FuxamLMS vs Canvas

Q: „Canvas is the established system. Why should we switch?“

Because established and up to date are two different things. Canvas has been on the market since 2011 and emerged at a time when neither AI assistance nor open agent standards existed. Both were added later, and that is visible in four places: AI arrived in 2025 and is tied to license tiers; there is still no official MCP support, only unofficial servers built by individual developers; the Core, Plus and Next tiers were introduced after the fact in 2026; and the „Free-for-Teacher“ program from an earlier growth phase became the entry point for an attack in 2026. FuxamLMS was designed around exactly these requirements. AI and MCP are part of the product rather than an addition, and the core features come at a single price with no tiering.

Q: Who owns Canvas, and does that matter to a university?

Canvas belongs to Instructure Inc., headquartered in Salt Lake City. The company was owned by Thoma Bravo between 2020 and 2021, went public in 2021 and was acquired in November 2024 by KKR and Dragoneer for around 4.8 billion US dollars and taken off the NYSE. Private equity firms invest with clear return and exit targets within defined holding periods. Since the delisting there is no more public quarterly reporting, license tiers followed in April 2026, and the free phase of the extended IgniteAI features ends worldwide on 30 September 2026. For a procurement decision designed to last five to ten years, ownership structure, holding period and foreseeable price development therefore belong in the risk assessment. Fuxam is a founder-led German GmbH. Its further development follows what universities need in day-to-day operation, and your point of contact is based in Germany.

Q: Does Canvas support the Model Context Protocol (MCP)?

Not officially. Several MCP servers exist for Canvas, all of them published by individual developers on GitHub and explicitly not affiliated with Instructure. They authenticate via the personal access tokens of individual instructors and inherit those instructors’ permissions. That leaves no central permission management, no audit-proof record and no assurance from the vendor. FuxamLMS supports MCP natively: AI agents access course, examination and administrative data within the university’s existing roles and permissions, with traceable logging and with the vendor accountable for it. Because that data sits on a single data foundation in FuxamOne, an agent does not have to combine several systems with different permission models.

Q: Is Canvas GDPR-compliant?

Canvas can be hosted in Frankfurt or Dublin, and Instructure holds certifications such as SOC 2 Type II as well as the Trusted Cloud seal. The server location does not, however, answer the question in full. Instructure is a US company and is therefore subject to the US CLOUD Act, which gives authorities access to data under the control of US providers regardless of where the servers are located. This point cannot be resolved contractually and has to be assessed in the data protection impact assessment. At Fuxam the question does not arise: a German GmbH, data centers exclusively in Germany, a data processing agreement under German law. The AI features can also be configured so that no data is processed in third countries; we document the models used and their processing locations in the register of sub-processors.

Q: How do we test the security of FuxamLMS?

At fixed intervals and with external scrutiny. Once a year an external company carries out a penetration test. Before every release, our own LLM-based cybersecurity agents run over the code. Every code change triggers static and dynamic code analysis as well as dependency scanning; each change passes through a staging environment identical to production with manual sign-off, and releases can be reverted within seconds. Every six months an internal cybersecurity audit follows, covering infrastructure, application logic, access controls and sub-processors, and once a year there is a Refactor Month. Added to that are German data centers, two-factor authentication, audit logs, encrypted transmission and 99.9% availability under the SLA. And if the worst happens, you speak to a German contact in your own time zone, which is decisive for the 72-hour notification deadline under Art. 33 GDPR.

Q: What does Canvas do better than FuxamLMS?

Three points, named openly. Canvas has a more mature peer review, particularly in its anonymized form; FuxamLMS offers peer review, but with less configuration depth. Turnitin is built into Canvas natively; with us, plagiarism checking can be integrated, and universities with an existing Turnitin license continue to use it independently of the LMS. And the LTI ecosystem, with more than 1,100 partners, is considerably larger than ours. That last point does come with a qualification: a large ecosystem matters above all when many third-party systems have to be connected. Video conferencing, calendar, payments, mobile app, digital exams and campus management are already part of the product at Fuxam, so precisely those connections become unnecessary. Where Canvas offers more integrations, you need fewer with us.

Q: Can existing courses be migrated from Canvas or Moodle?

Yes, and without any interruption to teaching. SCORM packages are imported directly, and LTI 1.3 is supported natively. Moodle migration is built into the product and runs semester by semester, so that current courses continue while new ones already start in FuxamLMS. For existing Canvas content, our onboarding team handles the migration in a structured way and combines it with instructor training, rather than working through the two one after the other.

Q: How quickly is a switch from Canvas to FuxamLMS realistic?

FuxamLMS goes live within a few weeks to a few months. The main reason: we transfer your existing data from Canvas directly. Course structures, content, users and enrollments are loaded via a seeding script instead of being rebuilt manually by instructors or IT. This step runs in parallel with training and implementation during onboarding rather than after them, so the migration does not form a project phase of its own. For comparison: publicly documented Canvas implementations at universities range from 3 to 24 months, most of them within a year. George Mason University alone needed 6 to 8 months for configuration after signing the contract and spread the transition across two academic years.

Two systems, two development logics

The starting point

Both platforms digitalize university teaching, and both do it well. The difference lies in the era a system comes from, and in who decides where it goes next. One is developed by its founders. The other has been in the hands of private equity firms for six years.

Fuxam GmbH, Berlin

FuxamLMS

A learning management system with course rooms, a workbench editor, learning journeys and assessment. Designed from the first line of code around AI and open agent standards, not extended towards them.

Copilot, DocuChat and Concierge are part of the product, not an add-on tier
Native MCP support: AI agents work inside the university’s own roles and permissions
German GmbH, German data centers, data processing agreement under German law
One price for the core features, with no tiering by license level

Instructure Inc., Salt Lake City

Canvas

Instructure’s learning management system, released in 2011 and the market leader in North American higher education. Functionally deep, with the largest partner ecosystem in the sector. And, since the delisting, a product inside a private equity holding period.

More than 1,100 EdTech partners: the largest LTI ecosystem in the market
Mature in individual academic disciplines, peer review and rubrics above all
AI arrived in 2025 as IgniteAI, fourteen years after launch, tied to license tiers
Acquired for around 4.8 billion US dollars in 11/2024 and taken off the NYSE

The procurement perspective

A ten-year decision meets a five-year holding period

Universities procure an LMS for the next decade. Private equity firms invest against an exit date.

This is not an accusation, it is a difference in time horizons. A university selects a learning platform, migrates its courses, retrains its faculty and lives with the decision for eight to ten years. An investor acquires a company, raises its returns within a defined holding period and sells it on. Both are rational. They simply optimize for different things, and when they meet in the same contract, the university is the one holding the longer end. What that looks like in practice is not a matter of speculation. It has been publicly documented since November 2024.

What a ten-year decision assumes

What has been observable since 11/2024

Roadmap

Development follows teaching

Whatever helps instructors and students in day-to-day operation gets built. The people deciding that are the people who talk to universities.

Development inside a holding period

Since the delisting from the NYSE there is no public quarterly reporting. Financial figures, investment ratios and the direction of R&D spending are no longer visible to customers.

Pricing

One price, predictable across the term

What the platform costs is known at signature and stays plannable for the length of the contract. Budget planning at a university runs in multi-year cycles.

Core, Plus and Next since 04/2026

Three license tiers were introduced after the fact. Features are assigned by tier, and which tier an institution actually needs only becomes clear during the negotiation.

AI

AI is part of the product

Assistance features are as much a part of a modern LMS as the gradebook. Nobody expects to buy the search function separately either.

The free phase ends on 30/09/2026

The extended IgniteAI features stop being free (30/06/2026 in the US, 30/09/2026 worldwide). Continuing to use them means upgrading to Canvas Plus or Canvas Next.

Getting started

A low-threshold way in

Individual instructors try the system out before the institution commits. That is how an LMS earns acceptance in a faculty, from the bottom up rather than by decree.

Free-for-Teacher discontinued

The free instructor program was permanently shut down in May 2026 following the security incident. The entry path for individual teaching staff no longer exists.

Escalation

Someone in your own time zone

When something goes wrong, a named contact answers within hours, in your language, with the authority to make a decision.

Via corporate headquarters in Utah

There is a DACH team, but product support runs predominantly in English and the reporting chain in an incident leads to Salt Lake City, eight time zones away.

Jurisdiction

A processor your DPO can sign off

The data protection impact assessment ends with a yes. Personal data of students sits with a processor subject to European law only.

CLOUD Act, whatever the server location

Hosting in Frankfurt or Dublin is possible. Instructure remains a US company and therefore subject to the CLOUD Act. That cannot be resolved contractually.

Good to know

None of this is hypothetical. It is the documented record of twenty months

Every one of these points is public, sourced and datable. Taken individually, each is a normal business decision. Taken together, they describe a pattern that a procurement committee has to price in, because the contract runs considerably longer than the holding period behind it.

11/2024 · Delisting from the NYSE
04/2026 · Core, Plus and Next license tiers
05/2026 · Free-for-Teacher permanently discontinued
09/2026 · End of the free IgniteAI phase
Ongoing · No public quarterly reporting

The uncomfortable truth

Fifteen years of growth. And two weeks in spring.

In April and May 2026 Instructure was compromised twice. The entry point for the first breach was the „Free-for-Teacher“ program, a legacy of an earlier growth phase that allowed instructor accounts without institutional verification, running on the same infrastructure as institutional tenants. Eight days later the same environment was breached again through a different route, this time during the exam period: the login pages of around 330 institutions were overwritten with an extortion message, among them Harvard, Princeton, Columbia and Georgetown. Canvas went into maintenance mode, universities blocked access, final exams were postponed. Instructure subsequently reached a settlement with the attacker group and, by its own account, received deletion logs; the trade press treats the transaction as a ransom payment. We set this out factually rather than gleefully, because organically grown platforms carry decisions that are hard to reverse later on.

275 M

records affected according to reports, roughly 3.65 terabytes: names, email addresses, student ID numbers, course and enrollment data as well as messages.

~330

institutions whose login pages were overwritten with an extortion message during the second breach, in the middle of the exam period.

~9,000

institutions affected in total. Passwords and payment data were not affected, according to the company.

Canvas · Chronology of the two incidents in 2026

Two breaches, eight days apart

Two breaches, eight days apart, through the same environment. The entry point was a decision from 2011.

29 April

First breach detected — entry point: Free-for-Teacher.

03 May

ShinyHunters go public with a ransom demand.

07 May

Second breach during the exam period — around 330 login pages overwritten.

11–12 May

Settlement with the attackers — public apology by the CEO.

Afterwards

Free-for-Teacher permanently discontinued.

Security at Fuxam

Which is why we say how we test

Criticizing someone else’s incident is easy. The harder and more useful thing is to state what runs at your own end, at what interval and under whose scrutiny. Security is not a one-off assurance but a process. What runs continuously at Fuxam:

External penetration test

Once a year a specialized German testing company examines FuxamLMS, and we keep increasing the depth of testing. Findings enter the development backlog on a prioritized basis. We make the current results report available during procurement on request, under an NDA.

AI scan before every release

Before every release our own cybersecurity agents, based on established LLMs, run over the code and carry out an extensive security scan before an update goes live.

Checks on every code change

Every change triggers static and dynamic code analysis plus dependency scanning, passes through a staging environment identical to production with manual sign-off, and can be reverted within seconds.

Internal audit every six months

Infrastructure, application logic, access controls, operational procedures and the controls of our sub-processors. Each audit produces a catalog of findings prioritized by severity, feeding directly into the backlog.

Refactor Month

Once a year we focus on extensive backend work in order to review all cybersecurity topics from the ground up. That improves not only security but also performance and scalability.

Standards in daily operation

German data centers, data processing agreement, two-factor authentication, audit logs, encrypted transmission, 99.9% availability under the SLA. There is no open self-registration access to the platform.

Good to know

Why that last sentence matters

No open self-registration access is precisely the design decision whose absence became the entry point at Canvas in 2026. Unverified accounts on the same infrastructure as institutional tenants are easy to introduce during a growth phase and hard to remove afterwards.

Day-to-day in comparison

Same task, different experience

Feature lists say what a system has. They say nothing about what happens on a Tuesday afternoon when an instructor has forty minutes between two lectures. Here is the reality check, without marketing language, including the places where Canvas is ahead.

FuxamLMS

Canvas

Setting up the first course

Build it like a presentation

Set up the course room, invite participants, create the first content in the workbench editor, all in one interface. Text, media and interactive tasks live in the same document. Anyone who can build a slide deck can build a course.

Modules, pages, assignments

Canvas separates content into modules, pages, assignments and files, which is logical and well documented. It does mean, however, that a lesson is assembled from several object types across several screens rather than written in one place.

A student asks a question at 10 p.m.

DocuChat answers from the material

Questions are answered directly from the course material, around the clock, with source references and without inventing anything beyond it. Students chat with their own lecture script. Instructors are relieved, not replaced.

IgniteAI, depending on the tier

Canvas has had native AI since 2025, and LLM-based assignments let instructors define the scope. The extended features are tied to license tiers, and their free phase ends worldwide on 30 September 2026.

An AI agent needs course data

MCP, natively and under permissions

Agents access course, examination and administrative data through the open standard, inside the roles the university has already defined, with traceable logging and the vendor accountable for it.

Unofficial servers, personal tokens

Several Canvas MCP servers exist, all published by individual developers on GitHub and explicitly not affiliated with Instructure. They authenticate via an instructor’s personal access token and inherit that person’s full permissions.

Grades, timetable and enrollments

One data foundation with FuxamCMS

Grades, curricula, timetables and student master data are already in the system. No interface, no nightly sync, no reconciliation job that fails on a Sunday and is noticed on a Monday.

SIS integration, a project of its own

Canvas is an LMS and expects a separate campus management system alongside it. The connection is well documented and widely proven, but it is a system of its own, with a contract of its own and maintenance of its own.

Peer review in a seminar-heavy program

Available, with less depth

Peer review works, and for most course formats that is enough. Where Canvas offers more configuration options, particularly for anonymized review, we are honest about it: this is one of the disciplines in which Canvas is further along.

Mature, and can be anonymized

Fifteen years of academic feature depth show here. Anyone running a seminar-heavy subject structure with a high proportion of peer feedback and detailed rubrics should weight this in Canvas’s favor.

A security incident happens

German contact, same time zone

You speak to a named contact in Germany, in your own working hours, which is what makes the 72-hour notification deadline under Art. 33 GDPR realistic rather than theoretical.

Escalation via Utah

A DACH team exists, but product support runs predominantly in English and the reporting chain leads to corporate headquarters in Salt Lake City. In May 2026 that took several days between detection and public communication.

Migration and go-live

Weeks, in parallel with training

Course structures, content, users and enrollments are transferred via a seeding script instead of being rebuilt by hand. Migration runs alongside training rather than after it, so it does not become a project phase of its own.

Months, documented

Publicly documented Canvas implementations at universities range from 3 to 24 months, most within a year. George Mason University alone needed 6 to 8 months for configuration after signing and spread the transition across two academic years.

AI and agents

Does Canvas support MCP?

The short answer: not officially. The Model Context Protocol is the open standard for how AI assistants and agents access external systems. Without such a standard, every AI tool needs its own individually built connection to every specialist system. With MCP, one interface is enough and every MCP-capable assistant can use it, comparable to USB-C connecting a wide range of devices through the same port.

FuxamLMS · MCP native in the product

Under the university’s own permissions

AI agents access course, examination and administrative data in a structured way and within the roles and permissions the institution has already defined. Because that data sits on a single data foundation in FuxamOne, an agent does not have to combine several systems with different permission models.

Central permission management, the university’s existing roles apply
Traceable logging of every agent access
Supported by the vendor and covered contractually

Canvas · community servers only

Via individual instructors’ tokens

Several MCP servers exist for Canvas, all of them published by individual developers on GitHub and explicitly not affiliated with Instructure. They authenticate via personal access tokens and inherit the full permissions of the person whose token is used.

No central permission management
No audit-proof record of what was accessed
No assurance from the vendor, no support path

Good to know

Why this matters now

AI increasingly happens outside the LMS. Instructors and administrative staff work with assistants that are expected to answer questions like „which students in my course are at risk of missing their submission?“ Whether that happens in a controlled way, under granted permissions and with traceable logging, or in an uncontrolled way through individuals’ private access, comes down to whether the specialist system officially supports MCP.

Feature comparison

What can the systems really do?

Canvas is functionally grown up. In fifteen years a system has emerged that covers almost everything academically and, in individual disciplines, does more than any young platform. The table deliberately names those points as well. A comparison that only ever wins is of no help to anyone in a tender.

Feature

FuxamLMS

Canvas

AI & agent connectivity

AI in the product

Copilot, DocuChat, Concierge

IgniteAI since 2025

MCP support

Native in the product

Unofficial community servers only

Answers from course material only

DocuChat, with source references

LLM assignments, instructors define the scope

Free choice of model

OpenAI, Mistral, Gemini, Claude

Open approach, focus on the OpenAI partnership

AI early warning system

Block-level, automatic, live

Analytics available, interpretation manual

AI in all license tiers

Included, at no extra cost

Depends on tier (Core, Plus, Next since 2026)

Academic depth: where Canvas is ahead

Peer review

Available, less configuration depth

Mature, can be anonymized

Plagiarism checking

Can be integrated, existing licenses continue to work

Turnitin built in natively

LTI ecosystem

Available and growing

More than 1,100 partners

Multilingual support

Available and growing

Very broad

Open source option

Proprietary, SaaS

Canvas LMS Open Source

Market maturity & installed base

Young product, growing user base

Since 2011, leader in North American higher education

Content & teaching

Authoring tool / editor

Workbench editor, multi-page, AI-assisted

Rich content editor, well documented

Interactive tasks natively in the content

MC, matching, free text, drawing canvas

Via quizzes and assignments as separate objects

Navigation for students

Learning journey, vertical and context-aware

Modules and pages, structure defined per course

SCORM & LTI 1.3

Native

Native, industry standard

Data protection & operations

Company headquarters

Germany, founder-led GmbH

USA, KKR & Dragoneer since 11/2024

Hosting

Germany exclusively

Frankfurt or Dublin, selectable

CLOUD Act exposure

None

Applies regardless of server location

Support languages

German and English, directly from the vendor

DACH team in place, product support mostly in English

Reporting chain in a security incident

German contact, same time zone

Via corporate headquarters in Utah

SSO (SAML 2.0, OAuth 2.0, OIDC)

Available

Self-registration access to the platform

Not available by design

Free-for-Teacher discontinued in 05/2026

Beyond the LMS: platform scope

Integrated campus management

FuxamCMS, one data foundation

Separate system required

Digital exams

FuxamExams, integrated, BYOD security

Via partners (Proctorio, Respondus)

Application management

FuxamApply, integrated

Not part of the product

Alumni management

FuxamAlumni

Not part of the product

Native mobile app

iOS and Android, offline reading, wallet ID card

Canvas Student and Teacher app

Implementation time

Weeks to a few months

3 to 24 months, documented

Cost comparison

What does Canvas really cost?

Instructure does not publish prices; every contract is negotiated on the basis of FTE enrollment, term and add-ons. Reported figures for smaller institutions cluster in a band that, together with implementation, SIS integration and training, produces a plannable range. The decisive point is what sits below the license line.

FuxamLMS

Typical LMS cost for a university with 500 students (3-year TCO, hosting included)

Server infrastructure & hosting

included

IT administration & maintenance

included

AI features (Copilot, DocuChat, Concierge)

included

Workshops & onboarding

approx. €5,000

LMS licenses (3 years)

approx. €40,000

Total over 3 years

approx. €45,000

Canvas

Typical LMS cost for a university with 500 students (3-year TCO, cloud hosting)

Canvas Plus licenses (3 years)

approx. €54,000

Implementation & SIS integration

approx. €22,000

LMS administration (0.4 FTE internal)

approx. €24,000

Training for instructors & IT

approx. €12,000

Extended AI features from 10/2026

approx. €14,000

Total over 3 years

approx. €126,000

Good to know

Note

The Canvas estimate is based on publicly reported price ranges for institutions of this size, plus implementation and internal effort typical of a cloud LMS. Not included: the separate campus management system that Canvas requires alongside it, and the interface maintenance that comes with it. Not included on the Fuxam side either: the cost of further Fuxam modules. Both figures are budgeting ranges, not quotes.

More about FuxamLMS

The Fuxam module landscape

An LMS that becomes an operating system

FuxamLMS is a module and at the same time part of FuxamOne. Campus management, exams, applications and the mobile app share a single data foundation. No reconciliation. No interface project. For universities replacing several systems anyway, that changes the calculation; for everyone else it is initially of secondary importance.

FuxamCMS

Central campus management with AI-assisted data maintenance and automated processes.

Learn more

FuxamLMS

Learning environment with workbench editor, learning journey, interactive tasks and native AI.

Learn more

FuxamExams

Digital exams with bring-your-own-device security and AI-assisted evaluation.

Learn more

FuxamApply

Application page in your own branding, drag-and-drop form builder, automated review workflows.

Learn more