-
Subprocessor Notification Regarding Charles River Associates (CRA)
What is Charles River Associates (“CRA”) and why are we adding this as a subprocessor? CRA is a data analysis firm that performs search and review services to identify information within Canvas structured data. Charles River Associates Privacy Policy Address: Location: 100 Clarendon Street, Boston, Massachusetts…
-
Subprocessor Notification Regarding Kroll Associates, Inc.
What is Kroll Associates, Inc., and why are we adding this as a subprocessor? Kroll is a data analysis firm that performs search and review services to identify information within Canvas structured data. Kroll Associates, Inc. Privacy Policy Address: 285 Fulton Street, 31st Floor, New York, NY 10007 What products will this…
-
Subprocessor Notification Regarding Wiz Inc.
What is Wiz Inc. (Wiz) and why is Instructure introducing it? Wiz is a vulnerability management tool utilized for endpoints, containers, and databases. The software scans cloud servers against known vulnerabilities, evaluates how security findings could impact the business, and compiles evidence alongside actionable…
-
Subprocessor Notification Regarding CrowdStrike, Inc.
What is CrowdStrike and why is Instructure introducing it? CrowdStrike, Inc. (CrowdStrike) is an Endpoint Detection and Response (EDR) platform used to secure enterprise infrastructure. Instructure is deploying the CrowdStrike Falcon agent across enterprise endpoints, primarily employee devices and servers. The software…
-
Subprocessor Notification Regarding Fastly, Inc.
What is Fastly, Inc. (Fastly) and why is Instructure introducing it? Fastly provides an edge cloud platform and security solutions. Instructure is onboarding Fastly’s Next-Generation Web Application Firewall (WAF) to shield its public internet-facing applications. Fastly, Inc. Privacy Policy Fastly Trust Center Address:…
-
Subprocessor Notification Regarding ReliaQuest, LLC
What is ReliaQuest, LLC (ReliaQuest) and why are we adding this as a subprocessor? ReliaQuest is an AI-powered security operations platform used for managed detection, response, and security information and event management (SIEM). ReliaQuest Privacy Policy Address: 1001 Water Street, Suite 1900, Tampa, FL 33602 What…
-
Subprocessor Notification Regarding WithSecure
What is WithSecure Corporation (WithSecure) and why is Instructure introducing it? WithSecure Corporation provides cloud-based content protection software. We are adding them to provide additional security layers for our internal CRM environment. The tool sits directly on top of our CRM database to inspect inbound URLs and…
-
FAQs: Subprocessor Notification RE: OneTrust Cookie Consent Deployment (Canvas LMS)
As part of Instructure's ongoing commitment to data privacy and transparency, we are deploying OneTrust cookie consent banners on Canvas LMS. This FAQ document provides our global institutions, administrators, and users with clarity on what this means, why it is happening, and how it impacts your Canvas experience.…
-
Subprocessor Notice: EU Data Processing for IgniteAI Agent (Canada)
As we prepare to launch the IgniteAI Agent in Canada on June 15, 2026, we are providing this Subprocessor Notification regarding the infrastructure used for this new feature. What is the IgniteAI Agent? IgniteAI Agent is an opt-in generative AI assistant embedded in Canvas that completes complex teaching and…
-
Update on Instructure’s Global Identity Proxy Service for Canvas Logins
We are committed to providing you with the most stable and reliable service possible, and that includes being transparent when issues arise. We want to provide an update following a temporary disruption some users experienced when attempting to log into Canvas recently. The Incident On January 12th, 2026, some Canvas users…
-
Instructure Technical Webinar FAQ
What data was affected, who was affected, and how far back does the data go? During the week of May 18, customers with information potentially involved received an email from Canvas with instructions on how to access preliminary information regarding the institution’s data, including what specific fields related to each…
-
FAQs: Subprocessor Notification Regarding Pendo.io
Frequently Asked Questions about Subprocessor Notification regarding Pendo.io What is Pendo.io, and why are we adding this as a subprocessor? Pendo.io provides in-app communication and analytics. For more information about Pendo.io: Pendo.io Privacy Policy Pendo.io's Trust Page Pendo.io Address: Pendo.io, Inc. 301…
-
May 2026 Instructure Technical Webinar
We recently hosted a technical deep-dive webinar to provide a technical update on what happened, the architecture and controls involved in our response, and the security investments we're making going forward. The session was designed for technical stakeholders (CISOs, CTOs, security architects, Information Security teams,…
-
Instructure May 2026 Incident Fact Sheet
On April 29, 2026, Instructure became aware of certain unauthorized activities by an unauthorized third party (the “Threat Actor”) in its computing environment, specifically in its Canvas learning management system (LMS). On May 1, 2026, CrowdStrike Services (“CrowdStrike”) was engaged to provide investigative services and…
-
Transparency Report - 01/01/25 - 12/31/2025
Transparency Report Like many other technology companies, Instructure, Inc., or our affiliates (“Instructure”, “us”, “we”) may on occasion receive a request from a law enforcement or other government agency seeking access to our customer data. Our goal is to always protect our customers’ data, while complying with…