Canvas has open security. AND NO, THAT’S NOT AN OXYMORON. IT’S MORE LIKE “OXYGENIUS.” READ THE LATEST SECURITY NOTICES. Once we learn about a security issue, we’re totally open when it comes to making sure you know what we know. Visit the Canvas Help Center to learn about security threats and to see how we fixed them. TELL US ABOUT A SECURITY ISSUE. Email us about vulnerabilities at [email protected] (If you want, you can use our public key.) REVIEW OUR ANNUAL, OPEN SECURITY AUDITS. See for yourself which LMS vendors conduct open security audits (hint: there’s only one) and learn more about how our relentless obsession with openness means good things for the security of your data. Canvas Blackboard Desire2Learn MoodleRooms 2011 Summary Report 2012 Summary Report 2013 Summary Report 2014 Summary Report 2015 Summary Report 2016 Summary Report 2017 Summary Report 2018 Summary Report X Close Canvas Security Overview Automatic updates We automatically install security patches as soon as they’re available, so right now (whenever that is), Canvas couldn’t be more secure. Authentication Canvas supports external identity providers (IdPs), including Active Directory, CAS, LDAP, OpenID, and SAML/Shibboleth. Protocol and session security To ensure the privacy and security of your data, Canvas uses HTTPS for all communication and encrypts all inbound and outbound traffic using 128-bit TLS/SSL. Data access The Canvas API uses the industry-standard OAuth2 protocol, which provides secure access to Canvas data while preventing direct access to Canvas databases. Physical security All Canvas user data is stored in highly stable, secure, and geographically diverse Amazon Web Services (AWS) data centers. Backup and recovery Canvas data is backed up redundantly (every day). In case of emergency or disaster, data is recovered from Amazon servers or from our own off-site backup.