TDS Asana Gateway

Privacy notice

The TDS Asana Gateway is operated by Digital Stronghold for authorized employees. It connects supported AI clients to the Digital Stronghold and Taylor Stitch Asana workspaces using each employee’s own authorized access.

This notice covers the gateway at asana.thedigitalstronghold.com, not every Digital Stronghold service. Connecting an account does not give you permissions you do not already have in Asana.

Information we handle

Google sign-in. We use Google through Auth0 to authenticate you. Sign-in requests basic identity information: an account identifier, verified email and basic profile information, which may include your name and profile picture. It does not request access to Gmail, Google Drive or Google Calendar. The gateway’s user database stores your account identifier, email, company domain, access-expiry and disabled status, and related timestamps.
Asana connections. When you authorize a workspace, we store your Asana account identifier and email, workspace identifier and name, connection status, authorization and expiry timestamps, and encrypted access and refresh tokens.
Work requested through an AI client. The gateway processes tool inputs and Asana responses, which can include task, project and comment content. It passes results back to the requesting client. Task, project and comment bodies are not stored in the gateway’s database or application audit records.
Authentication and operational records. We keep connection-attempt information and security audit metadata, including account identifiers, company domain, workspace, tool name, action category, request identifier, outcome, timestamp, latency and safe error codes. Application HTTP logs record the request method, path without its query string, status and request identifier. Our application audit records do not contain tool inputs, tool results or authorization tokens.

Why we use it

We use this information to verify employee eligibility, maintain your authorized connections, route supported Asana requests to the chosen workspace, enforce access controls, and investigate failures or misuse. Google identity information is used for authentication and access management, not for retrieving your Google documents or email.

Where information goes

Google and Auth0 handle sign-in. Asana handles authorization and Asana operations. Heroku hosts the gateway and its PostgreSQL database, and Papertrail handles operational logs. These providers may also process technical information, such as IP addresses and browser information, through their own systems.

Your chosen AI client and its provider receive the Asana content returned to them, along with relevant connection, account and workspace metadata. Their storage, conversation retention and model-training rules depend on that provider and your organization’s settings; this gateway does not control them. Use only company-approved clients for company information.

Cookies and security

The gateway uses necessary cookies for sign-in, browser sessions and authentication or renewal flows. Its pages use locally hosted assets and do not include advertising or analytics scripts.

Asana tokens are encrypted in the gateway database and decrypted on the server when needed to perform authorized operations, refresh access or attempt revocation. HTTPS protects traffic to the hosted gateway. Employee eligibility, workspace routing, Asana permissions and the gateway’s supported tools limit access. No system can guarantee absolute security.

Retention and disconnecting

Connection credentials remain in the active database until you disconnect that workspace or an administrator removes them, including during offboarding. Access expiry alone does not delete stored records.

Disconnecting removes the selected Asana grant from the active gateway database, invalidates pending connection attempts and attempts to revoke that grant with Asana. The gateway reports if Asana cannot confirm revocation. You can also manage the authorization in Asana.

Disconnecting does not erase your Asana content, information already returned to an AI client, your gateway user record, historical audit or authentication-flow records, or copies in retained backups.

The daily cleanup deletes security audit records older than 90 days and connection-setup or renewal records more than 24 hours past their expiry. Deletion happens during a cleanup run, not at the exact retention threshold. These schedules do not delete Asana tasks or AI conversations.

Gateway user records are used to manage access. On offboarding, saved Asana credentials and pending connection records are removed, and your email and company domain are cleared from the gateway user record. A minimal blocked-account record, containing the account identifier and security timestamps, is retained to prevent the same account from signing back in. That access-block record has no automatic expiry.

Provider logs and automatically managed database backups follow their existing provider retention settings. Our policy is to delete manually captured database snapshots older than 30 days. Removed records can remain in retained backups until those backups expire or are deleted. Session and authorization time limits control access; they are not data-retention periods.

Your choices and contact

You choose which supported Asana workspaces to connect and may disconnect them separately from the gateway’s connection page. Removing the gateway from an AI client and disconnecting its Asana grants are separate actions. Logging out ends the browser session; it does not delete the grants.

For privacy questions, correction requests or requests to remove gateway-held information, contact rick@thedigitalstronghold.com. Requests require review of the records involved, including security records and retained backups. Do not send passwords, tokens or client secrets by email.