Canvas LMS

Instructure

Restricted

At a glance

Administrative details

Application type

Web + iOS / Android

MFA / SSO

Supported

Schools using

Group pricing

Not available

Pricing tier

Tier 3 (>$10k)

User type

Students & Staff

Account manager

Luis Camargo

Customer success

Instructure Customer Success

Illustrative admin fields — real values load from contracts / vendor records in production.

Round 1 · Privacy Triage

Do Not Approve

Privacy score 82.9% · band Best · addresses 14 of 18

Hard no: the vendor explicitly does something disqualifying — Q11 (Data Safety). An explicit gate violation beats the privacy score. Scope note: 1 question(s) in the current rubric were not assessed in this run — Q19 (Data Security). The evidence predates them, so they are excluded from the 82.9% rather than scored as silence. Re-run the extractor to close the gap.

Waive a finding that doesn't apply to your school (e.g. a feature you don't enable). Re-scores instantly; recorded as a cited footnote.)

Q8 · Data Rights — Do the student / educator / parent / school retain ownership of data and IP of uploaded content? answer: unclearQ11 · Data Safety — Can students contact or interact with UNKNOWN users (strangers / the general public) in environments NOT supervised by a teacher or school? (Teacher-managed or within-class interaction, and content-only sharing, do NOT count.) answer: negativeQ16 · AI & Model-Training — Does the vendor use student/user data — including uploaded content — to train, fine-tune, or improve AI/ML models? answer: unclear

Re-vet from the live policy (re-reads the vendor's published policy set now — privacy policy plus the security, sub-processor and terms pages it links to — and re-runs Round 1. The current verdict stays until the new one lands; a partial or blocked page never replaces it.)

View full cited report ↗

Round 2 · Vendor-supplied documents

What the vendor sent you — a data-processing agreement, a completed security questionnaire, a SOC 2 or ISO summary, a contract. Stored with this record. Every re-vet and every Drift Sentinel scan reads these first, ahead of the public pages, and quotes from them carry evidence tier T2 (contractual) instead of T3 (public claim).

No vendor documents on file. Round 1 reads the public policy set only.

Add a document (PDF, DOCX, TXT or MD, up to 25 MB — or paste the text). It re-vets the vendor as soon as it is stored.

…or paste the document text

Demo: — labelled as a sample, not from the vendor.

Safeguarding summary

See the Round-1 cited report.

Round-1 hard stop (Q11, cited) from the vendor's own policy; reviewer waiver path recorded on the request. Verdict recomputes from the cached evidence run.