Instructure | Trust Center

Instructure has a SOC 2 Bridge Letter for 2026 now available on our Trust Center, providing coverage between our most recent SOC 2 reporting period and the present date.

For an update on a security incident, please see our incident update FAQ

Following the disclosure of CVE-2025-55182 and CVE-2025-66478, we immediately patched a limited number of affected services. No compromise was detected, and security monitoring remains active.

For an update on a security incident, please see our blog post.

Several of our Product Voluntary Product Accessibility Templates (VPAT) have been refreshed and now meet the AA level of the Web Content Accessibility Guidelines (WCAG) 2.2 accessibility standards.

Both our Canvas Catalog PCI DSS and our Parchment PCI DSS have been refreshed! This also includes a Responsibility Matrix for both platforms. Note, these documents require you to be an approved visitor for access.

We've just refreshed our Canvas LMS HECVAT to Version 4. This refreshed HECVAT includes a comprehensive section on both AI and Privacy. Our HECVATs are located under the Security Questionnaires folder in Documents.