Asana

Asana

Search the Trust Center...
Ctrl +K

Asana | Trust Center

This Trust Center provides you with resources demonstrating Asana's continuous commitment to protecting customer data. Below you'll find information about Asana's trust practices including additional information related to security, privacy, AI, and general infrastructure documentation. We prioritize security in our product strategy and build our platform using best practices for highly available, scalable, and secure cloud applications. We regularly monitor and assess our program to ensure it meets or exceeds compliance and regulatory requirements.

Report a vulnerability at: security@asana.com

Asana’s security and privacy programs are led by industry veterans with decades of experience:
Justin Berman: Head of Security
Whitney Merrill: Head of Global Privacy & Data Protection Officer (DPO)

altWant information on StackAI? See StackAI's Trust Center

Announcements

Asana response to PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

Thank you for reaching out regarding the recently reported PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, also known as PHP2Shell).

Following a thorough investigation by our security and engineering teams, we can confirm that Asana and StackAI are not affected by these vulnerabilities. Asana and StackAI's production application and the supporting infrastructure that processes customer data do not use PHP. Because Asana is not impacted, no remediation, patching, or mitigation actions are required on our end.

Additionally, we can confirm that we have found no evidence of exploitation and no impact on customer data as a result of these vulnerabilities. If your organization runs its own PHP-based applications, we recommend upgrading to a fixed release (8.5.12, 8.4.27, 8.3.36 or 8.2.35) or applying your vendor's backport. We will continue to monitor developments and will contact you if our assessment changes.

Badges

gdpr
GDPR
ccpa
CCPA
CSA STAR 1
CSA STAR 1
dora
DORA
eu-us-data-privacy
EU-US DPF
tx-ramp
TX-RAMP
vpat
VPAT

Quick Summary

One or more annual third-party audit(s)

Has a formal mobile device management (MDM) program

Annual third-party penetration testing

Has a disaster recovery plan

Has cyber insurance

Deletes customer data on request

Uses a centralized IAM solution (SSO) to manage employee access

Has an AI policy

What we offer

Asana

Asana is a project management tool to help teams organize, track, and manage their work across teams.

Typical data access: Asana will store data about the projects that you manage on the platform, so the sensitivity may vary based on the projects in scope.

Documents & Knowledge Base FAQs

Featured Documents

Powered by Conveyor, the first end-to-end customer trust platform.
Learn more