A formal AI Tools Usage and Governance Policy establishes guidelines for responsible and secure AI use, reviewed annually. Only approved AI tools vetted through the procurement lifecycle may be used, and usage must comply with data privacy laws (GDPR, HIPAA) while avoiding discrimination or bias.

A dedicated Securing AI Program strengthens AI products against security issues such as prompt injection and data exfiltration, with proactive security measures, regular assessments, and SLAs on security findings tracked through dashboards and leadership readouts.

Notion employs multiple layers of prompt injection defense: tool metadata and call results are scanned using an LLM-based detection system, MCP tool results are XML-escaped to prevent injection via fake markup, and tool call inputs are validated against declared JSON schemas.

Content moderation endpoints and safety checks are applied on inputs before reaching models, with policy enforcement on outputs consistent with Notion's Content and Use Policy. Guardrail effectiveness is tracked through metrics including denied prompt rates, false positive rates, and marketplace template scanning rejection rates.

User data is never used to train or influence Notion AI models. Notion and its AI subprocessors have contractual agreements prohibiting the use of customer data for model training. Only synthetic data is used for training, stored separately with the same strict access controls as other data.

For Enterprise workspaces, LLM providers use zero data retention after processing. Non-Enterprise workspaces have a maximum 30-day retention before deletion. AI embeddings are deleted within 60 days of page or workspace deletion.

AI features honor existing user session permissions, ensuring LLMs cannot access information users do not already have access to. Sensitive content is not cached, and human oversight is maintained at every stage from pre-deployment testing to post-output monitoring.

Workspace owners on the Enterprise Plan can promptly disable Notion AI features in settings, immediately preventing data from being sent to AI subprocessors. AI features can be re-enabled in a timely manner after incident resolution.

Outbound requests to external MCP servers are routed through a forward proxy that blocks connections to private/internal IP addresses. HTTPS is required, OAuth tokens are stored securely in AWS Secrets Manager, and newly discovered tools are disabled by default until an admin explicitly enables them.

AI activity logs capture usage by user and type of AI event with timestamps and actions performed. Enterprise administrators have direct access to verbose audit logs, and periodic audits ensure compliance with the AI governance policy.

All third-party AI vendors undergo security assessments, must sign data privacy compliance agreements, and are reviewed annually from both security and legal perspectives. Notion uses LLMs from vetted providers including Anthropic and OpenAI.

Customers can integrate third-party data loss prevention (DLP) solutions to trigger alerts for sensitive content in AI prompts and generated content, providing an additional layer of control over what data is processed by AI features.

AI tools are required to provide explanations for their decisions when possible. Users are made aware of limitations regarding accuracy and reliability, and employees must document AI tool usage including data used, decisions made, and potential risks.

Annual risk assessments identify, measure, and address risks related to AI, including documented policies guiding risk identification, analysis, and mitigation. Control activities are in place to address identified AI risks efficiently.

All data transmitted between clients and Notion servers is encrypted using TLS 1.2 or greater, protecting against interception or tampering during transit.

Enterprise customers can manage their own encryption keys through AWS Key Management Service (KMS), providing additional control over data confidentiality with the ability to revoke Notion's access at any time.

Notion employs a three-layer envelope encryption architecture: Customer Managed Key (CMK), Workspace Encryption Key (WEK), and Data Encryption Keys (DEK), exceeding traditional two-layer approaches for defense in depth.

Customer passwords are hashed using bcrypt, a one-way cryptographic hashing algorithm that inherently incorporates a unique salt for each password hash, ensuring identical passwords produce different hash values.

Comprehensive logs and audit trails are maintained for encryption operations, including key generation, access, rotation, and administrative actions across critical production systems.

All customer data stored on Notion's internal networks, cloud storage, database tables, and backups is encrypted at rest using AES-256 encryption. This applies across all Notion products and regions, including Notion core, Notion AI, Calendar, Mail, and all hosting regions.

Enterprise customers can configure SAML 2.0-based SSO with major identity providers including Okta, Microsoft Entra ID, Google Workspace, and OneLogin. Workspace administrators can enforce SSO-only authentication.

Two-step verification is available across all plan types with support for SMS-based codes, TOTP via authenticator apps, passkeys with biometric authentication, and backup codes.

Notion supports multiple user roles with granular permission levels (Full Access, Can Edit, Can Comment, Can View) at the page and teamspace level, enabling precise control over who can access and modify content.

Access rights are limited to the minimum necessary for individuals to perform their job functions. All access requests require documented business justification and approval by system or group owners.

SCIM-based automated user and group provisioning is supported through identity providers including Okta and Microsoft Entra ID, enabling streamlined onboarding and offboarding.

Server-side session management with configurable session duration policies, explicit revocation on logout, and remote session termination capabilities for organization administrators.

Workspace administrators can restrict access to approved networks through IP and domain allowlisting, adding an additional layer of access control beyond authentication.

Access rights are reviewed at least quarterly by designated managers or system owners to ensure appropriateness. Inappropriate access is revoked, and discrepancies are escalated to the Information Security team.

User access is terminated within 24 hours of an employee's last day of work. Access may also be suspended immediately in response to security incidents or suspected unauthorized activity.

Always-on access decisions validate each user's network in real-time by dynamically assessing identity, device security, behavior patterns, and location, enabling immediate restriction if anomalous activity is detected.

Notion undergoes annual SOC 2 Type II audits, providing independent verification that security controls are designed and operating effectively over a sustained period.

Independent point-in-time assessment validating the design of Notion's security controls against the SOC 2 Trust Services Criteria.

Publicly available general-use report summarizing the results of Notion's SOC 2 Type II audit, providing transparency into security control effectiveness.

Notion maintains ISO 27001 certification, demonstrating a systematic approach to managing sensitive information through an established Information Security Management System.

Notion's security controls and breach notification procedures are assessed against HIPAA Security Rule requirements, supporting healthcare customers with regulatory compliance needs.

Notion holds BSI Cloud Computing Compliance Controls Catalogue (C5) attestation, meeting the security requirements established by the German Federal Office for Information Security.

Notion completes the Cloud Security Alliance Consensus Assessments Initiative Questionnaire, providing standardized transparency into cloud security controls and practices.

Notion complies with the EU AI Act requirements. Under the risk-based framework, Notion AI is classified as a limited-risk AI system, and Notion is categorized as a deployer of AI systems.

Notion follows a defined SDLC with security integrated at every phase, including threat modeling and secure design reviews during design, code audits and security scans after development, and vulnerability management post-launch.

SAST runs on every pull request to automatically detect vulnerabilities when engineers make changes to code, providing continuous security validation as part of the development workflow.

Automated SCA scanning analyzes third-party components and dependencies for known security vulnerabilities, reducing supply chain risk.

All source code changes are managed through pull requests requiring independent peer review and approval before deployment to production, with reviews based on the OWASP framework.

Notion conducts annual third-party grey-box penetration testing across desktop, mobile, and browser applications, with all critical and high findings remediated and validated.

Notion operates a public bug bounty program through HackerOne, providing continuous external security testing from the global security research community.

Continuous unit, integration, and functional test suites include security invariants that must pass on each pull request and release candidate before deployment.

Developers complete annual secure coding training covering OWASP secure development principles and the OWASP Top 10 vulnerabilities, ensuring security awareness is embedded in the engineering culture.

Notion maintains a formal Data Classification Policy with four levels: Restricted Data, Highly Confidential, Confidential, and Public Data. Customer data and PII are classified as Restricted Data.

Notion provides a Data Processing Addendum (DPA) that governs the processing of personal data, establishing clear roles, responsibilities, and safeguards aligned with GDPR and other privacy regulations.

Formal data deletion policies and procedures ensure customer data is permanently removed upon request or account termination, with documented retention schedules applied by data classification level.

Documented data handling and retention policies govern how customer data is stored, processed, and retained, with schedules applied based on data classification and applicable legal requirements.

Notion's Privacy Policy is publicly accessible, clearly disclosing data collection practices, usage, and customer rights. Usage Data is distinguished from Customer Data and de-identified before external disclosure.

Customers retain full ownership of all content in their Notion workspace, including AI interaction inputs and outputs. Notion does not use customer data to train AI models and does not permit third parties to do so.

Notion maintains a dedicated incident response team with 24/7/365 on-call coverage to monitor, triage, contain, investigate, and respond to security events through centralized alerting and escalation procedures.

A formally documented and management-approved Security Incident Response Plan covers detection, coordination, resolution, closure, and post-incident review, validated through SOC 2 and ISO 27001 audits.

Upon becoming aware of a security incident, Notion provides written notice without undue delay in accordance with applicable data protection laws, with standard breach notification within 72 hours.

After each incident is resolved, a post-mortem is conducted including root cause analysis and lessons learned documentation. Findings are used to update the incident response plan and prevent recurrence.

The Incident Response Plan is tested at least annually through tabletop exercises or simulations to validate effectiveness, confirm team member understanding of roles, and identify gaps.

The incident response workflow supports cross-functional reporting and coordination with defined roles and severity-based engagement, including a clear matrix of authorized public communicators during adverse events.

A formal Business Continuity Plan ensures Notion can maintain or quickly resume critical business operations during disruptive events, reviewed and renewed at least annually by designated owners.

A documented Disaster Recovery Plan outlines strategies and procedures for continuity of critical systems and data, with multi-tiered, cross-region backup capabilities for production databases.

Production databases are backed up automatically with encryption using the same standards as live data. Backups are stored in geographically separate regions within the same compliance zone.

Business continuity and disaster recovery plans are tested annually with documented results covering Notion's core products and regions, validating plan effectiveness and team readiness.

Notion commits to 99.9% service availability, with current and historical uptime data publicly available at status.notion.so for full transparency.

Intrusion Detection and Prevention Systems (IDPS) continuously monitor production network traffic and system activity for known attack signatures and anomalous behavior, with alerts routed to security teams.

Production servers do not face the internet directly and are positioned behind a DMZ. Internet-facing services operate with a deny-by-default posture and least-privilege network connectivity.

A Security Information and Event Management platform collects, aggregates, and analyzes security-relevant logs across corporate and production environments with detection rules maintained as code.

No TCP or UDP services other than HTTPS are exposed to the public internet or employee-accessible VPN, minimizing the attack surface.

All cloud network configuration changes including firewalls, routing, and security groups require ticket documentation, owner assignment, approval, and audit trail before production deployment.

A formal Vulnerability Management Policy establishes a framework for identifying, assessing, prioritizing, and remediating vulnerabilities across all applications and infrastructure using standardized risk-ranking methodology.

Regular external vulnerability scans are performed by an Approved Scanning Vendor (ASV), complemented by internal dependency and vulnerability monitoring across the codebase.

Notion subscribes to threat intelligence feeds, RSS feeds, and vendor security advisories for up-to-date vulnerability information, enabling proactive identification and response.

Security patches are tested in non-production environments before deployment, with post-deployment validation to confirm effectiveness. Critical vulnerabilities may trigger emergency incident response procedures.

A published Responsible Disclosure Policy provides clear guidelines for external researchers to report security vulnerabilities, with a structured process for assessment and remediation.

Audit logs capture key events including page activity, data source changes, admin and security actions, user identification, IP addresses, event types, timestamps, and success or failure indicators.

System and data security is monitored 24/7/365 including hosted environments, with alerts for malware infections, suspicious activity, and anomalous behavior automatically routed to security channels.

All changes to privileged user access rights are tracked across all systems, including those with scoped data. Privileged access activities are logged and periodically reviewed for unauthorized behavior.

Application logs are archived with retention schedules applied in accordance with Data Handling and Retention, Data Classification, and Data Deletion policies for compliance and forensic readiness.

Security monitoring includes behavioral analysis capabilities to detect botnet traffic patterns, malware infections, and suspicious activity through IDS and SIEM correlation rules.

All third-party vendors undergo security assessments including questionnaire distribution, attestation report review, penetration test evaluation, and artifact analysis based on criticality and risk factors.

An up-to-date list of subprocessors is publicly available, providing customers full transparency into the third-party services involved in processing their data.

Subprocessors are monitored and reviewed at least annually to ensure continued compliance with Notion's security requirements, including review of attestation reports and security artifacts.

Notion maintains supplier-facing standards requiring vendors and subcontractors to comply with applicable laws, ethical labor practices, and responsible purchasing procedures.

All employees complete mandatory annual security and privacy awareness training, including incident response training. Resources expected to respond to security incidents receive specialized training.

All employees sign an Employee Proprietary Information and Inventions Assignment Agreement (PIIA) as a condition of employment, reviewed annually to ensure alignment with evolving requirements.

A comprehensive Code of Ethics and Business Conduct covers standards of conduct, ethics, conflicts of interest, confidentiality, anti-bribery, and discrimination prevention. All employees must acknowledge it annually.

Personnel are regularly monitored for privacy compliance through annual training, policy acknowledgement upon hire, and ongoing compliance monitoring by the Privacy Operations team.

All visitors to Notion facilities are required to have an escort at all times. On-site visitors and vendors must be accompanied by a Notion employee throughout their visit.

Physical access to facilities and computing areas is restricted through badge-controlled entry, visitor management systems, and surveillance, with access limited to authorized personnel and logged for accountability.

Notion is hosted on AWS with data center physical security, environmental safeguards, and geographic redundancy managed by AWS. Notion does not operate its own data centers.

An EDR solution is deployed on all company-managed endpoint devices with continuous updates pushed automatically. Employees cannot modify or disable the anti-malware configuration.

A mobile device management (MDM) tool continuously enforces security configurations and EDR deployment across all company-managed devices, ensuring consistent security posture.

Technical controls are maintained to prevent access to unauthorized AI tools on corporate devices, with any incidents requiring immediate reporting per the incident response policy.

All changes to Notion's application are tied to tracked records in a version control system, requiring independent peer review and approval before deployment to production.

Changes undergo testing in non-production environments before deployment, with continuous integration pipelines validating quality and security before release candidates are promoted.

Notion conducts risk-based red teaming exercises to evaluate the effectiveness of security controls and identify weaknesses before they can be exploited.

Application development is separated from production and test environments. Active production environments are never re-used for testing, and production data is not used in development or testing without customer coordination.

A rollback strategy is in place before changes are implemented, with previous software versions retained as a contingency measure and configuration control systems tracking all implemented changes.