Company: ASAN
Filing Date: 2025-03-18
Form Type: 10-K
Source: 0001477720-25-000045
Chunk: 15

Company: Asana, Inc.
Filing Date: 2025-03-18
Form: 10-K
Item: Item 1
Chunk 15
---
 our employees in furtherance of the security, confidentiality, integrity, and availability of customer data; and having a qualified third party perform security assessments on a periodic basis to test against security standards and practices. 

Our security program considers the American Institute of Certified Public Accountants (“AICPA”) Trust Services Criteria for Security, Availability, and Confidentiality as well as the ISO 27001:2013 standards for the systems that process the data our customers store in Asana. We issue a SOC 2 Type II report on an annual basis and are certified against ISO 27001:2013, and ISO 27017:2015. This means that independent third parties have both validated our processes and practices with respect to these standards, and confirmed our ability to maintain compliance with controls we have implemented. 

We have built our platform with security features, integrations, and infrastructure that are designed to be scalable as we develop and introduce new functionality. We have implemented a variety of safeguards designed to protect the security of our platform, including encrypting user data in transit and at rest, replicating our databases to support reliability of the platform, and controlling access to our facilities and office network.

Our commitment to meeting the rigorous security and compliance needs of regulated industries, including government customers, can be seen in our announced pursuit of FedRAMP authorization in the United States. This strategic initiative seeks to better enable healthcare providers, financial institutions, and governmental bodies to use Asana's work management platform while maintaining compliance with their strict security and privacy standards.

Data Protection and Privacy for Our Customers

We are committed to protecting the privacy rights of our customers. We have established a comprehensive privacy and data protection compliance program, aligning our practices with regulations such as the European Union’s General Data Protection Regulation 2016/679 (“EU GDPR”) and the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CPRA”) (collectively, “CCPA”). Asana also aligns its privacy program for the systems that process the data our customers store in Asana to privacy certifications such as ISO/IEC 27701:2019 and ISO 27018:2019. We deliver periodic training to our employees on privacy practices, review and map the data we collect, use, and share, and have created a global customer rights program to reply to customer requests pertaining to data privacy. Additionally, Enterprise customers can purchase a version of Asana that can be used to comply with their obligations under the U.S.