Data

Asana and the GDPR: AI training, data location and DPA

Advanced: Doesn't train on your data. EU hosting only on higher plans · DPA in the terms.

Vendor: Asana, Inc.Workspace and projectsChecked on How we check

Verdict

Is Asana GDPR compliant?

Advanced

Business

Doesn't train on your data

EU hosting only on higher plans · DPA in the terms

Price: $24.99 / user / mo

No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.

Training

Does Asana train on your data?

Trains on your data by default?

Checked

Doesn't train on your data.

No. Asana does not use or let its third-party AI partners use customer data to train the generative AI models behind Asana AI

Source: asana.comSection 'Asana AI' ('For purposes of clarity, Asana does not use or permit…')Checked on

Location

Where does Asana store your data?

Where data is stored by default

Checked

United States: organisations are hosted in AWS data centres in the US unless moved under a data residency order

Source: asana.comSection 'Data Residency'Second source: asana.comChecked on

EU hosting on this plan

Checked

EU hosting only on higher plans.

Not on Advanced: EU data residency is part of Enterprise+ and is ordered as a data residency SKU; profile data and organisation membership stay in the US

Source: asana.comEnterprise+ note ('adds SIEM integration, data residency…')Second source: asana.comChecked on

Contract

Does Asana sign a data processing agreement?

Data processing agreement (DPA)

Checked

DPA in the terms.

Yes. Asana's DPA (effective 1 Sep 2026) is incorporated by reference into the subscription agreement

Source: asana.comPreambleChecked on

Processors

Who else handles Asana data?

Sub-processors (companies that handle the data for them)

Checked

23 listed.

Public. 23 entries (15 companies) in four groups, mostly in the US; AI from Anthropic, OpenAI, AWS Bedrock, Google Gemini and Fireworks

Source: asana.comSubprocessors page (last updated 11 Sep 2026)Checked on

EU–US Data Privacy Framework

Checked

On the list.

Active (Asana; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Asana'Checked on

Security

Which certifications and admin controls does Asana have?

Security certifications

Checked

SOC 2 Type 2, SOC 3, ISO/IEC 27001, 27017, 27018 and 27701; HIPAA

Source: asana.comCompliance sectionChecked on

The vendor doesn't say: retention, admin controls, price.

Alternatives

Asana alternatives that don't train on your data

Other workspace and projects tools whose business plan doesn't train on your data and includes a DPA.

The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.

Tool · PlanVerdictYour five rules
  • Google Chat

    Google Workspace Business Standard · €13.60 / user / mo

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

  • Miro

    Business · €20 / user / mo

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

  • monday.com

    Pro · €19 / user / mo

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

  • Teamwork.com

    Basics · $9.99 / user / mo

    Doesn't train on your dataEU hosting available · DPA on request

    ✓✓✓✓✓

  • Wrike

    Business · $25 / user / mo

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

Need something your tools can't do?

We design and build what your team is missing, around the way you already work and the data rules you set.

Book a callServices