Does Asana’s AI train on your projects? No training by default, and the privacy function behind it is more resourced than most tools in this category.
Plain-English risk rating: 2 of 5
Scope note, added 3 September 2026. This rating covers a product that does not exist on Asana’s free Personal plan. Asana’s own page states that Asana AI is available on all paid tiers, with AI Studio on Starter, Advanced, Enterprise and Enterprise+. A free-plan workspace is not running the thing rated below. The rating itself is unchanged.
Asana's AI features ("Asana Intelligence") sit within Asana's broader workspace product and inherit its security posture. Asana operates a contractual no-training default with its third-party AI subprocessors, holds SOC 2 Type II, ISO 27001, and ISO 27017/27018 certifications, supports HIPAA via the Enterprise+ tier with BAA, and offers EU Data Residency. The Asana Trust Center (powered by SafeBase, verified 2026-05-24) provides documented evidence including a current FY25 penetration test by Praetorian Security.
Notably, Asana's privacy programme is led by Whitney Merrill as Global Privacy & Data Protection Officer — a recognised privacy practitioner who previously led privacy at Electronic Arts and the Federal Trade Commission. The leadership signal matters because the privacy posture of a SaaS vendor often tracks the quality of its DPO.
The risk picture is dominated less by Asana-specific concerns and more by the category-level prompt-injection class that affects any AI-with-access-to-workspace-content, and by the Atlassian competitive context (Atlassian's August 2026 AI training policy change to opt-out has driven some customers to evaluate alternatives, of which Asana is one).
Recommended for
- Sole proprietor: Asana Starter at US$10.99 a user a month billed annually (US$13.49 monthly) includes AI features. Acceptable for general project tracking with light AI usage.
- Small team (2-10 people): Advanced or Enterprise tier with appropriate admin controls. The Asana Intelligence features (smart fields, smart status updates) provide modest productivity uplift; the AI Studio (agentic workflows) requires more deliberate configuration.
- Regulated industry: Enterprise+ with BAA for HIPAA, EU Data Residency configured where applicable, FY25 penetration test report reviewed under NDA via SafeBase portal.
- The honest answer for most 1-10 employee businesses using Asana: AI features are bundled into existing paid tiers and the privacy posture is acceptable. The deliberate decision is whether to enable AI Studio agentic workflows on workspaces containing client-sensitive content — if so, prefer Enterprise tier and scope agent access carefully.
Data retention default
- Standard Asana data lifecycle applies to AI feature output
- Third-party AI subprocessors confirmed on Asana's published subprocessor list: Anthropic PBC and OpenAI OpCo, LLC as LLM providers, and AWS Bedrock and Google (Gemini Enterprise Agent Platform) for AI-enabled functionality. Anthropic processes in the United States, OpenAI in the United States and Norway, Bedrock in the United States and the European Union, and Google in the United States and Europe. (Subprocessor list last updated 11 September 2026, read 25 October 2026. Google Gemini was added after our earlier reading.) They operate under Asana's contractual no-training default.
- Fireworks AI, Inc. was added to that list on 31 August 2026, when Asana’s subprocessor page moved from a 22 June 2026 effective date to 31 August. Asana lists it under infrastructure subprocessors as a “cloud service provider”, rather than alongside Anthropic and OpenAI under LLM providers. Fireworks AI is an AI inference provider — its business is hosting and serving models on behalf of other companies — so the placement is worth knowing about even though the entry itself is accurate. We have not verified whether Asana’s contractual no-training default extends to it, and Asana does not say. Detected by monitoring 1 September 2026; the profile as a whole was last read end to end on 13 August 2026.
- Provider retention: not published as a number. Asana's Data Processing Addendum commits only to retaining information “for the period necessary to fulfil the purposes outlined in our privacy statement”. A previous version of this page stated 30-day standard provider retention for non-Enterprise tiers with zero-retention APIs at Enterprise. Neither figure appears in Asana's published terms and both are withdrawn, corrected 13 August 2026.
- Asana admin retention policies apply to AI-generated content (smart fields, summaries) the same way as user-generated content
- Per Asana Privacy Statement: chat transcripts of conversations with AI chatbots stored and processed for staff training and quality assurance purposes
Training opt-out
NO TRAINING ON CUSTOMER DATA, STATED BY ASANA ITSELF AND SEPARATELY REQUIRED OF ITS AI PARTNERS.
Corrected 21 September 2026, and this corrects a correction. On 20 September this section was changed to say that Asana's own position was NOT STATED. That went too far. Asana does state it, on its published AI FAQ. See Corrections.
Corrected 20 September 2026. This section previously read "NO TRAINING ON CUSTOMER DATA BY DEFAULT across plan tiers", which is broader than the evidence beneath it. See Corrections.
Asana's subprocessor agreements prohibit training on Asana customer content, and that commitment is contractual rather than a user toggle. It is a statement about the third parties Asana sends content to. Asana states both commitments in one sentence on its AI FAQ: "Asana does not use customer data for training and has contractual agreements with its AI partners that prohibit the use of customer data to train or improve their AI models and services." Read at source on 21 September 2026. Note where the word contractual sits: it attaches to the AI partners. Asana's own no-training position is a statement of practice on a help page, which the company can revise, rather than a term of your contract. That is a real difference for a buyer who needs the commitment to survive a change of policy, and it is why this profile does not treat Asana identically to a vendor that writes the exclusion into its terms. On 20 September we said we had not found this statement. We cannot establish whether it was present then and we missed it, or was published since, so we record it here rather than only in the alerts, and readers can judge it either way. The sub-processor bar is still structurally better than Atlassian's August 2026 opt-out default and Slack's general-purpose ML default.
One further limit worth knowing: Fireworks AI was added to Asana's published subprocessor list on 31 August 2026, filed under infrastructure providers rather than alongside Anthropic and OpenAI under LLM providers. Fireworks AI is an AI inference provider. We have not verified whether the contractual no-training default extends to it, and Asana does not say.
Zero Data Retention availability
- Not an Enterprise feature — it applies to every plan, and it comes from a help page. Asana's AI FAQ says its AI partners are “contractually required to delete customer data upon completion of an individual AI query” and may not train on it. We have not seen that term in Asana's published contracts, and Asana publishes no retention period for its own copy. (Corrected 3 October 2026: this line said zero retention was available at the Enterprise tier through arrangements with model providers. Asana does not limit it to Enterprise, and calls it deletion after each query.)
- EU Data Residency for qualifying Enterprise customers
Plan tiers and pricing (read 24 October 2026 from asana.com/pricing)
| Tier | Price (USD) | AI features | Suitable for |
|---|---|---|---|
| Personal (Free) | $0 | Limited AI | Personal use; small teams up to 10 |
| Starter | $10.99/user/month annual; $13.49 monthly | AI Teammates, Asana Dash and AI Studio (about 50,000 AI Studio credits a month) | Small teams |
| Advanced | $24.99/user/month annual; $30.49 monthly | As Starter, about 75,000 AI Studio credits a month | Growing teams with workflow automation needs |
| Enterprise | Custom | Full AI features + admin controls | Larger orgs needing SSO, audit, advanced compliance |
| Enterprise+ | Custom | Full AI + advanced security/compliance | Regulated industries needing BAA, EU residency |
Jurisdiction
- Primary processor: Asana, Inc., San Francisco, California, USA
- Cloud infrastructure: AWS and Google Cloud, with Fireworks AI also listed as a cloud provider (subprocessor list, 11 September 2026)
- Third-party AI: Anthropic PBC, OpenAI OpCo LLC, AWS Bedrock and Google Gemini, named on Asana's subprocessor list, under contractual no-training arrangements
- SOC 2 Type II, ISO 27001, ISO 27017/27018 certified; HIPAA available with BAA at Enterprise+
- EU Data Residency available at qualifying tiers
- Privacy leadership: Whitney Merrill (Global Privacy & DPO); Sean Cassidy (Head of Security)
Breach history (public incidents)
June 2025: Asana MCP server data exposure
Asana launched its Model Context Protocol (MCP) server on 1 May 2025. On 4 June 2025 it found a flaw that could have let one organisation see another's data through it, took the feature offline from 5 to 17 June, reset every MCP connection and contacted the affected organisations. It did not say how many were affected; The Register reported no evidence the flaw was exploited. It is the closest publicly documented Asana AI incident. Corrected 25 October 2026: we previously dated this June 2024 and called it a pre-cursor to the 2025 MCP vulnerabilities; it was part of them.
Source: The Register, 18 June 2025; BleepingComputer, June 2025
2025-2026 — Drift data breach impact assessment
The Asana Trust Center explicitly addresses the question "Was Asana impacted by the Drift data breach?" as a documented FAQ. The proactive treatment of the question (rather than waiting for customer inquiries) is a useful transparency signal. Drift (a chat/conversation platform) had widely-reported breach issues that affected multiple integrated vendors; Asana's published position is the most useful primary source for the specifics.
Source: Asana Trust Center via SafeBase (verified 2026-05-24)
No publicly-disclosed Asana AI-specific data breach as of May 2026.
Category-level risk: As with Notion AI and Linear AI, Asana Intelligence inherits the breach exposure of its model providers. The OpenAI Mixpanel third-party breach (November 2025) and Anthropic disclosures during 2025-2026 are the threat baseline. The agentic AI Studio features put Asana in the same prompt-injection class as Microsoft 365 Copilot (EchoLeak), Salesforce Agentforce (ForcedLeak), and other agentic-AI products; the underlying class of vulnerability is unsolved across the industry.
What this means in plain English for SMB owners
Three honest takeaways:
- Asana Intelligence's no-training default plus current third-party penetration testing make it one of the lower-risk Embedded Productivity AI options. The Whitney Merrill DPO appointment is a meaningful signal about how the privacy programme is led. If you already pay for Asana, the AI features are a reasonable addition.
- The AI Studio agentic features are the deliberate decision point. Smart fields and status summaries are low-risk additions. Agentic workflows that take actions on your behalf require the same care as Microsoft 365 Copilot or Salesforce Agentforce — scope access deliberately, especially for workspaces containing client data.
- The June 2025 MCP server flaw is a useful indicator. It demonstrates that workspace AI products do have novel attack surfaces. The mitigation pattern (prompt response to disclosure, customer guidance, documented in the Trust Center) is the right posture; the underlying class of risk remains a category-level concern.
Sources
- Asana Trust Center (trustcenter.asana.com via SafeBase, verified 2026-05-24)
- Asana Privacy Statement (asana.com/terms/privacy-statement, verified 2026-05-24)
- Asana AI feature documentation (asana.com/product/ai, verified 2026-05-24)
- Praetorian Security: Asana FY25 security assessment / penetration test (referenced in Trust Center)
- The Register: Asana MCP server bug (18 June 2025)
- General Embedded Productivity AI category analysis (OWASP LLM Top 10, 2025)
Related on AI Leakage
- Compare all 29 AI tools in the risk directory — see how Asana AI / Asana Intelligence stacks up against the rest, tier by tier.
- Take the 5-minute “Am I Leaking?” check — a personalised view of your business’s AI exposure.
- Check a prompt before you paste it — our free Data-Safe Prompt Rewriter.
- Shadow AI vs AI leakage — why even approved tools like Asana AI / Asana Intelligence can leak data.
- Get plain-English AI Leakage Alerts — we email you when an AI tool you use changes its data policy or has an incident.
- Get the free AI Acceptable Use Policy template — a plain-English policy with the tool-by-tool risk guide built in.
Compare similar tools: Asana AI / Asana Intelligence is one of 4 tools in AI in team work tools compared, which sets out each one’s rating and what it does with your data, side by side.