INSTRUCTURE GLOBAL LIMITED

Canvas

Canvas is a flexible, easy-to-use, cloud-native Learning Management System. As a software-as-a-service platform, Canvas offers powerful functionality while remaining user-friendly. Canvas provides powerful tools to extend learning beyond the classroom. It bundles messaging, assessments, grading, learning analytics, a learning object repository and more, all in one seamlessly integrated learning platform.

Features

• Flexible Assignments and Assessments, with effective Evaluation and Feedback
• Real-time Collaboration and Communication, including via native mobile apps
• Comprehensive Learning Analytics, with Impact and Intelligent Insights driving outcomes
• Intuitive, easy-to-use Content Creation and Organisation Tools
• Open and Flexible API, Allowing for One-Click LTI Integrations
• An Attractive and Customisable Marketplace through Catalog
• Interactive Video Learning and automated captioning via Studio
• Digital badges and stackable learning pathways via Parchment Digital Badges
• Implementation and change management services through our in-house team
• Native video conferencing and integrations with other leading video tools

Benefits

• Engage users with rich content, incorporating multimedia and LTI tools
• Implement various pedagogical approaches, from blended learning to flipped classrooms
• Deliver authentic assessment and provide personalised feedback on the go
• Improve collaboration through real-time document and conference collaborations
• Give personalised video and audio feedback without leaving the platform
• Enhance learning through integrating innovative LTI teaching and learning tools
• Improve understanding through easy content organisation and automated learning paths
• Gain meaningful insights into teaching and learning through actionable analytics
• Easily connect to proprietary applications via our flexible, standards-based architecture
• Simplify administration of users, accounts, permissions, branding, courses and templates

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at gclouduk@instructure.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

567192138593351

Contact

G-Cloud Contact
020 3514 6223
gclouduk@instructure.com

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Education
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: No
• System requirements:
  • An internet connection
  • A browser-enabled computer or mobile device

User support

• Email or online ticketing support: Yes
• Support response times: Instructure employs an industry-standard, traditional three-tier technical support methodology for incident reporting, escalation, and resolution. We offer three support services packages: Basic, 24x7, and Tier 1. These cover phone, live chat, and webform/email tickets. As an SLA, we guarantee the following response times for webform/email tickets: ; ; - Standard - 80% within 2 business days; - 24/7 - 80% within 12 hours; - Tier One - One hour targeted initial response for webform/email tickets, 5 minute targeted initial response for phone & chat.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: We rely on accessibility testing performed by Salesforce, the provider of our web chat platform. Salesforce conducts accessibility evaluations using a combination of automated testing, manual testing, and assistive technology tools, including JAWS, NVDA, and VoiceOver, across modern browsers and operating systems.; ; Testing includes validation of keyboard operability, screen reader compatibility, focus order, labeling, and status message announcements. Salesforce also performs ongoing accessibility research, audits, and product updates informed by user feedback and accessibility best practices.; ; At this time, we have not conducted separate direct testing with assistive technology users beyond Salesforce’s published accessibility evaluations.
• Onsite support: Yes, at extra cost
• Support levels: Instructure offers three different levels of technical support, Standard, 24/7 and Tier 1, employing an industry-standard, traditional three-tier technical support methodology for incident reporting, escalation, and resolution. ; ; Standard Support: package is included in the Canvas subscription fee at no additional cost. Under this package, first-tier support is provided by the institution’s VLE Administrator and Instructure’s Support team provides second- and third-tier Support.; 24/7 Support; package offers 24/7/365 support to up to three of the institutions’ local LMS administrators, via phone, web chat, or email. ; Tier 1 Support; package provides 24/7/365 support, for all of the institutions’ students and instructors. Accessed via phone, web chat or email, we will answer calls and chats within five minutes, and emails within one hour.; ; In addition to technical support, institutions have a dedicated Customer Success Manager to ensure they get the most from their Canvas system. They will be available via email or phone for adhoc queries, as well as regular Executive Business Reviews.
• Support available to third parties: Yes
• AI chatbot: No

Onboarding and offboarding

• Getting started: We support users through a structured yet flexible implementation process designed to ensure a smooth rollout and strong long-term adoption of the Canvas learning platform. While implementations typically follow a 12-month framework, timelines and activities are tailored to each institution’s size, readiness, academic calendar, and strategic priorities.; ; Training and enablement are central to our approach. We provide structured onboarding through webinars, self-paced courses, a dedicated training portal, and optional onsite delivery. A train-the-trainer model empowers institutions to build internal capability and scale knowledge across academic and support teams.; ; Canvas also includes in-built tutorials and guided tours for new users, alongside hundreds of regularly updated Canvas Guides that provide step-by-step instructions with screenshots and videos. These resources are fully online within the Canvas Community, where users can access forums, user groups, live sessions, and peer support to build confidence and share best practice.; ; Alongside training, we deliver project management, technical configuration, and change management in partnership with the customer’s core project team. Canvas is configured to align with institutional structures, including authentication, user roles, SIS integrations, branding, and third-party tools. User Acceptance Testing is embedded throughout to confirm system readiness.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: As per Instructure’s Terms and Conditions, customers may export content and data through the API or by using Canvas’ export features, which will provide IMS CC packages. They will be able to do this during the term of the agreement and for 3 months after expiration or termination.; ; Users can export Courses through the 'Export Course Content' feature, and individual users can also export material from the platform. Users can also export a huge amount of invaluable data from Canvas at any time using Canvas Data. The Canvas Data service provides key data points from Canvas, facilitating on-demand querying, reporting, and analysis. Canvas Data is available as a daily flat-file download which can be imported and used with your preferred reporting tool.
• End-of-contract process: In the unlikely event that a user chooses to leave Canvas, we will support them throughout the process, giving them the assistance you need to successfully transition to their new provider. Canvas' inherently open nature makes it easy for the data and content to talk to other systems, and this includes all other major VLE providers.; ; A Customer Success Manager will continue to support the user throughout the phase-out process, providing advice on how data can be migrated from the Canvas system. Tasks and timescales will depend on the size of the organisation and the number of institutions. For example, teachers could be made responsible for exporting their own course/s. Alternatively, admins could also bulk export their Canvas Courses, using our open APIs.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: We place accessibility at the forefront of our approach. We have a dedicated Accessibility team, and they review the Community regularly. Khoros, where the Guides are held, also offer an accessibility plugin that can be enabled within individual instances.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The Canvas Student and Canvas Teacher apps optimise the desktop version for mobile. Rather than replicating the experience, we recognise that mobile devices are inherently different and have planned accordingly. For instance, students can submit assignments, view grades and annotate documents, but cannot create ePortfolios, as this is generally done via desktop. Teachers can grade, update assignments and communicate with students, but admin and analytic functionality is not included, since this would be done on desktop. The mobile apps also allow for push notifications and video usage, which are only available using native mobile apps.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Canvas has both a modern web interface, accessible through web browsers, and native mobile applications for iOS and Android. Our native mobile apps allow for instant push notifications and video usage on the mobile, going beyond what traditional VLEs can provide in terms of mobile engagement. In every workflow, mobile or otherwise, simplicity is the power behind Canvas. In study after study, users of all abilities say the Canvas interface is clean, intuitive and easy to navigate.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Testing is regularly conducted using automated tools and assistive technology (such as screen readers, keyboard testing, etc.), and coding best practices. Mechanisms are in place for logging and fixing accessibility defects. We officially support the following screen reader and browser combinations, having actively tested them against Canvas code:; Macintosh: VoiceOver (latest version for Safari); PC: NVDA (latest version for Firefox); PC: JAWS (latest version for Firefox); ; Our Accessibility team has also established an Accessibility User Group in collaboration with Access Technology Higher Education Network (ATHEN).; ; Within the Canvas Community, we have an Accessibility user group, where hundreds of Canvas users from all around the world discuss accessibility in the education landscape, and they help shape Canvas' accessibility goals.; ; Canvas also engages in testing with WebAIM, which has certified it to be substantially conformant with Level A and Level AA of the Web Content Accessibility Guidelines version 2.2.
• API: Yes
• What users can and can't do using the API: Canvas provides an extensive, open REST (JSON) and GraphQL API with full Create, Read, Update and Delete functionality for most features within Canvas. The API enables users to build customised integrations, automate processes, export data for reporting and visualisation, integrate third-party tools, securely access Canvas data, and connect Student Information Systems for automated data transfer.; ; Users with appropriate permissions can configure SIS integrations, authentication, courses, users, enrolments, academic terms, departments, groups and custom data fields through the API. Within courses, the API supports managing announcements, assignments, discussions, quizzes, learning outcomes, rubrics, grades, and student submissions.; ; To set up access, users register a Connected App, obtain a client ID and secret, and authenticate using OAuth2. Users can generate API tokens to execute requests, subject to administrator controls, role-based permissions, and token expiry policies.; ; Changes can be made using standard tools such as JavaScript or cURL, enabling full CRUD operations across supported endpoints, including enrolment management, role assignment, and scheduling.; ; All Canvas users may access the API, but actions are limited to their assigned permissions. For example, students may submit assignments but cannot modify course content. Additional limitations include API rate limits, platform policy requirements, and responsible data use.; ; API documentation: https://canvas.instructure.com/doc/api/index.html
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Admins can customise their Canvas instance with ease, while teachers and students both have scope to customise their own Canvas experience.; ; Admins can quickly and easily customise the Canvas interface to match the institution's unique brand using the Theme Editor. Admins can add the institution's colours and logo to the Canvas interface and login screen, as well as customising the global navigation menu. These customisations can be done at a core account level and at a sub-account level, allowing for different customisations based on departments, schools, or organisations. Admins can also customise which LTIs are available at an account level, creating lists for accounts and sub-accounts, and they can easily customise roles and permissions for entire accounts.; ; Teachers and students are also able to customise their Canvas environment to their own needs. Both types of users are able to customise their homepage, for example, editing the Dashboard to include course nicknames, course card colours, and even the way in which the Dashboard provides information. Users are also able to edit their language settings, the accessibility options of their environment (e.g. high contrast mode) and more. Crucially, they can define Notification Settings, allowing for a truly personalised and customised experience.

Scaling

• Independence of resources: We provide all users with a 99.9% uptime guarantee as an SLA. We can auto-scale to this extent because of our Amazon Web Services hosting, which allows us to automatically adapt to usage peaks. We go further than reactive scaling, however, having built our own predictive scaling software, ensuring we react to usage spikes before they have even occurred. We maintained an average of 99.983% across the last 5 years - and this in spite of increased numbers due to a global pandemic. That figure equates to less than 8 hours’ uptime across the past 5 years.

Analytics

• Service usage metrics: Yes
• Metrics types: Canvas has a range of metrics that help teachers and admins monitor service usage. ; ; Administrators have access to the analytics that will help them make smart decisions in running their organisation. These analytics include 7 graph and table analytics, 18 downloadable reports, and Canvas Data, which allows admins to extract customised data in a .txt and API format.; ; Teachers are also able to monitor system usage and performance, via Course Analytics tools and Student Context Cards. These analytics show how students are performing and engaging, on a granular individual scale, and on a more general class-based scale.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Canvas’ "Export Course Content" tool will make it easy to export content from the Canvas, as Canvas will enable staff to archive and export courses on an individual and batch basis. Content can be exported based on LMS industry standard formats, including IMS QTI and Common Cartridge. Activity can also be exported via Canvas Data, and reports can be exported by admins for other archiving.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • IMS Common Cartridge
  • QTI
  • TSV
  • JSON Lines
  • Parquet
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • IMS Common Cartridge
  • QTI
  • SCORM
  • CSV
  • ZIP
  • DOC
  • PPT
  • PDF
  • MP4
  • JPEG

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Instructure will use commercially reasonable efforts to make the Service available with an Annual Uptime Percentage of at least 99.9% (“Service Commitment”). In the event Instructure does not meet the Service Commitment, Customer will be eligible to receive a service credit as described below. The maximum amount of the credit is 1/12 of the annual subscription fee for a twelve (12) month period. The service credit is calculated by taking the number of hours the Service was unavailable below the Service Commitment, and multiplying it by 3% of 1/12 the annual subscription fee. If the Customer has been using the Service for less than 365 days, the preceding 365 days will be used, but any days prior to Customer’s use of the Service will be deemed to have had 100% availability. Any unavailability occurring prior to a credit cannot be used for any future claims. The Service Commitment does not apply to any scheduled outages, standard maintenance windows, force majeure, and outages that result from any technology issue originating from Customer or a User.
• Approach to resilience: Canvas’ cloud hosted datacentre services are provided by Amazon Web Services, the most established and trusted cloud hosting provider in the world. Resiliency is ensured by Canvas’ self-healing architecture and automatic scaling allowing Canvas to accommodate tens of millions of users at once. Canvas maintains a comprehensive architecture document which details our resilient design. It is available to anyone upon request.; ; Canvas guarantees a 99.9% uptime guarantee (SLA). Across all of our contracts, we have met this guarantee and more. ; ; We also stand out in our transparency and access to historical data: we publish our availability status and updates at status.instructure.com, meaning you will always be able to keep tabs on Canvas’ availability, any known problems, and expectations on problem resolution. You will never experience this with Canvas, and no one else in the industry will provide you with this level of transparency.
• Outage reporting: We are incredibly transparent when it comes to reporting outages: everything is accessible via a public dashboard online, allowing users to keep tabs on Canvas' availability. Individual systems even have their own status page, making it easy to track individual problems.; ; We publish our availability status and updates at status.instructure.com, meaning you will always be able to keep tabs on Canvas’ availability. We have all been in the situation where our favourite website goes down, and we have no way of knowing if the website is experiencing problems or when they are planning on getting back up. You will never experience this with Canvas, and no one else in the industry will provide you with this level of transparency. ; ; The Customer Success Manager will also keep customers informed, reporting on any issues the institution has escalated to support.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Management access for Instructure employees is granted through a strict, multi-level approval system based on the principle of least privilege. Only those who require access to perform their job are granted, and only to the specific functions they require.; ; It is also easy for customers to restrict access for their own users, as access to the system can follow role-based protocols or be based on privileges established at account setup.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Instructure has internally documented security policies covering a wide range of topics such as Information Classification, Encryption, Fraud, Maintenance, Privacy, Change Management, Media Protection, Risk Management, Mobile Computing, Awareness Training, and several other topics. ; ; Our security policies are maintained and regularly reviewed by Canvas’ Senior Director and Head of Security. Ensuring policies are followed is a team effort made up of Instructure's IT, DevOps, Engineering, and other technology teams. For example, our engineering team ensures compliance by way of a formal developer peer review process based on the Open Web Application Security Project (OWASP) secure coding and code review documents and other community sources on best security practices.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Canvas follows AICPA's Trust Services Principles and Criteria as opined on by our external auditors via our SOC2 report. ; ; Change management is critical to any software. All changes, whether new feature enhancements, defect fixes, or data changes, must be reviewed, tested, and planned for deployment. A critical change may require multiple levels of authorisation.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Instructure’s security team conducts vulnerability scans of the production environment and annual third-party code base and penetration testing. Members of Instructure’s security team have many years of experience with security audits by major corporations and government agencies and stay up-to-date with a wide range of ongoing professional development.; ; Security-related patches to the OS, application software, and libraries are applied according to severity:; Critical: ASAP (within commercially reasonable timeframe); High: Within 30 days; Moderate: Within 90 days; Low: Within 120 days; ; In most cases, this incurs no downtime.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Canvas uses Amazon’s existing network and security monitoring to protect against MITM Attacks, IP Spoofing, Port Scanning, VPC’s, and DDoS attacks.; ; Additionally, Instructure leverages AWS's GuardDuty service to continuously monitor for malicious or unauthorised behavior such as unusual API calls or potentially unauthorised deployments that indicate a possible compromise. ; ; In the event of a compromise, the information security officer will work with the incident response team to draft and execute a notification plan. In the case of high severity security issues, affected parties will be alerted immediately while indirectly affected parties will be alerted within 48 hours.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Users have a variety of means for reporting issues depending on their chosen support options, including chat, webform/email, and phone.; ; A documented incident management process exists, available on request. Significant security events are reported to administrators automatically via email, with regular updates during and after the event as the incident is diagnosed and resolved. Other updates, e.g. performance, are reported on publicly at https://status.instructure.com/.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Users can trial Canvas via a Free for Teacher account which grants full functionality for teachers and students, access to publically shared course content, inline tutorials to get started, and free sign up to Canvas.net for Canvas Training. Administration feature trials can be arranged by contacting our sales department.
• Link to free trial: https://www.instructure.com/en-gb/canvas-free-for-teacher/orientation

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 3%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 8%
• Between £1,000,001 and £2,500,000: 12%
• Between £2,500,001 and £5,000,000: 17%
• Over £5,000,001: 20%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Moss Adams Certifications LLC, Ansi National Accreditations Board, IAF
• ISO/IEC 27001 accreditation date: Wednesday 16 October 2024
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: Yes
• CSA STAR accreditation date: Wednesday 9 February 2022
• CSA STAR certification level: Level 1: CSA STAR Self-Assessment
• What the CSA STAR doesn’t cover: N/A
• PCI certification: Yes
• Who accredited the PCI DSS certification: PCI Security Standards Council
• PCI DSS accreditation date: Tuesday 10 June 2025
• What the PCI DSS doesn’t cover: We have PCI certification for Catalog and Parchment, since these are the only areas PCI is applicable to.
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 4a4bc4ae-3c41-470d-97a4-ebc10f592d2a
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 2d0362aa-3ec2-4529-b07e-cc167d357a7b
• Other security certifications: Yes
• Any other security certifications:
  • SOC2 Type II
  • SOC3

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at gclouduk@instructure.com. Tell them what format you need. It will help if you say what assistive technology you use.