Asana backup security & compliance: GDPR, ISO 27001, NIS2

Shared responsibility applies here too

Like most SaaS platforms, Asana protects its own infrastructure and platform availability. The data your team creates — and the ability to recover it after an accidental deletion, a runaway rule or a bad import — remains your responsibility. Auditors know this. "The vendor keeps backups" does not pass an assessment.

Where an independent backup fits your framework

• ISO 27001 (A.8.13) — backup copies of information, protected and tested. A dated daily snapshot history is direct evidence.
• SOC 2 (Availability & Confidentiality) — client data must be recoverable. Independent downloadable archives prove you don't depend on a single vendor.
• NIS2 — for in-scope EU organizations, backup and disaster recovery are explicit requirements, and operational project data is in scope.
• GDPR art. 32 — the ability to restore availability of personal data after an incident. Tasks and comments about people are personal data.

How your snapshots themselves are protected

• Read-only OAuth — we never see your Asana password; you can revoke access anytime from your Asana settings.
• Encryption — tokens and archives encrypted in transit (TLS) and at rest (AES-256).
• EU hosting — snapshots stored on servers in the European Union.
• No secondary use — your data serves only the backup service. Never analyzed, shared or sold. Deletion on request, per GDPR.