← All tool ratings

Canva

Design tool for social media graphics, presentations, and basic video. Free tier is genuinely useful. AI features expanding fast.

Adequate
https://www.canva.com Reviewed 2026-04-02 Editorial assessment by Mike Schneider — not an independent security audit

What should journalists know about Canva?

Canva is the practical choice for journalists who need visuals but don't have design skills or Adobe subscriptions. The free tier is genuinely useful. Since 2024, Canva has been on an acquisition tear — Leonardo AI for image generation, Affinity for professional photo/vector/layout editing (now free), Flourish for data visualization, Cavalry for animation. The result is a platform that keeps absorbing capabilities that used to require separate tools. The AI features (Magic Studio) are aggressive: 800 million AI tool uses per month as of 2025, up 700% year-over-year. For public-facing graphics and presentations, it's hard to beat the speed. But the 2024 pricing debacle — a 300% hike announced via quiet emails, then walked back after backlash — reveals a company that will test how much it can extract from locked-in users. With 265 million MAUs, 31 million paying, and $3.5B in 2025 revenue, Canva has scale. Use it for what it's good at. Don't store sensitive material on it.

Best for

Social media graphics and story cards. Presentation slides for events or pitches. Quick infographics when Datawrapper or Flourish are overkill. Newsletter header images. Basic video editing for social clips. Data visualization via built-in Flourish integration.

Not for

Complex data visualization (use Flourish standalone or Datawrapper). Print design with precise typography (use Affinity Publisher or InDesign). Complex video editing (use DaVinci Resolve). Work where template aesthetics are a concern — Canva output is recognizable. Anything involving confidential source material or sensitive documents.

Security & Privacy

Encryption in transit Yes

Data is scrambled while being sent to their servers

Encryption at rest Yes

Data is scrambled when stored on their servers

Data jurisdiction Australia (Canva Pty Ltd, headquartered in Sydney). Data stored across multiple regions including US and EU. SOC 2 Type II compliant and ISO 27001 certified.

Where servers are located — affects which governments can request your data

Security rating Adequate

Privacy policy summary

Account required (email or Google/Facebook login). Designs stored on Canva servers, private by default unless shared. For individual free/Pro users, Canva does NOT use your content to train AI by default — you can opt in via Privacy preferences. For Teams, Business, Enterprise, and Education accounts, content is never used for AI training and this cannot be toggled on. Canva Creators can opt out of AI training. Canva committed $200M in content and AI royalties to creators over three years.

How to protect yourself:

Don't upload sensitive or confidential images — they're stored on Canva's servers. Verify your account's AI training setting in Privacy preferences (should be off by default for individuals, always off for Teams/Business/Enterprise). Use the download feature to keep local copies of everything. For sensitive presentations, use a local tool like Affinity or LibreOffice Impress instead. If your newsroom qualifies as a 501(c)(3), apply for Canva for Nonprofits — free Pro for up to 50 users.

SOC 2 Type II and ISO 27001 certified. Canva Shield provides enterprise-grade AI governance, SSO, SCIM provisioning, and audit logs. AI training policy is clear and favorable: off by default for individuals, always off for Teams/Business/Enterprise. The 2019 breach (139M records) is old but large. Current security posture is standard for a company at this scale. Not suitable for confidential source material, but fine for public-facing production work.

Who Owns This

Owner Canva Pty Ltd (Australian private company, headquartered in Sydney). Not publicly listed — IPO expected on NASDAQ in second half of 2026. Last private valuation: US$42B (August 2025 employee share sale). Co-founders Melanie Perkins (CEO), Cliff Obrecht, Cameron Adams.
Funding Venture-backed, pre-IPO. Major investors: Sequoia, Blackbird Ventures, Felicis, T. Rowe Price. August 2025 secondary share sale at $42B valuation. Blackbird has told LPs to expect a 2H 2026 NASDAQ listing.
Business model Freemium SaaS. $3.5B revenue in 2025. 265M monthly active users, 31M paid subscribers. B2B segment (25+ seats) hit $500M ARR with 100% growth. Enterprise tier, Canva Print for physical products. Acquisitions expanding the platform: Leonardo AI (image generation), Affinity (professional editing suite, now free), Flourish (data viz), MagicBrief (ad intelligence), Cavalry (animation), MangoAI (ad performance).

Known issues

2019 data breach exposed 139 million user records (usernames, emails, bcrypt-hashed passwords). Canva forced password resets. In 2025, a third-party AI company (My Jedai) exposed survey data from 571 Canva Creators — not a Canva breach, but a reminder that ecosystem partners handle your data too. Late 2024 pricing crisis: Canva attempted a 300% price hike on Teams plans with minimal notice, communicated via quiet emails rather than public announcements. Reversed after significant subscriber backlash, but the move signaled willingness to squeeze locked-in users. Canva output is visually identifiable — the 'Canva look' can undermine credibility for outlets that want a distinctive visual identity.

Pricing

Free tier (250,000+ templates, basic features). Canva Pro: $15/month or $120/year. Canva Business (replaced Teams for new signups): $20/user/month or $200/user/year. Enterprise: custom pricing. Canva for Nonprofits: free Pro access for up to 50 users for qualifying 501(c)(3) organizations. Note: Canva raised Teams pricing by up to 300% in late 2024, then partially reversed after backlash. Existing Teams subscribers kept legacy rates.

This is an editorial assessment based on publicly available information as of 2026-04-02, using our published methodology. Independent security review is pending. Security posture can change at any time. This is not a guarantee of safety.

Something wrong or outdated? Report it.