From what I can tell, right now, anything I put in Asana will end up in an email notification. Given that SMTP has no guarantee of transit in trusted networks or encryption in transit, I then need to assume that all task information is being leaked by Asana’s email notifications in cleartext. I’m not concerned about the intended recipient of the email, but of all the intermediaries that may process an email in transit.
The risks will vary, and I’m not trying to be overly dramatic here. For some use cases, that risk of leakage is low and the actionable information in the leak will be task information.
My concern is for anything with even mild sensitivity. I see I can turn off many kinds of notifications for myself and others, but that I can’t control some kinds of email notifications that may include task content.
My request is, hopefully, relatively simple. I’d like a way to mark either a project or a field (or both?) as not being allowed to be included in email. It could be a toggle “include task information in email notifications” for the project, or on the field “include field in email notifications.” If I could toggle off fields that have higher risks if intercepted via plaintext email, then that’s a mitigating control for putting data into Asana. I understand that very sensitive information just shouldn’t live here, but in some cases, operational information would be useful to include without requiring the user to think through the risks of disclosure via email for each piece of information.