, so no current-status inference is made from the May 2024 description.¹⁶

Enterprise Technology Stack & Vendor Relationships

Israeli-origin software and services

Check Point - evidenced procurement; deployment details unavailable. The Queensland Government’s CUATIS2024 contractor catalogue, updated in August 2026, profiles Baidam Solutions and lists Canva Pty Ltd among key customers for “Supply of CheckPoint Network Equipment and Firewalls.” The catalogue does not state when Canva bought the equipment, models, quantities, contract value or whether the deployment remains active.¹⁷ Check Point’s current FAQ states that Gil Shwed, Marius Nacht and Shlomo Kramer founded the company in 1993 and that its international headquarters are in Tel Aviv, Israel.¹⁸

Wiz - current material cloud-security relationship. Wiz’s current Canva customer case says Canva deployed Wiz Cloud across AWS and GCP for cloud-security posture management, vulnerability management and compliance; it reports onboarding within one week, broad internal adoption with more than 100 users, unified multi-cloud visibility and a pivotal role in Canva’s security program.¹⁹ Amazon’s profile of Wiz says Assaf Rappaport formed Wiz in early 2020 with former members of IDF Unit 8200.²⁰ That founder history establishes vendor provenance; it does not establish military use by Canva.^{19, 20}

SentinelOne - verified 2023 use; continuation unknown. SentinelOne stated on 20 June 2023 that Canva deployed its Singularity platform to protect endpoints, cloud workloads and its remote workforce.²¹ Reuters reported in 2017 [pre-2020] that SentinelOne was founded by Israelis and maintained an Israeli R&D centre.²² SentinelOne’s 2026 Form 10-K says its Tel Aviv office draws from Israeli military cybersecurity and intelligence talent.²³ No later Canva-specific source located in this review independently confirms whether the 2023 SentinelOne deployment remains active in 2026.^{21, 23}

For Check Point, Wiz and SentinelOne, no public evidence identified that Canva Customer Personal Data is stored or processed in Israel. Canva’s April 17, 2026 Customer Personal Data subprocessor list does not name those three security vendors, so their evidenced security relationships are not proof of an Israeli Customer Personal Data processing path.^{3, 17, 19, 21}

Other named Israeli-origin vendors. No public evidence identified of a verified Canva licensing, subscription or integration relationship with NICE, Verint, Claroty or CyberArk after focused searches. Search results that merely used Canva as an application/example were not treated as procurement evidence.^{3, 17, 19, 21}

Scale and integrators

AWS is core infrastructure for Canva: Canva’s technical measures state that the service is hosted and Customer Personal Data is stored within AWS data centres.²⁴ AWS Professional Services also describes building a Canva security data lake that processes more than 50 million log records per day for threat detection, historical digital forensics and threat hunting, with services including S3, Kinesis, Glue, Athena, Lambda and DynamoDB.²⁵

Baidam Solutions is the named intermediary for the Check Point equipment/firewall supply.¹⁷ Canva’s current partner directory lists Dubai-based Xanadu as a certified reseller for Canva Enterprise, Business and Campus and includes Israel among its countries of service; the page describes large-scale rollout, governance, SSO/provisioning, integrations and API-led automation.²⁶ The same page says Xanadu is deploying Canva Enterprise across government, higher-education and commercial organisations “in the region,” but it does not identify those organisations as Israeli, so that statement alone does not establish an Israeli-government deployment.²⁶

Surveillance, Biometrics & Retail Technology

Facial recognition and biometrics: no public evidence identified of Canva using Israeli-origin facial-recognition, biometric-identification, gait-analysis or retail computer-vision products from Trigo, BriefCam, AnyVision/Oosto, Trax or comparable vendors in the material reviewed.^{3, 25, 17, 19, 21}

Predictive analytics and monitoring: Canva operates substantial internal cyber-monitoring. AWS says its security data lake processes more than 50 million log records per day, enriches records with IP-location information and supports threat detection, forensics and threat hunting; Wiz and SentinelOne are also evidenced defensive security tools.^{25, 19, 21} no public evidence identified that those deployments are used for predictive policing, sentiment analysis, social-media monitoring or workforce surveillance.^{25, 19, 21}

Third-party deployment: no public evidence identified of Israeli-origin biometric or surveillance technology reaching Canva through a managed service or bundled suite. The April 2026 Canva subprocessor list identifies infrastructure and AI suppliers including AWS, Google, Anthropic, OpenAI and ElevenLabs, but it does not identify an Israeli-located Customer Personal Data subprocessor.³

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Hosting and data exposure

Canva’s current technical measures say Customer Personal Data is encrypted in transit over public networks using TLS 1.2 or higher, encrypted at rest using AES-256 or stronger, and stored in AWS data centres.²⁴ The April 2026 subprocessor list gives AWS processing locations as the United States and EU and Google as the United States; it also lists the named Canva AI subprocessors in non-Israel locations.³ Canva’s Trust Center says Canva stores user data in the United States and processes data through group members in Australia, New Zealand, the Philippines, the UK, Singapore, Europe and the United States.²⁷ Canva’s audit-log documentation enumerates data-residency values US, EU, AU, JP and ANY; Israel is not an enumerated residency option.²⁸

On the disclosed record reviewed, no public evidence identified of a Canva-operated or leased Israeli data centre, an Israeli Canva group Customer Personal Data processing entity, or a disclosed Customer Personal Data storage location in Israel.^{1, 3, 24, 27, 28} This does not establish the location of every security telemetry flow generated by Check Point, Wiz or SentinelOne.^{3, 17, 19, 21}

Israeli state-sector provision

An OpenBudget government-spending record reports that Israel’s Ministry of Foreign Affairs renewed Canva software licensing for an IT-training team through Business Design (L.A. Software) Ltd. It records a contract amount of NIS 1,709 and NIS 1,695 paid in 2024 under a small-value procurement exemption.²⁹ The record establishes indirect state procurement of Canva licences through a local supplier; it does not identify sensitive workloads or security/intelligence use.²⁹

Canva’s current partner directory separately confirms a certified commercial reseller channel whose stated countries of service include Israel.²⁶ Under Canva’s procurement rules, customers outside North America and the UK generally contract with Canva Pty Ltd; the public records above do not identify the Canva contracting entity used for the specific Israeli government transaction.^{2, 29}

Government cloud and sovereignty

UN A/HRC/59/23 discusses cloud, AI, surveillance and Project Nimbus in the Israel/OPT context, but the reviewed report does not identify Canva as a Nimbus provider.³⁰ The BDS corporate-priority guide names other technology providers in its advocacy framework but did not yield a Canva match in the reviewed text.³¹ Canva’s own use of AWS or Google does not establish Canva participation in Project Nimbus.^{3, 30, 31}

Government Cloud Contracts: no public evidence identified of Canva holding a Project Nimbus contract or providing cloud infrastructure to the Israeli government, military or intelligence services.³⁰

Data Sovereignty & Resilience Services: no public evidence identified of Canva marketing or contracting sovereign-cloud, data-sovereignty or infrastructure-resilience services specifically to Israeli military or security bodies.^{3, 30}

Defence, Intelligence & Security Sector Technology Relationships

Military & intelligence contracts: no public evidence identified of a verified Canva contract or service agreement with the Israeli Ministry of Defence, IDF, Mossad, Shin Bet or another Israeli security body in the reviewed sources and focused searches. The independently retrieved Israeli state-sector record is a small 2024 Ministry of Foreign Affairs licence renewal.²⁹

Dual-use technology provision: Canva is a general-purpose design and collaboration platform. No public evidence identified that Canva’s product, AI features, security stack or acquired businesses have been documented as deployed by Israeli military or intelligence bodies for surveillance or operational-security tasks.^{26, 29, 30} Individual or unaffiliated user activity was not treated as a Canva military contract.

Offensive cyber & weapons technology: no public evidence identified that Canva develops, sells, licenses or maintains zero-day exploit tooling, offensive cyber capabilities or digital weapons for Israeli state actors.³⁰ The Check Point, Wiz and SentinelOne relationships documented above are evidenced as Canva’s own defensive enterprise-security procurements/deployments.^{17, 19, 21}

AI, Algorithmic & Autonomous Systems

Canva’s current privacy disclosures describe use of content and activity in connection with AI features subject to product/account context and privacy settings, while the April 2026 subprocessor list identifies the external AI service providers and their disclosed processing locations.^{3, 27}

Canva’s Trust Center says creator content may be used to improve AI features unless creators opt out; user content and usage data are subject to account privacy settings. It says student content in Canva Education is excluded from AI improvement, and that Business, Teams and Enterprise content is currently excluded from such improvement by Canva and its partners. Third-party apps have their own terms and privacy policies; these published controls do not establish every security-telemetry flow.²⁷

In 2026, The Verge reported that Canva’s Magic Layers feature could replace the word “Palestine” with “Ukraine” when converting some designs into editable layers. Canva apologised, said the feature should preserve original content, fixed the behaviour and said it was adding safeguards.³² This is a verified Palestine-related AI/content-integrity incident; the report does not identify an Israeli state actor, Israeli vendor or surveillance-derived dataset as its cause.³²

AI/ML provision to Israeli state/security bodies: no public evidence identified of Canva providing AI/ML, computer-vision or autonomous decision-support systems to Israeli military, intelligence or security bodies.³⁰

Training data from Israel/OPT surveillance: no public evidence identified that Canva or Leonardo.Ai trained models on intercepted communications, military surveillance feeds or civilian-population surveillance datasets originating in Israel or the occupied Palestinian territory.^{3, 27, 30}

Autonomous systems & lethality: no public evidence identified of Canva or its controlled businesses providing autonomous target generation, fire-control, kill-chain automation or autonomous tracking systems to Israeli forces.³⁰

Technology Ecosystem & R&D Footprint

Israeli R&D centres: no public evidence identified of a Canva-operated Israeli R&D centre, engineering office or innovation lab. Canva’s FY25 legal-group statement and April 2026 group-subprocessor list name operating/group entities across several countries without identifying an Israeli Canva entity.^{1, 3} Canva’s procurement page likewise identifies contracting entities in Australia, the United States and UK, without an Israeli contracting entity.²

Acquisitions and investments: The verified acquisition trail reviewed here includes Pexels and Pixabay (2019 [pre-2020]), Kaleido (2021), Flourish (2021), Affinity (March 2024) and Leonardo.Ai (July 2024); current group disclosures also identify Serif, Leonardo.AI and Scene Group/Cavalry.^{3, 4, 5, 7, 6} no public evidence identified of Canva acquiring an Israeli-origin technology company or making a disclosed strategic investment in an Israeli technology startup or fund in this acquisition review.^{4, 5, 7, 6}

Patent/IP and academic co-development: no public evidence identified of a significant Canva patent-licensing or co-development arrangement with Technion, Hebrew University, Weizmann Institute or another Israeli research institution after focused searches.^{4, 5, 7, 6}

Controlling-principal / owner lens

Square Peg is a verified Canva investor, disclosed a partial Canva sale in 2024, continued to report Canva as a major holding later that year, and still discussed Canva as an existing portfolio company in its June 2026 investor letter.^{10, 11, 12} Square Peg also has a current Israel investment program and names Fiverr, Aidoc and Tomorrow.io among Israeli portfolio relationships.¹³ Those portfolio relationships are factual investor-level links; no public evidence identified that Canva controls those companies or directed Square Peg’s investments.^{10, 11, 9, 13}

Blackbird states in 2026 that it remains Canva’s largest investor shareholder by a large margin, but does not publish a current percentage in that statement.¹⁴ Its almost-15% figure and Rick Baker board reference come from 2021 and are treated as historical.¹⁵ Canva’s May 2024 page establishes Bob Iger’s board membership at that date, without establishing continuation through October 2026.¹⁶ No verified personal investment by Perkins or Obrecht in the named Israeli surveillance/cyber/SIGINT companies searched was identified in the reviewed sources.

Civil Society Scrutiny & Regulatory History

NGO/UN reports: The reviewed A/HRC/59/23 material does not identify Canva as a named technology provider in the report’s Project Nimbus/cloud/AI discussion.³⁰ Targeted searches of Who Profits, AFSC Investigate and OHCHR material did not surface a Canva-specific company record for the technology/settlement issues examined. Absence of a search result is not treated as proof that no indirect exposure exists.

Boycott/divestment campaigns: The BDS Movement corporate-priority guide reviewed did not yield a Canva match, although it names other technology companies and discusses Project Nimbus and settlement-linked corporate activity in its advocacy framework.³¹ no public evidence identified of Canva itself being a named priority target in that guide.³¹

Regulatory/legal actions: no public evidence identified of a sanctions, export-control, regulatory or legal action concerning Canva technology sales or services to Israeli state, military or settlement bodies in the reviewed material.^{30, 31}

Corporate political and humanitarian actions

Canva published a dedicated 2022 Ukraine statement [2022] condemning Russia’s invasion, describing product/content measures, announcing US$1 million in Canva Foundation donations for affected people and stating that Canva would match employee donations.³³

The review did not identify a dedicated Canva Newsroom statement dated October 2023 concerning Israel/Gaza. A contemporaneous 11 October 2023 report, however, contains a direct Canva spokesperson response stating that violent imagery in Students for Justice in Palestine templates breached Canva’s policies and had been removed; the spokesperson also expressed distress about violence in Israel and Gaza and sympathy for people affected.³⁴ This establishes a contemporaneous corporate content-moderation response and public statement, not a Canva payment or donation.³⁴ No payment or conduct by Disney is attributed to Canva on the basis of Bob Iger’s board role.¹⁶

A later humanitarian record is separately attributable. MSF Australia says it became a Crisis Response Partner of the Canva Foundation in 2025, receiving support for humanitarian crisis response plus Canva product access.³⁵ MSF Australia subsequently stated that Canva Foundation support helped it provide immediate medical humanitarian care in Gaza and Sudan during 2025.³⁶ Canva’s own 2025 Impact Wrap reports US$4.2 million donated toward crisis relief since 2021 but does not itemise a Gaza-specific amount in the public summary.⁸ No Gaza-specific monetary amount was identified in the reviewed Canva/MSF sources.^{35, 36, 8} The 2025 MSF evidence does not establish that Canva or the Canva Foundation made an October 2023 Gaza donation.^{35, 36}

Constructive-notice chronology and settlement nexus

Canva’s current certified-reseller listing shows that its general-purpose civilian product remains commercially available in Israel after 19 July 2024 and November 2024.²⁶ The 2024 Foreign Ministry licence record does not establish whether the procurement or payment decision occurred before or after 19 July 2024, so it is not used as post-notice timing evidence.²⁹

No public evidence identified of settlement-specific Canva provision, a Canva/reseller branch located in an Israeli settlement, or a Canva digital service contracted specifically for settlement administration in the West Bank, East Jerusalem or Golan Heights. The Israel-wide reseller service listing and civilian Foreign Ministry record do not identify settlement customers or locations.^{26, 29}