Does your organization use Notion? One sensor, and Openwake watches it on its own: the documents re-read daily, every moved clause told.Start free
Notion did not let our reader in: privacy policy (HTTP 401), subprocessors (HTTP 404). Facts below come only from what was readable; anything marked "not stated" may simply be behind that block. We retry daily and rebuild the record the moment the documents open. Work for Notion? Claim the profile and send us the text.
Trains on customer data
Training posture: does not train
for the product and account type the quoted document covers
“User data is never used to train or influence Notion AI models.”
Opt-out mechanism
none described
Not stated in the documents we could read. An absence here is an unknown, not a no.
AI features
none stated
Not stated in the documents we could read. An absence here is an unknown, not a no.
Retention
AI embeddings are deleted within 60 days of page or workspace deletion.
“AI embeddings are deleted within 60 days of page or workspace deletion.”
Hosting regions
not stated
Not stated in the documents we could read. An absence here is an unknown, not a no.
Subprocessor notice
not stated
Not stated in the documents we could read. An absence here is an unknown, not a no.
Downstream
Who's behind Notion, as listed in its own subprocessor documents. 17 subprocessors.
Model providers
- AnthropicGlobal
- Fireworks AIGlobal
- OpenAIunstated
Hyperscalers
- Amazon Web ServicesUSA
- Google Cloudunstated
Other subprocessors
- 1Passwordunstated
- AmplitudeUSA
- Boxunstated
- Cloudflareunstated
- Discordunstated
- Figmaunstated
- FivetranUSA
- MailgunUSA
- Oktaunstated
- SplunkUSA
- TwilioUSA
- Vercelunstated
Reviewer notes
Extracted by deterministic rules (rules/v1), no language model. Coverage is limited to recognisable clauses and a gazetteer of common subprocessors; absent values mean 'not matched', not 'not present'.
Documents read
- privacy policy https://www.notion.com/privacyHTTP 401 · 2026-10-22
- subprocessors https://www.notion.com/help/subprocessorsHTTP 404 · 2026-10-22
- dpa https://trust.notion.com/legal/dpaHTTP 200 · 2026-10-22
Document changes
- low 2026-10-22 · dpa +2 / −1 lines
show diff
+ Network Architecture Diagram+ Workers (Beta) Security White Paper− Workers Security White Paper - high 2026-10-21 · dpa +120 / −14 lines
show diff
+ OverviewNotion Security & TrustDocumentationProduct Security FeaturesSubprocessorsTerms and PrivacyBug BountyControlsLatest Updates+ Data protection and privacy+ Restricted production data use+ Data retention and deletion+ Customer-requested deletion+ Restricted encryption key access+ Key rotation and compromise response+ Information is classified by sensitivity, with customer data and user content designated as the most sensitive category and subject to privileged, monitored, and explicitly approved access.+ Customer data is prohibited from being used or stored in non-production environments unless explicitly authorized through a documented process with appropriate safeguards.+ Customer data is retained and deleted according to contractual, legal, regulatory, and documented retention requirements, including deletion upon termination where applicable.+ Customers may request deletion of their confidential information, and deletion requests are documented and tracked through completion.+ Customer data transmitted over public networks is protected using secure transport encryption, helping prevent interception and unauthorized modification.+ Customer and other sensitive data stored in production systems is encrypted, reducing exposure if storage media or services are accessed improperly.+ Encryption keys are stored in approved key management systems and access is limited to authorized personnel.+ Keys are rotated when compromised and on a defined recurring basis, while suspected compromise triggers prompt revocation or rotation procedures.+ Multi-factor authentication is enabled for workforce identity accounts, critical systems, privileged access, and production access where supported.+ Role-based least-privilege access+ Access is assigned according to job role and limited to the minimum privileges needed to perform authorized responsibilities.+ Access approval workflow+ Requests for access and access changes require documented business justification and approval from designated managers or system owners before provisioning.+ Management reviews user roles and permissions at least quarterly, including privileged access, to identify and correct inappropriate access.+ SOC 2 Type II examination+ An independent service auditor examined the design and operating effectiveness of controls supporting security, availability, and confidentiality over the review period.+ ISO/IEC 27001 certification+ The information security management system is certified against ISO/IEC 27001, with annual surveillance audits supporting continued conformity.+ HIPAA and HITECH attestation+ An independent practitioner reported that the information security and breach notification program conformed to applicable HIPAA Security Rule and HITECH criteria.+ C5 cloud security attestation+ An independent practitioner examined the design and operating effectiveness of controls against the BSI C5 cloud computing criteria.+ Secure software development lifecycle− OverviewNotion Security & TrustDocumentationSubprocessorsTerms and PrivacyBug BountyControlsLatest Updates− Access control and authentication− All data transmitted between clients and Notion servers is encrypted using TLS 1.2 or greater, protecting against interception or tampering during transit.− All customer data stored on Notion's internal networks, cloud storage, database tables, and backups is encrypted at rest using AES-256 encryption. This applies across all Notion products and regions, including Notion core, Notion AI, Calendar, Mail, and all hosting regions.− Two-step verification is available across all plan types with support for SMS-based codes, TOTP via authenticator apps, passkeys with biometric authentication, and backup codes.− Access rights are reviewed at least quarterly by designated managers or system owners to ensure appropriateness. Inappropriate access is revoked, and discrepancies are escalated to the Information Security team.− Notion maintains a formal Data Classification Policy with four levels: Restricted Data, Highly Confidential, Confidential, and Public Data. Customer data and PII are classified as Restricted Data.− Production servers do not face the internet directly and are positioned behind a DMZ. Internet-facing services operate with a deny-by-default posture and least-privilege network connectivity.− All third-party vendors undergo security assessments including questionnaire distribution, attestation report review, penetration test evaluation, and artifact analysis based on criticality and risk factors.− All employees complete mandatory annual security and privacy awareness training, including incident response training. Resources expected to respond to security incidents receive specialized training.− A mobile device management (MDM) tool continuously enforces security configurations and EDR deployment across all company-managed devices, ensuring consistent security posture.− CERTIFICATIONS− PRIVACY & LEGAL− What is a Subprocessor? In order to provide our Services, Notion engages the Subprocessors listed in the tables below. A Subprocessor is a third-party engaged by Notion Labs, Inc., and its applicable Affiliates, to process Customer Personal Data. Capitalized terms used herein are defined in Notion’s Data Processing Addendum. How do I subscribe to new Subprocessor notifications? Customers may sign up to receive notification of new Subprocessors by e-mailing team@makenotion.com with the subject “Subscribe to New Subprocessors.” - medium 2026-10-13 · dpa +0 / −6 lines
show diff
− Connect via MCPSubscribe to updatesGet accessEN− See all documents− Request access− See all 26 subprocessors− See all 16 controls− AI governance and securityEncryption and key managementAccess control and authenticationCompliance and certificationsApplication securityData protection and privacyIncident responseBusiness continuity and disaster recoveryNetwork and infrastructure securityVulnerability managementMonitoring and loggingThird-party risk managementEmployee securityPhysical and environmental securityEndpoint securityChange management - high 2026-09-25 · dpa +4 / −1 lines
show diff
+ OverviewNotion Security & TrustDocumentationSubprocessorsTerms and PrivacyBug BountyControlsLatest Updates+ Contact supportReport a vulnerability+ What is a Subprocessor? In order to provide our Services, Notion engages the Subprocessors listed in the tables below. A Subprocessor is a third-party engaged by Notion Labs, Inc., and its applicable Affiliates, to process Customer Personal Data. Capitalized terms used herein are defined in Notion’s Data Processing Addendum. How do I subscribe to new Subprocessor notifications? Customers may sign up to receive notification of new Subprocessors by e-mailing team@makenotion.com with the subject “Subscribe to New Subprocessors.”+ LATEST UPDATES− OverviewNotion Security & TrustDocumentationSubprocessorsTerms and PrivacyBug BountyControlsUpdates - low 2026-09-23 · dpa +1 / −1 lines
show diff
+ OverviewNotion Security & TrustDocumentationSubprocessorsTerms and PrivacyBug BountyControlsUpdates− and PrivacyBug BountyNotion Security & Trust - high 2026-09-22 · dpa +2 / −2 lines
show diff
+ Service provider for AI agents, hosting large language models and embeddings, and for abuse prevention.+ Google LLC · Global− Service provider for AI agents, hosting large language models and embeddings.− Google Cloud · Global - high 2026-09-14 · dpa +17 / −17 lines
show diff
+ Notion's security and compliance program is built on transparency, trust, and enterprise-grade protection. Explore our certifications, security controls, policies, and subprocessors to understand how Notion safeguards your data. * Annual third-party audits: SOC 2 Type II, ISO 27001/17/18/701, HIPAA, BSI C5. * Annual third-party penetration testing. * Bug bounty program through [HackerOne](https://hackerone.com/notion). * 99.9% uptime SLA ([notion-status.com](https://www.notion-status.com/)). * [Notion Security & Trust](https://notion.notion.?pvs=143 "Notion Security & Trust") * [Privacy policy](https://www.notion.). * [Data processing addendum](https://www.notion.). * [Subprocessor list](https://notion.notion.).+ * Notion Security & Trust+ Hosting and storage systems provider.+ Security for MCP connections.+ Content distribution and processing, security, abuse prevention and DNS services.+ Kafka managed streaming storage platform used for in-product audit log data and analytics.+ Translation services.+ PDF file conversion.+ Service provider for hosting large language models and embeddings and for abuse prevention.+ Service provider for providing web search results and for hosting large language models and embeddings.+ Security and application logging.+ Storage platform used for in-product analytics.+ Vector database for storing embeddings.+ Multi-factor Authentication.+ Support services.+ Event logging for analytics.+ Data pipeline for connecting systems to our data warehouse.− Notion's security and compliance program is built on transparency, trust, and enterprise-grade protection. Explore our certifications, security controls, policies, and subprocessors to understand how Notion safeguards your data. * Annual third-party audits: SOC 2 Type II, ISO 27001/17/18/701, HIPAA, BSI C5. * Annual third-party penetration testing. * Bug bounty program through [HackerOne](https://hackerone.com/notion). * 99.9% uptime SLA ([notion-status.com](https://www.notion-status.com/)). * [Privacy policy](https://www.notion.). * [Data processing addendum](https://www.notion.). * [Subprocessor list](https://notion.notion.).− Hosting and storage systems provider− Security for MCP connections− Service provider for hosting large language models and embeddings− Content distribution and processing, security, abuse prevention and DNS services− Kafka managed streaming storage platform used for in-product audit log data and analytics− Translation services− PDF file conversion− Service provider for hosting large language models and embeddings and for abuse prevention− Service provider for providing web search results and for hosting large language models and embeddings− Security and application logging− Storage platform used for in-product analytics− Vector database for storing embeddings− Multi-factor Authentication− Support services - high 2026-09-13 · dpa +16 / −15 lines
show diff
+ Hosting and storage systems provider+ Security for MCP connections+ Service provider for hosting large language models and embeddings+ Content distribution and processing, security, abuse prevention and DNS services+ Kafka managed streaming storage platform used for in-product audit log data and analytics+ Translation services+ PDF file conversion+ Service provider for hosting large language models and embeddings and for abuse prevention+ Service provider for providing web search results and for hosting large language models and embeddings+ Security and application logging+ Storage platform used for in-product analytics+ Vector database for storing embeddings+ Multi-factor Authentication+ Support services+ Event logging for analytics+ Data pipeline for connecting systems to our data warehouse− Hosting and storage systems provider.− Security for MCP connections.− Content distribution and processing, security, abuse prevention and DNS services.− Kafka managed streaming storage platform used for in-product audit log data and analytics.− Translation services.− PDF file conversion.− Service provider for hosting large language models and embeddings and for abuse prevention.− Service provider for providing web search results and for hosting large language models and embeddings.− Security and application logging.− Storage platform used for in-product analytics.− Vector database for storing embeddings.− Multi-factor Authentication.− Support services.− Event logging for analytics.− Data pipeline for connecting systems to our data warehouse. - low 2026-09-11 · dpa +2 / −1 lines
show diff
+ and PrivacyBug BountyNotion Security & Trust+ Notion Security & Trust− and PrivacyBug Bounty - high 2026-09-08 · dpa +15 / −16 lines
show diff
+ Hosting and storage systems provider.+ Security for MCP connections.+ Content distribution and processing, security, abuse prevention and DNS services.+ Kafka managed streaming storage platform used for in-product audit log data and analytics.+ Translation services.+ PDF file conversion.+ Service provider for hosting large language models and embeddings and for abuse prevention.+ Service provider for providing web search results and for hosting large language models and embeddings.+ Security and application logging.+ Storage platform used for in-product analytics.+ Vector database for storing embeddings.+ Multi-factor Authentication.+ Support services.+ Event logging for analytics.+ Data pipeline for connecting systems to our data warehouse.− Hosting and storage systems provider− Security for MCP connections− Service provider for hosting large language models and embeddings− Content distribution and processing, security, abuse prevention and DNS services− Kafka managed streaming storage platform used for in-product audit log data and analytics− Translation services− PDF file conversion− Service provider for hosting large language models and embeddings and for abuse prevention− Service provider for providing web search results and for hosting large language models and embeddings− Security and application logging− Storage platform used for in-product analytics− Vector database for storing embeddings− Multi-factor Authentication− Support services− Event logging for analytics
Fact changes
No changes recorded yet. Changes appear here when a later reading differs from an earlier one.
Corrections
No correction requests. Anyone may dispute a fact with a source; requests and resolutions are public and ledger-entered.
Facts are as stated in Notion's public documents on the date read. This is a record, not legal advice. Work for Notion? Claim this profile · Something wrong? Request a correction.