Asana, Inc. is a publicly traded (NYSE: ASAN) work management platform used by organizations to plan, track, and manage tasks and projects. Its Privacy Statement (effective January 1, 2026) describes collection of account information plus metadata and inference information about how users work, including logged in-product actions and approximate location inferred from IP addresses. Asana operates a subscription business rather than an advertising marketplace, but its marketing websites use third-party targeting cookies and pixels, and its policy permits disclosing contact and device information to online advertising and analytics partners. Asana publishes a subprocessor list (including AWS, Google Cloud, Amplitude, OpenAI, and Anthropic), holds SOC 2 Type 2 and ISO 27001-family certifications, certifies under the EU-US Data Privacy Framework, and states that third-party LLM providers are contractually prohibited from training on customer data. In June 2025, a logic flaw in its Model Context Protocol (MCP) AI feature exposed some customer data across organizations for over a month; Asana disclosed the incident in its 10-K. Co-founder Dustin Moskovitz holds a majority of voting power via a dual-class share structure.
TRACK RECORD
1 ENFORCEMENT ACTION
[2026-03-13]
In its FY2026 Form 10-K risk factors, Asana disclosed that in June 2025 a flaw in the implementation of its Model Context Protocol (MCP) feature potentially made certain customers' data accessible to other users of the feature, and acknowledged it has suffered security incidents in the past.
Asana's developer-reported Apple App Privacy label lists 'Data Linked to You' categories including contact info (email address, name), identifiers (User ID, Device ID), user content, search history, usage data, and diagnostics, with stated purposes that include 'Developer's Advertising or Marketing' and analytics. Apple notes this information is self-reported by the developer and has not been verified by Apple.
As assessed by PrivacySpy on 2021-01-05 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
Asana's Privacy Statement states it collects metadata and inference information about how users work — logging in-product actions such as tasks viewed or deleted, features used, and integrations — and derives approximate geographic location from IP addresses; it also receives user information from third parties including marketing services and integrations. For AI features, the same policy states Asana's third-party LLM service providers are contractually prohibited from using customer data to train their models.
As assessed by PrivacySpy on 2021-01-05 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.
Asana states it is certified under the EU-US Data Privacy Framework, the UK Extension, and the Swiss-US Data Privacy Framework as set forth by the US Department of Commerce, a certification verifiable in the Department of Commerce's public DPF program list.
Asana is a standalone public company (NYSE: ASAN) whose FY2026 Form 10-K discloses that co-founder and Chair Dustin Moskovitz beneficially owns a majority of the voting power of its capital stock as of January 31, 2026, via a dual-class structure in which Class B shares carry 10 votes per share — full ownership disclosure, but concentrated founder control.
Asana's Law Enforcement Guidelines state it discloses user information to authorities only under established legal process consistent with the Stored Communications Act (subpoena for basic records, court order or search warrant for more), and that its default policy is to notify users of requests before disclosure unless legally prohibited or in emergency circumstances.
As assessed by PrivacySpy on 2021-01-05 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes, but you may opt-out.
Asana's CCPA disclosures acknowledge that contact information (including email) and internet network/device information (cookie data, IP address) may be disclosed to online advertising and analytics partners — activity users can opt out of as cross-context behavioral advertising. The same policy states Asana does not disclose user information to third parties for their own direct marketing purposes, though aggregated and de-identified data may be disclosed to any third parties including advertisers.
Asana publishes a dated subprocessor list naming the third parties that process customer data — including Amazon Web Services and Google Cloud (infrastructure), Amplitude (analytics), Databricks (data warehouse), and OpenAI and Anthropic (LLM providers for AI features) — and states each subprocessor must sign a written agreement with data-protection obligations at least as protective as Asana's own measures.
Reporting on the incident states the MCP feature launched May 1, 2025, Asana discovered the logic flaw on June 4, 2025 — meaning cross-organization data exposure persisted for over a month — and that exposed data could include task-level information, project metadata, comments, and uploaded files; the exposure resulted from a software bug, not an external attack.
In its FY2026 Form 10-K risk factors, Asana disclosed that in June 2025 a flaw in the implementation of its Model Context Protocol (MCP) feature potentially made certain customers' data accessible to other users of the feature, and acknowledged it has suffered security incidents in the past.
Asana's iOS App Store privacy label contains no 'Data Used to Track You' section — the developer declares no data used for cross-app or cross-website tracking for the mobile app, only 'Data Linked to You' categories. This is a developer self-report that Apple states it has not verified.
Asana's Cookies Notice discloses use of third-party 'Targeting Cookies' from its advertising partners that collect browsing-habit information, as well as web beacons (tracking pixels) on its websites and in emails to analyze usage and measure engagement.
Asana's Privacy Statement discloses that its advertising partners place cookies and similar technologies on Asana's website to retarget visitors with Asana ads on other websites. The policy states Asana honors the Global Privacy Control signal 'where required' but does not currently recognize or respond to browser Do Not Track signals.