A formal AI Tools Usage and Governance Policy establishes guidelines for responsible and secure AI use, reviewed annually. Only approved AI tools vetted through the procurement lifecycle may be used, and usage must comply with data privacy laws (GDPR, HIPAA) while avoiding discrimination or bias.

A dedicated Securing AI Program strengthens AI products against security issues such as prompt injection and data exfiltration, with proactive security measures, regular assessments, and SLAs on security findings tracked through dashboards and leadership readouts.

Notion employs multiple layers of prompt injection defense: tool metadata and call results are scanned using an LLM-based detection system, MCP tool results are XML-escaped to prevent injection via fake markup, and tool call inputs are validated against declared JSON schemas.

Content moderation endpoints and safety checks are applied on inputs before reaching models, with policy enforcement on outputs consistent with Notion's Content and Use Policy. Guardrail effectiveness is tracked through metrics including denied prompt rates, false positive rates, and marketplace template scanning rejection rates.

User data is never used to train or influence Notion AI models. Notion and its AI subprocessors have contractual agreements prohibiting the use of customer data for model training. Only synthetic data is used for training, stored separately with the same strict access controls as other data.

For Enterprise workspaces, LLM providers use zero data retention after processing. Non-Enterprise workspaces have a maximum 30-day retention before deletion. AI embeddings are deleted within 60 days of page or workspace deletion.

AI features honor existing user session permissions, ensuring LLMs cannot access information users do not already have access to. Sensitive content is not cached, and human oversight is maintained at every stage from pre-deployment testing to post-output monitoring.

Workspace owners on the Enterprise Plan can promptly disable Notion AI features in settings, immediately preventing data from being sent to AI subprocessors. AI features can be re-enabled in a timely manner after incident resolution.

Outbound requests to external MCP servers are routed through a forward proxy that blocks connections to private/internal IP addresses. HTTPS is required, OAuth tokens are stored securely in AWS Secrets Manager, and newly discovered tools are disabled by default until an admin explicitly enables them.

AI activity logs capture usage by user and type of AI event with timestamps and actions performed. Enterprise administrators have direct access to verbose audit logs, and periodic audits ensure compliance with the AI governance policy.

All third-party AI vendors undergo security assessments, must sign data privacy compliance agreements, and are reviewed annually from both security and legal perspectives. Notion uses LLMs from vetted providers including Anthropic and OpenAI.

Customers can integrate third-party data loss prevention (DLP) solutions to trigger alerts for sensitive content in AI prompts and generated content, providing an additional layer of control over what data is processed by AI features.

AI tools are required to provide explanations for their decisions when possible. Users are made aware of limitations regarding accuracy and reliability, and employees must document AI tool usage including data used, decisions made, and potential risks.

Annual risk assessments identify, measure, and address risks related to AI, including documented policies guiding risk identification, analysis, and mitigation. Control activities are in place to address identified AI risks efficiently.

Information is classified by sensitivity, with customer data and user content designated as the most sensitive category and subject to privileged, monitored, and explicitly approved access.

Customer data is prohibited from being used or stored in non-production environments unless explicitly authorized through a documented process with appropriate safeguards.

Notion provides a Data Processing Addendum (DPA) that governs the processing of personal data, establishing clear roles, responsibilities, and safeguards aligned with GDPR and other privacy regulations.

Customer data is retained and deleted according to contractual, legal, regulatory, and documented retention requirements, including deletion upon termination where applicable.

Formal data deletion policies and procedures ensure customer data is permanently removed upon request or account termination, with documented retention schedules applied by data classification level.

Customers may request deletion of their confidential information, and deletion requests are documented and tracked through completion.

Documented data handling and retention policies govern how customer data is stored, processed, and retained, with schedules applied based on data classification and applicable legal requirements.

Notion's Privacy Policy is publicly accessible, clearly disclosing data collection practices, usage, and customer rights. Usage Data is distinguished from Customer Data and de-identified before external disclosure.

Customers retain full ownership of all content in their Notion workspace, including AI interaction inputs and outputs. Notion does not use customer data to train AI models and does not permit third parties to do so.

Customer data transmitted over public networks is protected using secure transport encryption, helping prevent interception and unauthorized modification.

Customer and other sensitive data stored in production systems is encrypted, reducing exposure if storage media or services are accessed improperly.

Encryption keys are stored in approved key management systems and access is limited to authorized personnel.

Enterprise customers can manage their own encryption keys through AWS Key Management Service (KMS), providing additional control over data confidentiality with the ability to revoke Notion's access at any time.

Notion employs a three-layer envelope encryption architecture: Customer Managed Key (CMK), Workspace Encryption Key (WEK), and Data Encryption Keys (DEK), exceeding traditional two-layer approaches for defense in depth.

Keys are rotated when compromised and on a defined recurring basis, while suspected compromise triggers prompt revocation or rotation procedures.

Customer passwords are hashed using bcrypt, a one-way cryptographic hashing algorithm that inherently incorporates a unique salt for each password hash, ensuring identical passwords produce different hash values.

Comprehensive logs and audit trails are maintained for encryption operations, including key generation, access, rotation, and administrative actions across critical production systems.

Multi-factor authentication is enabled for workforce identity accounts, critical systems, privileged access, and production access where supported.

Enterprise customers can configure SAML 2.0-based SSO with major identity providers including Okta, Microsoft Entra ID, Google Workspace, and OneLogin. Workspace administrators can enforce SSO-only authentication.

Access is assigned according to job role and limited to the minimum privileges needed to perform authorized responsibilities.

Notion supports multiple user roles with granular permission levels (Full Access, Can Edit, Can Comment, Can View) at the page and teamspace level, enabling precise control over who can access and modify content.

Requests for access and access changes require documented business justification and approval from designated managers or system owners before provisioning.

Management reviews user roles and permissions at least quarterly, including privileged access, to identify and correct inappropriate access.

Access rights are limited to the minimum necessary for individuals to perform their job functions. All access requests require documented business justification and approval by system or group owners.

SCIM-based automated user and group provisioning is supported through identity providers including Okta and Microsoft Entra ID, enabling streamlined onboarding and offboarding.

Server-side session management with configurable session duration policies, explicit revocation on logout, and remote session termination capabilities for organization administrators.

Workspace administrators can restrict access to approved networks through IP and domain allowlisting, adding an additional layer of access control beyond authentication.

User access is terminated within 24 hours of an employee's last day of work. Access may also be suspended immediately in response to security incidents or suspected unauthorized activity.

Always-on access decisions validate each user's network in real-time by dynamically assessing identity, device security, behavior patterns, and location, enabling immediate restriction if anomalous activity is detected.

Notion undergoes annual SOC 2 Type II audits, providing independent verification that security controls are designed and operating effectively over a sustained period.

An independent service auditor examined the design and operating effectiveness of controls supporting security, availability, and confidentiality over the review period.

Independent point-in-time assessment validating the design of Notion's security controls against the SOC 2 Trust Services Criteria.

The information security management system is certified against ISO/IEC 27001, with annual surveillance audits supporting continued conformity.

Publicly available general-use report summarizing the results of Notion's SOC 2 Type II audit, providing transparency into security control effectiveness.

An independent practitioner reported that the information security and breach notification program conformed to applicable HIPAA Security Rule and HITECH criteria.

An independent practitioner examined the design and operating effectiveness of controls against the BSI C5 cloud computing criteria.

Notion maintains ISO 27001 certification, demonstrating a systematic approach to managing sensitive information through an established Information Security Management System.

Notion's security controls and breach notification procedures are assessed against HIPAA Security Rule requirements, supporting healthcare customers with regulatory compliance needs.

Notion holds BSI Cloud Computing Compliance Controls Catalogue (C5) attestation, meeting the security requirements established by the German Federal Office for Information Security.

Notion completes the Cloud Security Alliance Consensus Assessments Initiative Questionnaire, providing standardized transparency into cloud security controls and practices.

Notion complies with the EU AI Act requirements. Under the risk-based framework, Notion AI is classified as a limited-risk AI system, and Notion is categorized as a deployer of AI systems.

Security requirements are integrated across software design, implementation, testing, deployment, and operation.

Notion follows a defined SDLC with security integrated at every phase, including threat modeling and secure design reviews during design, code audits and security scans after development, and vulnerability management post-launch.

Application and infrastructure changes receive independent peer review before production deployment, supporting separation of duties and reducing unauthorized or defective changes.

SAST runs on every pull request to automatically detect vulnerabilities when engineers make changes to code, providing continuous security validation as part of the development workflow.

Changes are tested before production deployment, with security-relevant changes receiving validation appropriate to their risk.

Automated SCA scanning analyzes third-party components and dependencies for known security vulnerabilities, reducing supply chain risk.

Development, testing, and production environments are logically separated to reduce the risk of unauthorized access to customer data and uncontrolled production changes.

All source code changes are managed through pull requests requiring independent peer review and approval before deployment to production, with reviews based on the OWASP framework.

Notion conducts annual third-party grey-box penetration testing across desktop, mobile, and browser applications, with all critical and high findings remediated and validated.

Notion operates a public bug bounty program through HackerOne, providing continuous external security testing from the global security research community.

Continuous unit, integration, and functional test suites include security invariants that must pass on each pull request and release candidate before deployment.

Developers complete annual secure coding training covering OWASP secure development principles and the OWASP Top 10 vulnerabilities, ensuring security awareness is embedded in the engineering culture.

A formal plan defines incident handling procedures, responsibilities, escalation, and communication expectations for personnel and customers.

Notion maintains a dedicated incident response team with 24/7/365 on-call coverage to monitor, triage, contain, investigate, and respond to security events through centralized alerting and escalation procedures.

A formally documented and management-approved Security Incident Response Plan covers detection, coordination, resolution, closure, and post-incident review, validated through SOC 2 and ISO 27001 audits.

Security events are continuously monitored, reviewed, documented, and escalated for resolution by authorized personnel.

Impacted customers are notified of confirmed security incidents in accordance with applicable laws and contractual commitments.

Upon becoming aware of a security incident, Notion provides written notice without undue delay in accordance with applicable data protection laws, with standard breach notification within 72 hours.

After each incident is resolved, a post-mortem is conducted including root cause analysis and lessons learned documentation. Findings are used to update the incident response plan and prevent recurrence.

Incident evaluations include lessons learned, root-cause analysis where appropriate, and corrective actions intended to reduce recurrence.

The Incident Response Plan is tested at least annually through tabletop exercises or simulations to validate effectiveness, confirm team member understanding of roles, and identify gaps.

The incident response workflow supports cross-functional reporting and coordination with defined roles and severity-based engagement, including a clear matrix of authorized public communicators during adverse events.

A formal Business Continuity Plan ensures Notion can maintain or quickly resume critical business operations during disruptive events, reviewed and renewed at least annually by designated owners.

Business continuity and disaster recovery plans define recovery priorities, responsibilities, communication methods, and restoration procedures for major disruptions.

Automated backups are performed for data stores containing customer data, supporting recovery from deletion, corruption, incidents, or disasters.

A documented Disaster Recovery Plan outlines strategies and procedures for continuity of critical systems and data, with multi-tiered, cross-region backup capabilities for production databases.

Production databases are backed up automatically with encryption using the same standards as live data. Backups are stored in geographically separate regions within the same compliance zone.

Databases are replicated to secondary availability zones and production environments use a multi-location strategy to support continued operations after a facility or system failure.

Business continuity and disaster recovery plans are tested annually with documented results covering Notion's core products and regions, validating plan effectiveness and team readiness.

Disaster recovery and backup restoration tests are performed at least annually, with results and lessons learned documented for improvement.

Notion commits to 99.9% service availability, with current and historical uptime data publicly available at status.notion.so for full transparency.

Intrusion Detection and Prevention Systems (IDPS) continuously monitor production network traffic and system activity for known attack signatures and anomalous behavior, with alerts routed to security teams.

Firewalls, security groups, and web application protections restrict unauthorized traffic to production systems and support controlled connectivity.

Production systems and customer-facing applications are logically separated from corporate information systems and other network environments.

A Security Information and Event Management platform collects, aggregates, and analyzes security-relevant logs across corporate and production environments with detection rules maintained as code.

Network activity is monitored for potentially malicious traffic, with alerts reviewed and resolved by authorized personnel.

Traffic distribution controls support production reliability and availability by balancing requests across available service capacity.

No TCP or UDP services other than HTTPS are exposed to the public internet or employee-accessible VPN, minimizing the attack surface.

All cloud network configuration changes including firewalls, routing, and security groups require ticket documentation, owner assignment, approval, and audit trail before production deployment.

Internal production infrastructure is scanned continuously and external application scans are performed at least weekly to identify potential weaknesses.

A formal Vulnerability Management Policy establishes a framework for identifying, assessing, prioritizing, and remediating vulnerabilities across all applications and infrastructure using standardized risk-ranking methodology.

Regular external vulnerability scans are performed by an Approved Scanning Vendor (ASV), complemented by internal dependency and vulnerability monitoring across the codebase.

Qualified independent testing is performed at least annually to identify vulnerabilities that could affect the production environment.

Confirmed vulnerabilities are validated, risk-ranked, assigned to responsible owners, and remediated according to severity-based timelines.

Notion subscribes to threat intelligence feeds, RSS feeds, and vendor security advisories for up-to-date vulnerability information, enabling proactive identification and response.

Security patches are tested in non-production environments before deployment, with post-deployment validation to confirm effectiveness. Critical vulnerabilities may trigger emergency incident response procedures.

Independent researchers and customers can submit potential bugs and vulnerabilities to the security team, expanding external security coverage.

A published Responsible Disclosure Policy provides clear guidelines for external researchers to report security vulnerabilities, with a structured process for assessment and remediation.

Audit logs capture key events including page activity, data source changes, admin and security actions, user identification, IP addresses, event types, timestamps, and success or failure indicators.

Security events and production activity are collected in centralized monitoring systems that alert authorized personnel to potential incidents.

System and data security is monitored 24/7/365 including hosted environments, with alerts for malware infections, suspicious activity, and anomalous behavior automatically routed to security channels.

Critical systems record account management, login, object access, policy change, and privileged-use events to support accountability and investigation.

Alerts are reviewed and resolved in a timely manner, with relevant events tracked through documented operational or security processes.

All changes to privileged user access rights are tracked across all systems, including those with scoped data. Privileged access activities are logged and periodically reviewed for unauthorized behavior.

Access to audit logs is restricted, and the number of personnel able to modify or delete them is limited to help preserve evidentiary integrity.

Application logs are archived with retention schedules applied in accordance with Data Handling and Retention, Data Classification, and Data Deletion policies for compliance and forensic readiness.

Security monitoring includes behavioral analysis capabilities to detect botnet traffic patterns, malware infections, and suspicious activity through IDS and SIEM correlation rules.

Vendors undergo risk assessments before contributing to service delivery, with reviews repeated at least annually or when material changes occur.

Contracts with vendors handling confidential data or providing critical services include security, confidentiality, incident reporting, and data return or deletion commitments.

An up-to-date list of subprocessors is publicly available, providing customers full transparency into the third-party services involved in processing their data.

Subprocessors are monitored and reviewed at least annually to ensure continued compliance with Notion's security requirements, including review of attestation reports and security artifacts.

Independent assurance reports and other security evidence for critical vendors are reviewed at least annually, with findings and action items documented.

Exit planning addresses access revocation, data return or export, secure deletion, transition responsibilities, and timing for higher-dependency vendors.

Notion maintains supplier-facing standards requiring vendors and subcontractors to comply with applicable laws, ethical labor practices, and responsible purchasing procedures.

Background checks are initiated for new personnel before their start date in accordance with applicable laws.

All employees sign an Employee Proprietary Information and Inventions Assignment Agreement (PIIA) as a condition of employment, reviewed annually to ensure alignment with evolving requirements.

Personnel complete security and privacy awareness training during onboarding and at least annually, with completion records retained.

A comprehensive Code of Ethics and Business Conduct covers standards of conduct, ethics, conflicts of interest, confidentiality, anti-bribery, and discrimination prevention. All employees must acknowledge it annually.

Personnel with specialized responsibilities, including developers and incident responders, receive training tailored to their security duties.

Personnel acknowledge confidentiality and proprietary information obligations upon hire, limiting unauthorized use or disclosure of company and customer information.

Personnel are regularly monitored for privacy compliance through annual training, policy acknowledgement upon hire, and ongoing compliance monitoring by the Privacy Operations team.

All visitors to Notion facilities are required to have an escort at all times. On-site visitors and vendors must be accompanied by a Notion employee throughout their visit.

Physical access to corporate facilities is restricted through access credentials that track entry and exit activity.

Access permissions for restricted areas are reviewed periodically, including monthly review where designated secondary controls are not present.

Physical access to facilities and computing areas is restricted through badge-controlled entry, visitor management systems, and surveillance, with access limited to authorized personnel and logged for accountability.

Visitors are logged, issued temporary identification, and escorted by Notion personnel while on company premises.

Notion is hosted on AWS with data center physical security, environmental safeguards, and geographic redundancy managed by AWS. Notion does not operate its own data centers.

Physical access, visitor, maintenance, and repair records are retained to support investigations, audits, and accountability.

Company-managed endpoint drives are encrypted to reduce the risk of data exposure if a device is lost or stolen.

An EDR solution is deployed on all company-managed endpoint devices with continuous updates pushed automatically. Employees cannot modify or disable the anti-malware configuration.

Anti-malware protection is installed and continuously enforced on company-managed endpoint devices and applicable infrastructure systems.

Technical controls are maintained to prevent access to unauthorized AI tools on corporate devices, with any incidents requiring immediate reporting per the incident response policy.

Mobile devices supporting the service are centrally managed, enabling consistent security configuration and administrative oversight.

Workstations are configured to lock and require authentication after inactivity, helping limit unauthorized access to unattended devices.

Application and infrastructure changes are tracked, reviewed, tested, and approved before production deployment.

All changes to Notion's application are tied to tracked records in a version control system, requiring independent peer review and approval before deployment to production.

Changes undergo testing in non-production environments before deployment, with continuous integration pipelines validating quality and security before release candidates are promoted.

Production changes are deployed through controlled release mechanisms, with migration access restricted to authorized personnel.

Notion conducts risk-based red teaming exercises to evaluate the effectiveness of security controls and identify weaknesses before they can be exploited.

Changes are maintained in version control and linked to records that identify the change and supporting implementation evidence.

Application development is separated from production and test environments. Active production environments are never re-used for testing, and production data is not used in development or testing without customer coordination.

Documented rollback procedures support recovery when a production change introduces an error, vulnerability, or service impact.

A rollback strategy is in place before changes are implemented, with previous software versions retained as a contingency measure and configuration control systems tracking all implemented changes.