Canvas LMS Backup · Australia
Protect your Canvas courses, and prove you can restore them.
You are responsible for protecting your institution’s course data. Instructure keeps Canvas online. Recovering what’s inside it is on you, and their own terms say so. That data is years of course design, every enrolment, every submission, and the grade records you are required to keep. Retenta protects it on Australian infrastructure and proves you can restore it.
Protecting your courses is your job. Proving it is ours.
Built in direct response to the May 2026 Canvas breach. Independent of Instructure, data held in Australia, recovery tested on a schedule.
- ASQA Clause 8.1–8.2
- Essential Eight ML2
- ISO 27001 A.8.13
Whose job is it to protect your course data?
Organisations assume their critical course data is protected, until they discover it isn’t.
Instructure keeps Canvas running and secures the platform (Master Terms §5). Your courses stay your property (§9), and protecting them is your responsibility (§3). The platform is provided as is, with no obligation on Instructure to keep a recoverable copy of your courses for you.
It rarely takes an attacker. Course data is lost in ordinary ways, and Canvas’s own recovery is limited and time-boxed. Miss the window and it is gone.
An SIS import deletes enrolments
A student-data import in batch mode removes every enrolment not in the file, with no prompt. The window to restore is about 30 days.
“Reset Course Content”
Resetting a course wipes its content. Recovery depends on the weekly beta refresh, not a backup you control.
Deletion is time-boxed
Canvas recovers only the most recently deleted items, and only if you catch them fast. Miss the window and it is gone.
Protecting your own course data is not extra caution. It is your half of an arrangement you already agreed to. The only open question is whether you can prove the recovery works.
Instructure keeps the platform running
- Hosts, secures and operates Canvas§5
- No obligation to keep a recoverable copy of your courses
Protecting and recovering your data is yours
- Your content is your responsibility§3
- It is your property, worth years of work§9
The platform is theirs to run. The courses are yours to protect, and to prove you can recover.
Who’s accountable for the courses.
RTO Compliance Manager
You own the ASQA audit. Your course records have to be retrievable under Clause 8.1.
The recovery path you assumed was there closed in May 2026.
A counter-signed restore report, before the auditor asks.
Canvas Administrator
You manage high-value courses on an Essential Eight uplift program.
ML2 wants your restores tested, not just your backups taken. No one has run one.
We run it on a schedule and produce the evidence.
Director of Digital Learning
You're accountable for the courses, and your insurer now asks whether you've recently restored.
That course content is tens of thousands of hours you can't rebuild.
Protected in Australia and proven recoverable, before you need it.
Not sure which fits? Talk to us →
What Retenta does.
Protects your Canvas data
We back up your courses at least daily to Retenta's secure platform in Australia. Nothing can be deleted or overwritten by hackers, malicious insiders, or even us.
Verified restore
We restore a real backup into a separate Canvas test environment and check your courses came back complete and correct. Automated, on a schedule.
Auditor-ready evidence
You receive a counter-signed Restore Verification Report, mapped to ASQA Clause 8.1–8.2, Essential Eight ML2, and ISO 27001 A.8.13. It is already in the format the auditor asks for.
The Restore Verification Report
After every restore drill, we produce a counter-signed report that tells an auditor exactly what was tested, when, and whether it passed.
It maps to the clause they will ask about. It is signed by Retenta as the independent third party, so there is nothing to interpret and no logs to chase from the vendor that was breached.
Restore Verification Report- Course
- Diploma of Nursing (HLT54121)
- Restore date
- 14 May 2026, 02:14 AEST
- Source backup
- Immutable, AU East
sha256:9f86d081884c7d659a2feaa0c55ad015
a3bf4f1b2b0b822cd15d6c15b0f00a08
- Course structure verified
- Enrolments verified
- Submissions & gradebook verified
- Media assets verified
Counter-signed by Retenta
Independent verification · ASQA 8.1–8.2 · Essential Eight ML2
How it works.
Connect and protect
Retenta connects to your Canvas and backs up all your important course data to secure Australian servers, at least daily.
We run the restore
We restore a real backup into a separate Canvas test environment to prove it works, and counter-sign the Restore Verification Report. Automated, on a schedule. You do not need to be there.
Receive your report
The counter-signed report arrives by email and in your portal. Hand it to your auditor.
Counter-signedNot ready to start? Start here.
Download the Canvas Restore Drill Template. It is the step-by-step guide we use to run a manual restore drill, including the verification checklist and a blank restore log you can hand to an auditor. Free.
How does it prove the courses come back?
Most institutions assume one of these has them covered. The test is simple: how does it prove the courses come back?
| Assumption | What it actually is | Proves recovery? |
|---|---|---|
| “It’s in the cloud, Canvas has it” | A hosting arrangement, not a backup | Their terms put recovery on you |
| Manual Canvas export | A partial copy you download | Omits enrolments, submissions, and the gradebook, and nobody tests or validates it |
| Custom script | A copy, while someone maintains it | Unmonitored, unverified, no evidence an auditor accepts |
| Archive | Moves finished courses out of Canvas onto its own platform | Built to archive completed courses, not to back up live ones. No verified restore and no signed evidence |
| Generic backup (Commvault, Veeam, Rubrik and similar) | Enterprise backup for other systems | Does not cover Canvas |
| Retenta | Verified recovery, with evidence | Tested restore, on a schedule, counter-signed |
One claim marked ASSUMED: auditor acceptance of the Restore Verification Report is being validated with ASQA and Essential Eight assessors. We’ll update this page when that validation is complete.
Ready to protect your courses and prove it?
- Backup of your published Canvas courses in Australia, run at least daily
- A restore drill per quarter (monthly on the Govern tier), automated
- A counter-signed Restore Verification Report mapped to your framework
- A hash-chained audit log
- An evidence pack: ASQA 8.1–8.2 / Essential Eight ML2 / ISO 27001 A.8.13