canva-data-handling

name	canva-data-handling
description	Implement Canva Connect API data handling, PII protection, and GDPR/CCPA compliance. Use when handling user design data, implementing data retention policies, or ensuring privacy compliance for Canva integrations. Trigger with phrases like "canva data", "canva PII", "canva GDPR", "canva data retention", "canva privacy", "canva CCPA".
allowed-tools	Read, Write, Edit
version	1.0.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","design","canva"]
compatible-with	claude-code

Canva Data Handling

Overview

Handle Canva Connect API data responsibly. The API exposes user identifiers, design metadata, design content (via exports), uploaded assets, and comments. Apply proper classification, retention, and privacy controls.

Data Classification — Canva API Responses

Data Type	Source Endpoint	Sensitivity	Handling
User ID, Team ID	GET /v1/users/me	Internal	Don't expose externally
User profile	GET /v1/users/me/profile	PII	Encrypt at rest, minimize
Design metadata	GET /v1/designs	Business	Standard protection
Design content	Export URLs from /v1/exports	Confidential	Time-limited URLs, don't cache
OAuth tokens	/v1/oauth/token	Secret	Encrypt, never log
Asset files	/v1/asset-uploads	Business	Validate, scan for malware
Comments	/v1/designs/{id}/comment_threads	PII	May contain personal data
Webhook payloads	Incoming POST	Mixed	Verify signature first

Token Protection

// NEVER log tokens — they grant full access to a user's Canva account
function redactCanvaData(data: any): any {
  const sensitiveKeys = [
    'access_token', 'refresh_token', 'authorization',
    'client_secret', 'code_verifier',
  ];

  if (typeof data !== 'object' || data === )  data;

   redacted = .(data) ? [...data] : { ...data };
   ( key  .(redacted)) {
     (sensitiveKeys.(key.())) {
      redacted[key] = ;
    }   ( redacted[key] === ) {
      redacted[key] = (redacted[key]);
    }
  }
   redacted;
}


.(, .((apiResponse)));