Top of page

Instructure Cybersecurity Incident Update – July 2026

Following the recent cybersecurity incident, Instructure has immediately onboarded seven (7) specialized security partners. These partners are being engaged to further strengthen our security posture and maintain protections over the data entrusted to us. We are providing this notice to describe these recently engaged security vendors supporting our post-incident response and security remediation efforts.

An updated list of these security subprocessors is available below. They are also now reflected on our Third Party Processing Guide and each vendor is described in detail on our Privacy Resources Page in Community.

As part of our broader post-incident review, we are also reviewing our internal data flows and vendor relationships. We will provide a further update to our subprocessor list when that comprehensive review concludes.

1. Subprocessor Name: Kroll Associates, Inc.

  • Type: Consulting Firm
  • Description: Kroll performs search and review services to identify information within Canvas structured data.
  • Covered Products: Canvas
  • Data Processing & Hosting Location: Data for this matter will be processed and hosted in the United States. Hosting locations are in Ashburn, Virginia and Fresno, California.


2. Subprocessor Name: Charles River Associates (“CRA”)

  • Type: Consulting Firm
  • Description: CRA performs search and review services to identify information within Canvas structured data.
  • Covered Products: Canvas
  • Data Processing & Hosting Location: CRA will process Canvas data on its own servers in an on-premises environment located in a Chicago, IL, USA data center.


3. Subprocessor Name: WithSecure

  • Type: Software as a Service (SaaS)
  • Description: WithSecure offers additional security features for our CRM environment containing customer information by inspecting links (URLs) and attachments for threats. It strictly copies and extracts only the specific attachment or URL link to test it; it does not read, download, or access entire customer databases, account details, or chats.
  • Covered Products: All Instructure products and brands
  • Data Processing & Hosting Location: AWS North American regions (primarily utilizing us-east region)


4. Subprocessor Name: ReliaQuest

  • Type: Software as a Service (SaaS)
  • Description: An AI-powered security operations platform used for managed detection, response, and security information and event management (SIEM). The tool processes security logs containing data such as customer IP addresses, and usernames.
  • Covered Products: All Instructure products and brands
  • Data Processing & Hosting Location: AWS North American regions (primarily utilizing us-east region)


5. Subprocessor Name: Fastly

  • Type: Software as a Service (SaaS) / Platform as a Service (PaaS)
  • Description: Fastly provides a Web Application Firewall (WAF) to protect Instructure’s public websites and applications from cyberattacks. It scans incoming web requests to block malicious software and bad actors. It does not track or store the activities of everyday users.
  • Covered Products: All Instructure products and brands
  • Data Processing & Hosting Location: USA


6. Subprocessor Name: CrowdStrike EDR

  • Type: Software as a Service (SaaS)
  • Description: Provides endpoint detection and protection on employee laptops and server instances across all product lines. CrowdStrike monitors endpoints using agents capable of quarantining devices compromised with malware or other negative security statuses. Processed data includes Customer IP addresses and usernames.
  • Covered Products: All Instructure products and brands
  • Data Processing & Hosting Location: USA


7. Subprocessor Name: Wiz

  • Type: Software as a Service (SaaS)
  • Description: A security tool that scans cloud servers against known vulnerabilities across all products. Wiz highlights active security issues, analyzes how they can impact the business, compiles evidence, and lists remediation steps for Instructure to execute. Customer data is stored within scanned databases.
  • Covered Products: All Instructure products and brands
  • Data Processing & Hosting Location: USA