Question 1

Is Canvas Envision SOC 2 compliant?

Accepted Answer

Yes. SOC 2 Type 2.

Question 2

What other compliance frameworks does Canvas Envision hold?

Accepted Answer

SOC 2 Type 2 is the current posture. Additional frameworks may be added.

Question 3

Does Canvas Envision support data residency in specific regions?

Accepted Answer

Yes. Multi-tenant deployments are AWS-hosted with regional options. Private single-tenant deployments support data residency in customer-specified regions. GovCloud supports sovereign and regulated workloads.

Question 4

Does Canvas Envision support GovCloud?

Accepted Answer

GovCloud is available for sovereign and regulated workloads.

Question 5

Is customer data encrypted at rest and in transit?

Accepted Answer

Yes. AES-256 at rest. TLS 1.2+ in transit.

Question 6

How are encryption keys managed?

Accepted Answer

Industry-standard key management practices. Detailed architecture available under NDA.

Question 7

Is customer data isolated in multi-tenant deployments?

Accepted Answer

Yes. Multi-tenant data isolation is enforced at the application and data layers. Single-tenant deployments provide full isolation.

Question 8

What is your data retention policy?

Accepted Answer

Customer data is retained per the contractual agreement. On contract termination, customer data is deleted on the timeline specified in the agreement; full export is available before deletion.

Question 9

Can customers export their data?

Accepted Answer

Yes. Full export is available.

Question 10

What is your sub-processor list?

Accepted Answer

Available through customer success, or via the SecureFrame trust portal.

Question 11

Does Canvas Envision support SSO?

Accepted Answer

Yes. SAML and OIDC.

Question 12

Is MFA required or supported?

Accepted Answer

Supported. Configurable at the organization level.

Question 13

How is role-based access control implemented?

Accepted Answer

Role-based access at the platform level for authoring, viewing, and administrative functions. Named-user permissions in Envision Operator support per-user data tracking and traceability.

Question 14

Does Canvas Envision conduct third-party penetration testing?

Accepted Answer

Yes. Frequency disclosed through customer success.

Question 15

Is there a vulnerability disclosure program?

Accepted Answer

Yes. Contact security@canvasenvision.com to report a vulnerability.

Question 16

What is the secure development lifecycle?

Accepted Answer

Secure development practices include code review, dependency scanning, security testing, and continuous monitoring.

Question 17

What is the incident response process?

Accepted Answer

Defined incident response procedures with customer notification commitments per contract. Detailed process available under NDA.

Question 18

Will Canvas Envision notify customers if there is a security incident affecting their data?

Accepted Answer

Yes. Notification timeline is per contractual commitment.

Question 19

What is the business continuity / disaster recovery posture?

Accepted Answer

Multi-region redundancy on the cloud provider. RTO and RPO commitments available under NDA.

Question 20

What foundation models does Evie use?

Accepted Answer

Evie's orchestration uses Anthropic Claude (via AWS Bedrock) and Google Gemini (via Google Vertex AI). Customer data is never sent directly to Anthropic or Google. The orchestration layer picks the best model for each task and continuously optimizes the selection.

Question 21

Is customer data used to train Evie or any third-party AI models?

Accepted Answer

No. Customer production data is not used to train Evie or any of the underlying foundation models. This commitment is enforced at the cloud-provider level through AWS Bedrock and Google Vertex AI data-handling agreements.

Question 22

How does Evie handle customer data when processing AI requests?

Accepted Answer

All foundation-model calls route through enterprise cloud services — AWS Bedrock for Anthropic Claude, Google Vertex AI for Google Gemini. Customer data does not leave these managed environments and is not sent to model providers directly. Encryption in transit. Contractual data-handling commitments at the cloud-provider level. The no-training-on-customer-data commitment applies across all providers.

Question 23

Are AI-processed outputs stored, and with what controls?

Accepted Answer

Yes. Outputs are stored as part of the customer's Envision content and follow the standard data-protection controls (encryption at rest, role-based access, customer data isolation).

Question 24

Can customers opt out of AI features?

Accepted Answer

Yes. AI features are configurable at the organization level.

Question 25

For sovereign or regulated workloads, can Evie operate within a GovCloud or equivalent regulated environment?

Accepted Answer

Yes. AWS GovCloud is available for sovereign and regulated workloads.

Question 26

How are Envision SDK API calls authenticated?

Accepted Answer

OAuth 2.0, service accounts, and API tokens.

Question 27

How are webhooks secured?

Accepted Answer

Webhooks are signed; receivers verify signatures before processing.

Question 28

If a customer builds a custom integration via Envision SDK, who is responsible for its security?

Accepted Answer

The customer is responsible for the security of customer-built integrations under the shared-responsibility model. Canvas Envision is responsible for the Envision SDK itself and the platform's authentication and authorization.

Question 29

Is Canvas Envision GDPR / CCPA compliant?

Accepted Answer

Privacy posture is documented in the Privacy Policy. DPAs are available for customers in covered jurisdictions.

Question 30

Where is the Privacy Policy / DPA?

Accepted Answer

Privacy Policy is linked in the footer. DPAs are available through customer success.

The trust portal experience is coming soon