Does your organization use Notion? One sensor, and Openwake watches it on its own: the documents re-read daily, every moved clause told.Start free
Notion did not let our reader in: privacy policy (HTTP 401), subprocessors (HTTP 404). Facts below come only from what was readable; anything marked "not stated" may simply be behind that block. We retry daily and rebuild the record the moment the documents open. Work for Notion? Claim the profile and send us the text.
Trains on customer data
Training posture: does not train
for the product and account type the quoted document covers
“User data is never used to train or influence Notion AI models.”
Opt-out mechanism
none described
Not stated in the documents we could read. An absence here is an unknown, not a no.
AI features
none stated
Not stated in the documents we could read. An absence here is an unknown, not a no.
Model providers named
OpenAI, Anthropic, AssemblyAI, Fireworks AI
“OpenAI Figma Ramp”
Retention
AI embeddings are deleted within 60 days of page or workspace deletion.
“AI embeddings are deleted within 60 days of page or workspace deletion.”
Hosting regions
not stated
Not stated in the documents we could read. An absence here is an unknown, not a no.
Subprocessor notice
not stated
Not stated in the documents we could read. An absence here is an unknown, not a no.
Downstream
Who's behind Notion, as listed in its own subprocessor documents. 18 subprocessors.
Model providers
- AnthropicGlobal
- AssemblyAIUSA
- Fireworks AIGlobal
- OpenAIunstated
Hyperscalers
- Amazon Web ServicesUSA
- Google Cloudunstated
Other subprocessors
- 1Passwordunstated
- Boxunstated
- Cloudflareunstated
- Customer.ioUSA
- Discordunstated
- Figmaunstated
- FivetranUSA
- MailgunUSA
- Oktaunstated
- SplunkUSA
- TwilioUSA
- Vercelunstated
Reviewer notes
Extracted by deterministic rules (rules/v1), no language model. Coverage is limited to recognisable clauses and a gazetteer of common subprocessors; absent values mean 'not matched', not 'not present'.
Documents read
- privacy policy https://www.notion.com/privacyHTTP 401 · 2026-11-03
- subprocessors https://www.notion.com/help/subprocessorsHTTP 404 · 2026-11-03
- dpa https://trust.notion.com/legal/dpaHTTP 200 · 2026-11-02
Document changes
- low 2026-11-02 · dpa +1 / −1 lines
show diff
+ Want a trust center like this one? Get one for your company with Wolfia− Does your team answer security questionnaires too? Wolfia answers them for you and runs trust centers - high 2026-10-30 · dpa +15 / −4 lines
show diff
+ AssemblyAI Inc. · USA+ Transcription services.+ Compute infrastructure for serving large language models and powering AI services.+ Browserbase, Inc. · USA, Spain+ Service provider for browser-based web access and automation for AI agents.+ Cinder Technologies Inc. · USA+ Service provider for abuse prevention.+ Modal Labs, Inc. · Global+ PlanetScale, Inc. · USA, Germany, Japan+ Hosting and management of large-scale databases.+ USA, Germany, Japan+ TypeSafe AI, Inc. · Global+ Service provider for hosting structured classification and other models.+ Customer.io · USA+ Mailgun Technologies, Inc. · USA− Amplitude · USA− Event logging for analytics.− Customer · USA− Mailgun · USA - low 2026-10-29 · dpa +1 / −1 lines
show diff
+ OverviewNotion Security & TrustSecurity advisoriesProduct Security FeaturesDocumentationSubprocessorsTerms and PrivacyControlsBug Bounty− OverviewNotion Security & TrustProduct Security FeaturesDocumentationControlsSecurity advisoriesSubprocessorsTerms and PrivacyBug Bounty - low 2026-10-27 · dpa +2 / −2 lines
show diff
+ OverviewNotion Security & TrustProduct Security FeaturesDocumentationControlsSecurity advisoriesSubprocessorsTerms and PrivacyBug Bounty+ Notion operates this public trust center. It publishes 15 independent compliance certifications, security documentation available on request, and a published list of its subprocessors.− OverviewNotion Security & TrustDocumentationProduct Security FeaturesSubprocessorsTerms and PrivacyBug BountyControls− Notion operates this public trust center. It publishes 14 independent compliance certifications, security documentation available on request, and a published list of its subprocessors. - low 2026-10-23 · dpa +1 / −1 lines
show diff
+ OverviewNotion Security & TrustDocumentationProduct Security FeaturesSubprocessorsTerms and PrivacyBug BountyControls− OverviewNotion Security & TrustDocumentationProduct Security FeaturesSubprocessorsTerms and PrivacyBug BountyControlsLatest Updates - low 2026-10-22 · dpa +2 / −1 lines
show diff
+ Network Architecture Diagram+ Workers (Beta) Security White Paper− Workers Security White Paper - high 2026-10-21 · dpa +120 / −14 lines
show diff
+ OverviewNotion Security & TrustDocumentationProduct Security FeaturesSubprocessorsTerms and PrivacyBug BountyControlsLatest Updates+ Data protection and privacy+ Restricted production data use+ Data retention and deletion+ Customer-requested deletion+ Restricted encryption key access+ Key rotation and compromise response+ Information is classified by sensitivity, with customer data and user content designated as the most sensitive category and subject to privileged, monitored, and explicitly approved access.+ Customer data is prohibited from being used or stored in non-production environments unless explicitly authorized through a documented process with appropriate safeguards.+ Customer data is retained and deleted according to contractual, legal, regulatory, and documented retention requirements, including deletion upon termination where applicable.+ Customers may request deletion of their confidential information, and deletion requests are documented and tracked through completion.+ Customer data transmitted over public networks is protected using secure transport encryption, helping prevent interception and unauthorized modification.+ Customer and other sensitive data stored in production systems is encrypted, reducing exposure if storage media or services are accessed improperly.+ Encryption keys are stored in approved key management systems and access is limited to authorized personnel.+ Keys are rotated when compromised and on a defined recurring basis, while suspected compromise triggers prompt revocation or rotation procedures.+ Multi-factor authentication is enabled for workforce identity accounts, critical systems, privileged access, and production access where supported.+ Role-based least-privilege access+ Access is assigned according to job role and limited to the minimum privileges needed to perform authorized responsibilities.+ Access approval workflow+ Requests for access and access changes require documented business justification and approval from designated managers or system owners before provisioning.+ Management reviews user roles and permissions at least quarterly, including privileged access, to identify and correct inappropriate access.+ SOC 2 Type II examination+ An independent service auditor examined the design and operating effectiveness of controls supporting security, availability, and confidentiality over the review period.+ ISO/IEC 27001 certification+ The information security management system is certified against ISO/IEC 27001, with annual surveillance audits supporting continued conformity.+ HIPAA and HITECH attestation+ An independent practitioner reported that the information security and breach notification program conformed to applicable HIPAA Security Rule and HITECH criteria.+ C5 cloud security attestation+ An independent practitioner examined the design and operating effectiveness of controls against the BSI C5 cloud computing criteria.+ Secure software development lifecycle− OverviewNotion Security & TrustDocumentationSubprocessorsTerms and PrivacyBug BountyControlsLatest Updates− Access control and authentication− All data transmitted between clients and Notion servers is encrypted using TLS 1.2 or greater, protecting against interception or tampering during transit.− All customer data stored on Notion's internal networks, cloud storage, database tables, and backups is encrypted at rest using AES-256 encryption. This applies across all Notion products and regions, including Notion core, Notion AI, Calendar, Mail, and all hosting regions.− Two-step verification is available across all plan types with support for SMS-based codes, TOTP via authenticator apps, passkeys with biometric authentication, and backup codes.− Access rights are reviewed at least quarterly by designated managers or system owners to ensure appropriateness. Inappropriate access is revoked, and discrepancies are escalated to the Information Security team.− Notion maintains a formal Data Classification Policy with four levels: Restricted Data, Highly Confidential, Confidential, and Public Data. Customer data and PII are classified as Restricted Data.− Production servers do not face the internet directly and are positioned behind a DMZ. Internet-facing services operate with a deny-by-default posture and least-privilege network connectivity.− All third-party vendors undergo security assessments including questionnaire distribution, attestation report review, penetration test evaluation, and artifact analysis based on criticality and risk factors.− All employees complete mandatory annual security and privacy awareness training, including incident response training. Resources expected to respond to security incidents receive specialized training.− A mobile device management (MDM) tool continuously enforces security configurations and EDR deployment across all company-managed devices, ensuring consistent security posture.− CERTIFICATIONS− PRIVACY & LEGAL− What is a Subprocessor? In order to provide our Services, Notion engages the Subprocessors listed in the tables below. A Subprocessor is a third-party engaged by Notion Labs, Inc., and its applicable Affiliates, to process Customer Personal Data. Capitalized terms used herein are defined in Notion’s Data Processing Addendum. How do I subscribe to new Subprocessor notifications? Customers may sign up to receive notification of new Subprocessors by e-mailing team@makenotion.com with the subject “Subscribe to New Subprocessors.” - medium 2026-10-13 · dpa +0 / −6 lines
show diff
− Connect via MCPSubscribe to updatesGet accessEN− See all documents− Request access− See all 26 subprocessors− See all 16 controls− AI governance and securityEncryption and key managementAccess control and authenticationCompliance and certificationsApplication securityData protection and privacyIncident responseBusiness continuity and disaster recoveryNetwork and infrastructure securityVulnerability managementMonitoring and loggingThird-party risk managementEmployee securityPhysical and environmental securityEndpoint securityChange management - high 2026-09-25 · dpa +4 / −1 lines
show diff
+ OverviewNotion Security & TrustDocumentationSubprocessorsTerms and PrivacyBug BountyControlsLatest Updates+ Contact supportReport a vulnerability+ What is a Subprocessor? In order to provide our Services, Notion engages the Subprocessors listed in the tables below. A Subprocessor is a third-party engaged by Notion Labs, Inc., and its applicable Affiliates, to process Customer Personal Data. Capitalized terms used herein are defined in Notion’s Data Processing Addendum. How do I subscribe to new Subprocessor notifications? Customers may sign up to receive notification of new Subprocessors by e-mailing team@makenotion.com with the subject “Subscribe to New Subprocessors.”+ LATEST UPDATES− OverviewNotion Security & TrustDocumentationSubprocessorsTerms and PrivacyBug BountyControlsUpdates - low 2026-09-23 · dpa +1 / −1 lines
show diff
+ OverviewNotion Security & TrustDocumentationSubprocessorsTerms and PrivacyBug BountyControlsUpdates− and PrivacyBug BountyNotion Security & Trust
Fact changes
- high 2026-10-30 · 0 field change(s), +2/−1 subprocessors, +1 model providers
Corrections
No correction requests. Anyone may dispute a fact with a source; requests and resolutions are public and ledger-entered.
Facts are as stated in Notion's public documents on the date read. This is a record, not legal advice. Work for Notion? Claim this profile · Something wrong? Request a correction.