Canva
Connect Canva to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Canva to collect business applications evidence with automated compliance tests, switched on per workspace.
| Category | Business Applications |
| Connect with | API token, MCP server |
| What a connection produces | Automated compliance tests |
| Canva's guide | canva.dev |
Connect with an API token
-
In Canva:
- Sign in to Canva as a team administrator or owner.
- Click the gear icon to go to your Account settings.
- In the side menu, under your team's settings, click SSO & provisioning.
- Under SCIM, turn on Enable SCIM user provisioning.
- Copy the access token.
SCIM is available on Canva Enterprise (and Canva for Districts). There is a single active SCIM token per team, and it is long-lived. Each time the slider is toggled the current token is revoked and a new one is created, so if SCIM is already on for your identity provider, reuse that token or update the IdP after toggling. The SCIM token can also create and change users; Canva has no read-only one.
Source: canva.dev, canva.dev, checked 2026-10-07.
The permissions Safeguard needs:
SCIM token. A SCIM token can also create and change users, and Canva has no read-only one. Safeguard only reads with it. Safeguard's compliance tests for Canva need the credential on the API token tab: an OAuth connection cannot read everything they check. -
On Compliance › Connectors, open Canva, click Connect, choose API token and fill in:
Field What to enter SCIM token Required. Stored encrypted and never shown again. -
Click Connect with token.
Connect with the MCP server
Choose MCP server: the address https://mcp.canva.com/mcp is filled in. Sign in to Canva when asked. It lets Griffin AI search Canva; the compliance evidence comes from the API token connection.
Frameworks
Safeguard's automated tests read Canva and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3 | 2 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5 | 2 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4) | 2 |
| PCI DSS | Automated tests | 7.2.4, 8.2.5 | 2 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-05 | 2 |
These tests are switched on per workspace by the Safeguard team.
Related
- Business Applications connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks