Snapshot 257272
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Notion Trust Center Notion's security and compliance program is built on transparency, trust, and enterprise-grade protection. Explore our certifications, security controls, policies, and subprocessors to understand how Notion safeguards your data. * Annual third-party audits: SOC 2 Type II, ISO 27001/17/18/701, HIPAA, BSI C5. * Annual third-party penetration testing. * Bug bounty program through [HackerOne](https://hackerone.com/notion). * 99.9% uptime SLA ([notion-status.com](https://www.notion-status.com/)). * [Notion Security & Trust](https://notion.notion.site/Notion-Security-Trust-3cfefdeead0580779027f2d8e40de427?pvs=143 "Notion Security & Trust") * [Privacy policy](https://www.notion.so/notion/Privacy-Policy-3468d120cf614d4c9014c09f6adc9091). * [Data processing addendum](https://www.notion.so/notion/Data-Processing-Addendum-361b540101274b1fa7e16b90402b0d99). * [Subprocessor list](https://notion.notion.site/Notion-s-List-of-Subprocessors-268fa5bcfa0f46b6bc29436b21676734). Powered by Wolfia. Review compliance certifications, security policies, subprocessors, and request access to detailed documentation. Skip to main content Notion Trust Center Notion's security and compliance program is built on transparency, trust, and enterprise-grade protection. Explore our certifications, security controls, policies, and subprocessors to understand how Notion safeguards your data. Annual third-party audits: SOC 2 Type II, ISO 27001/17/18/701, HIPAA, BSI C5. Annual third-party penetration testing. Bug bounty program through HackerOne. 99.9% uptime SLA (notion-status.com). Notion Security & Trust Privacy policy. Data processing addendum. Subprocessor list. Try asking OverviewNotion Security & TrustSecurity advisoriesProduct Security FeaturesDocumentationSubprocessorsTerms and PrivacyControlsBug Bounty Loading content... Audit Reports Regulations Trusted by OpenAI Figma Ramp Cursor Vercel NVIDIA Volvo L'Oréal Discord Lovable 1Password Toyota Clay Faire Contact supportReport a vulnerability Trust center by Wolfia: AI trust center & security questionnaire automation Want a trust center like this one? Get one for your company with Wolfia Documentation Featured SOC 2 Type II Report ISO/IEC 27001 Certificate Notion Security & Trust Subprocessors AWS · USA, European Union, Korea, Japan Hosting and storage systems provider. USA, European Union, Korea, Japan Anthropic · Global Service provider for AI agents, hosting large language models and embeddings, and for abuse prevention. Global Anysource Inc., dba Runlayer · USA Security for MCP connections. USA AssemblyAI Inc. · USA Transcription services. USA Baseten Labs, Inc. · Global Compute infrastructure for serving large language models and powering AI services. Global Controls AI governance and security Comprehensive policies, technical controls, and dedicated programs ensuring responsible, secure, and transparent use of AI capabilities across all Notion products. AI tools usage and governance policy Securing AI program Prompt injection protection AI content moderation and guardrails No customer data for AI training AI data retention controls Permissions-aware AI architecture Enterprise AI kill switch MCP server security controls AI activity logging and audit AI vendor governance DLP integration for AI AI transparency and explainability AI risk assessment Data protection and privacy Policies and technical controls ensuring customer data is classified, handled, retained, and deleted in compliance with global privacy regulations. Data classification framework Restricted production data use Data processing addendum Data retention and deletion Data deletion procedures Customer-requested deletion Data handling and retention Privacy policy transparency Customer data ownership Encryption and key management Comprehensive encryption controls protecting data at rest, in transit, and through customer-managed key infrastructure. Encryption in transit Encryption at rest Restricted encryption key access Enterprise key management Multi-layer envelope encryption Key rotation and compromise response Password hashing Encryption audit trails Contact supportReport a vulnerability Trust center by Wolfia: AI trust center & security questionnaire automation Want a trust center like this one? Get one for your company with Wolfia Controls AI governance and security Comprehensive policies, technical controls, and dedicated programs ensuring responsible, secure, and transparent use of AI capabilities across all Notion products. AI tools usage and governance policy A formal AI Tools Usage and Governance Policy establishes guidelines for responsible and secure AI use, reviewed annually. Only approved AI tools vetted through the procurement lifecycle may be used, and usage must comply with data privacy laws (GDPR, HIPAA) while avoiding discrimination or bias. Securing AI program A dedicated Securing AI Program strengthens AI products against security issues such as prompt injection and data exfiltration, with proactive security measures, regular assessments, and SLAs on security findings tracked through dashboards and leadership readouts. Prompt injection protection Notion employs multiple layers of prompt injection defense: tool metadata and call results are scanned using an LLM-based detection system, MCP tool results are XML-escaped to prevent injection via fake markup, and tool call inputs are validated against declared JSON schemas. AI content moderation and guardrails Content moderation endpoints and safety checks are applied on inputs before reaching models, with policy enforcement on outputs consistent with Notion's Content and Use Policy. Guardrail effectiveness is tracked through metrics including denied prompt rates, false positive rates, and marketplace template scanning rejection rates. No customer data for AI training User data is never used to train or influence Notion AI models. Notion and its AI subprocessors have contractual agreements prohibiting the use of customer data for model training. Only synthetic data is used for training, stored separately with the same strict access controls as other data. AI data retention controls For Enterprise workspaces, LLM providers use zero data retention after processing. Non-Enterprise workspaces have a maximum 30-day retention before deletion. AI embeddings are deleted within 60 days of page or workspace deletion. Permissions-aware AI architecture AI features honor existing user session permissions, ensuring LLMs cannot access information users do not already have access to. Sensitive content is not cached, and human oversight is maintained at every stage from pre-deployment testing to post-output monitoring. Enterprise AI kill switch Workspace owners on the Enterprise Plan can promptly disable Notion AI features in settings, immediately preventing data from being sent to AI subprocessors. AI features can be re-enabled in a timely manner after incident resolution. MCP server security controls Outbound requests to external MCP servers are routed through a forward proxy that blocks connections to private/internal IP addresses. HTTPS is required, OAuth tokens are stored securely in AWS Secrets Manager, and newly discovered tools are disabled by default until an admin explicitly enables them. AI activity logging and audit AI activity logs capture usage by user and type of AI event with timestamps and actions performed. Enterprise administrators have direct access to verbose audit logs, and periodic audits ensure compliance with the AI governance policy. AI vendor governance All third-party AI vendors undergo security assessments, must sign data privacy compliance agreements, and are reviewed annually from both security and legal perspectives. Notion uses LLMs from vetted providers including Anthropic and OpenAI. DLP integration for AI Customers can integrate third-party data loss prevention (DLP) solutions to trigger alerts for sensitive content in AI prompts and generated content, providing an additional layer of control over what data is processed by AI features. AI transparency and explainability AI tools are required to provide explanations for their decisions when possible. Users are made aware of limitations regarding accuracy and reliability, and employees must document AI tool usage including data used, decisions made, and potential risks. AI risk assessment Annual risk assessments identify, measure, and address risks related to AI, including documented policies guiding risk identification, analysis, and mitigation. Control activities are in place to address identified AI risks efficiently. Data protection and privacy Policies and technical controls ensuring customer data is classified, handled, retained, and deleted in compliance with global privacy regulations. Data classification framework Information is classified by sensitivity, with customer data and user content designated as the most sensitive category and subject to privileged, monitored, and explicitly approved access. Restricted production data use Customer data is prohibited from being used or stored in non-production environments unless explicitly authorized through a documented process with appropriate safeguards. Data processing addendum Notion provides a Data Processing Addendum (DPA) that governs the processing of personal data, establishing clear roles, responsibilities, and safeguards aligned with GDPR and other privacy regulations. Data retention and deletion Customer data is retained and deleted according to contractual, legal, regulatory, and documented retention requirements, including deletion upon termination where applicable. Data deletion procedures Formal data deletion policies and procedures ensure customer data is permanently removed upon request or account termination, with documented retention schedules applied by data classification level. Customer-requested deletion Customers may request deletion of their confidential information, and deletion requests are documented and tracked through completion. Data handling and retention Documented data handling and retention policies govern how customer data is stored, processed, and retained, with schedules applied based on data classification and applicable legal requirements. Privacy policy transparency Notion's Privacy Policy is publicly accessible, clearly disclosing data collection practices, usage, and customer rights. Usage Data is distinguished from Customer Data and de-identified before external disclosure. Customer data ownership Customers retain full ownership of all content in their Notion workspace, including AI interaction inputs and outputs. Notion does not use customer data to train AI models and does not permit third parties to do so. Encryption and key management Comprehensive encryption controls protecting data at rest, in transit, and through customer-managed key infrastructure. Encryption in transit Customer data transmitted over public networks is protected using secure transport encryption, helping prevent interception and unauthorized modification. Encryption at rest Customer and other sensitive data stored in production systems is encrypted, reducing exposure if storage media or services are accessed improperly. Restricted encryption key access Encryption keys are stored in approved key management systems and access is limited to authorized personnel. Enterprise key management Enterprise customers can manage their own encryption keys through AWS Key Management Service (KMS), providing additional control over data confidentiality with the ability to revoke Notion's access at any time. Multi-layer envelope encryption Notion employs a three-layer envelope encryption architecture: Customer Managed Key (CMK), Workspace Encryption Key (WEK), and Data Encryption Keys (DEK), exceeding traditional two-layer approaches for defense in depth. Key rotation and compromise response Keys are rotated when compromised and on a defined recurring basis, while suspected compromise triggers prompt revocation or rotation procedures. Password hashing Customer passwords are hashed using bcrypt, a one-way cryptographic hashing algorithm that inherently incorporates a unique salt for each password hash, ensuring identical passwords produce different hash values. Encryption audit trails Comprehensive logs and audit trails are maintained for encryption operations, including key generation, access, rotation, and administrative actions across critical production systems. Access control and authentication Identity verification, role-based permissions, and multi-factor authentication to protect workspace access. Multi-factor authentication Multi-factor authentication is enabled for workforce identity accounts, critical systems, privileged access, and production access where supported. SAML single sign-on Enterprise customers can configure SAML 2.0-based SSO with major identity providers including Okta, Microsoft Entra ID, Google Workspace, and OneLogin. Workspace administrators can enforce SSO-only authentication. Role-based least-privilege access Access is assigned according to job role and limited to the minimum privileges needed to perform authorized responsibilities. Role-based access control Notion supports multiple user roles with granular permission levels (Full Access, Can Edit, Can Comment, Can View) at the page and teamspace level, enabling precise control over who can access and modify content. Access approval workflow Requests for access and access changes require documented business justification and approval from designated managers or system owners before provisioning. Quarterly access reviews Management reviews user roles and permissions at least quarterly, including privileged access, to identify and correct inappropriate access. Least privilege access Access rights are limited to the minimum necessary for individuals to perform their job functions. All access requests require documented business justification and approval by system or group owners. Automated user provisioning SCIM-based automated user and group provisioning is supported through identity providers including Okta and Microsoft Entra ID, enabling streamlined onboarding and offboarding. Session management Server-side session management with configurable session duration policies, explicit revocation on logout, and remote session termination capabilities for organization administrators. IP and domain allowlisting Workspace administrators can restrict access to approved networks through IP and domain allowlisting, adding an additional layer of access control beyond authentication. Access termination within 24 hours User access is terminated within 24 hours of an employee's last day of work. Access may also be suspended immediately in response to security incidents or suspected unauthorized activity. Zero trust network architecture Always-on access decisions validate each user's network in real-time by dynamically assessing identity, device security, behavior patterns, and location, enabling immediate restriction if anomalous activity is detected. Compliance and certifications Independent third-party audits and certifications validating Notion's security controls against industry-recognized frameworks. SOC 2 Type II certification Notion undergoes annual SOC 2 Type II audits, providing independent verification that security controls are designed and operating effectively over a sustained period. SOC 2 Type II examination An independent service auditor examined the design and operating effectiveness of controls supporting security, availability, and confidentiality over the review period. SOC 2 Type I certification Independent point-in-time assessment validating the design of Notion's security controls against the SOC 2 Trust Services Criteria. ISO/IEC 27001 certification The information security management system is certified against ISO/IEC 27001, with annual surveillance audits supporting continued conformity. SOC 3 Type II report Publicly available general-use report summarizing the results of Notion's SOC 2 Type II audit, providing transparency into security control effectiveness. HIPAA and HITECH attestation An independent practitioner reported that the information security and breach notification program conformed to applicable HIPAA Security Rule and HITECH criteria. C5 cloud security attestation An independent practitioner examined the design and operating effectiveness of controls against the BSI C5 cloud computing criteria. ISO 27001 certification Notion maintains ISO 27001 certification, demonstrating a systematic approach to managing sensitive information through an established Information Security Management System. HIPAA compliance Notion's security controls and breach notification procedures are assessed against HIPAA Security Rule requirements, supporting healthcare customers with regulatory compliance needs. BSI C5 attestation Notion holds BSI Cloud Computing Compliance Controls Catalogue (C5) attestation, meeting the security requirements established by the German Federal Office for Information Security. CAIQ security assessment Notion completes the Cloud Security Alliance Consensus Assessments Initiative Questionnaire, providing standardized transparency into cloud security controls and practices. EU AI Act compliance Notion complies with the EU AI Act requirements. Under the risk-based framework, Notion AI is classified as a limited-risk AI system, and Notion is categorized as a deployer of AI systems. Application security Security integrated throughout the software development lifecycle, from design through deployment and ongoing monitoring. Secure software development lifecycle Security requirements are integrated across software design, implementation, testing, deployment, and operation. Secure development lifecycle Notion follows a defined SDLC with security integrated at every phase, including threat modeling and secure design reviews during design, code audits and security scans after development, and vulnerability management post-launch. Peer review of code changes Application and infrastructure changes receive independent peer review before production deployment, supporting separation of duties and reducing unauthorized or defective changes. Static application security testing SAST runs on every pull request to automatically detect vulnerabilities when engineers make changes to code, providing continuous security validation as part of the development workflow. Pre-production security testing Changes are tested before production deployment, with security-relevant changes receiving validation appropriate to their risk. Software composition analysis Automated SCA scanning analyzes third-party components and dependencies for known security vulnerabilities, reducing supply chain risk. Production and non-production separation Development, testing, and production environments are logically separated to reduce the risk of unauthorized access to customer data and uncontrolled production changes. Mandatory code review All source code changes are managed through pull requests requiring independent peer review and approval before deployment to production, with reviews based on the OWASP framework. Annual penetration testing Notion conducts annual third-party grey-box penetration testing across desktop, mobile, and browser applications, with all critical and high findings remediated and validated. Bug bounty program Notion operates a public bug bounty program through HackerOne, providing continuous external security testing from the global security research community. Automated security testing Continuous unit, integration, and functional test suites include security invariants that must pass on each pull request and release candidate before deployment. OWASP secure coding training Developers complete annual secure coding training covering OWASP secure development principles and the OWASP Top 10 vulnerabilities, ensuring security awareness is embedded in the engineering culture. Incident response Established procedures for detecting, containing, investigating, and recovering from security incidents with 24/7 coverage. Documented incident response plan A formal plan defines incident handling procedures, responsibilities, escalation, and communication expectations for personnel and customers. 24/7 incident response capability Notion maintains a dedicated incident response team with 24/7/365 on-call coverage to monitor, triage, contain, investigate, and respond to security events through centralized alerting and escalation procedures. Security incident response plan A formally documented and management-approved Security Incident Response Plan covers detection, coordination, resolution, closure, and post-incident review, validated through SOC 2 and ISO 27001 audits. Continuous incident monitoring Security events are continuously monitored, reviewed, documented, and escalated for resolution by authorized personnel. Customer breach notification Impacted customers are notified of confirmed security incidents in accordance with applicable laws and contractual commitments. Breach notification Upon becoming aware of a security incident, Notion provides written notice without undue delay in accordance with applicable data protection laws, with standard breach notification within 72 hours. Post-incident reviews After each incident is resolved, a post-mortem is conducted including root cause analysis and lessons learned documentation. Findings are used to update the incident response plan and prevent recurrence. Post-incident improvement Incident evaluations include lessons learned, root-cause analysis where appropriate, and corrective actions intended to reduce recurrence. Annual incident response testing The Incident Response Plan is tested at least annually through tabletop exercises or simulations to validate effectiveness, confirm team member understanding of roles, and identify gaps. Cross-functional escalation The incident response workflow supports cross-functional reporting and coordination with defined roles and severity-based engagement, including a clear matrix of authorized public communicators during adverse events. Business continuity and disaster recovery Plans and infrastructure ensuring service resilience, data backup, and rapid recovery from disruptive events. Business continuity plan A formal Business Continuity Plan ensures Notion can maintain or quickly resume critical business operations during disruptive events, reviewed and renewed at least annually by designated owners. Documented continuity and recovery plans Business continuity and disaster recovery plans define recovery priorities, responsibilities, communication methods, and restoration procedures for major disruptions. Customer data backups Automated backups are performed for data stores containing customer data, supporting recovery from deletion, corruption, incidents, or disasters. Disaster recovery plan A documented Disaster Recovery Plan outlines strategies and procedures for continuity of critical systems and data, with multi-tiered, cross-region backup capabilities for production databases. Automated data backups Production databases are backed up automatically with encryption using the same standards as live data. Backups are stored in geographically separate regions within the same compliance zone. Availability-zone replication Databases are replicated to secondary availability zones and production environments use a multi-location strategy to support continued operations after a facility or system failure. Annual BC/DR testing Business continuity and disaster recovery plans are tested annually with documented results covering Notion's core products and regions, validating plan effectiveness and team readiness. Annual recovery testing Disaster recovery and backup restoration tests are performed at least annually, with results and lessons learned documented for improvement. Service level commitment Notion commits to 99.9% service availability, with current and historical uptime data publicly available at status.notion.so for full transparency. Network and infrastructure security Defense-in-depth controls protecting network boundaries, traffic monitoring, and cloud infrastructure from threats. Intrusion detection and prevention Intrusion Detection and Prevention Systems (IDPS) continuously monitor production network traffic and system activity for known attack signatures and anomalous behavior, with alerts routed to security teams. Production network protection Firewalls, security groups, and web application protections restrict unauthorized traffic to production systems and support controlled connectivity. Network segmentation Production systems and customer-facing applications are logically separated from corporate information systems and other network environments. SIEM-based monitoring A Security Information and Event Management platform collects, aggregates, and analyzes security-relevant logs across corporate and production environments with detection rules maintained as code. Intrusion detection Network activity is monitored for potentially malicious traffic, with alerts reviewed and resolved by authorized personnel. Traffic distribution and availability Traffic distribution controls support production reliability and availability by balancing requests across available service capacity. Restricted service exposure No TCP or UDP services other than HTTPS are exposed to the public internet or employee-accessible VPN, minimizing the attack surface. Change control for network configuration All cloud network configuration changes including firewalls, routing, and security groups require ticket documentation, owner assignment, approval, and audit trail before production deployment. Vulnerability management Systematic identification, assessment, prioritization, and remediation of security vulnerabilities across applications and infrastructure. Continuous vulnerability scanning Internal production infrastructure is scanned continuously and external application scans are performed at least weekly to identify potential weaknesses. Vulnerability management program A formal Vulnerability Management Policy establishes a framework for identifying, assessing, prioritizing, and remediating vulnerabilities across all applications and infrastructure using standardized risk-ranking methodology. Automated vulnerability scanning Regular external vulnerability scans are performed by an Approved Scanning Vendor (ASV), complemented by internal dependency and vulnerability monitoring across the codebase. Annual penetration testing Qualified independent testing is performed at least annually to identify vulnerabilities that could affect the production environment. Risk-based vulnerability remediation Confirmed vulnerabilities are validated, risk-ranked, assigned to responsible owners, and remediated according to severity-based timelines. Threat intelligence monitoring Notion subscribes to threat intelligence feeds, RSS feeds, and vendor security advisories for up-to-date vulnerability information, enabling proactive identification and response. Patch management Security patches are tested in non-production environments before deployment, with post-deployment validation to confirm effectiveness. Critical vulnerabilities may trigger emergency incident response procedures. Public bug bounty program Independent researchers and customers can submit potential bugs and vulnerabilities to the security team, expanding external security coverage. Responsible disclosure program A published Responsible Disclosure Policy provides clear guidelines for external researchers to report security vulnerabilities, with a structured process for assessment and remediation. Monitoring and logging Comprehensive audit trails and real-time monitoring across all systems to detect anomalies and support forensic investigation. Comprehensive audit logging Audit logs capture key events including page activity, data source changes, admin and security actions, user identification, IP addresses, event types, timestamps, and success or failure indicators. Centralized security monitoring Security events and production activity are collected in centralized monitoring systems that alert authorized personnel to potential incidents. 24/7 security monitoring System and data security is monitored 24/7/365 including hosted environments, with alerts for malware infections, suspicious activity, and anomalous behavior automatically routed to security channels. Access activity logging Critical systems record account management, login, object access, policy change, and privileged-use events to support accountability and investigation. Alert investigation and resolution Alerts are reviewed and resolved in a timely manner, with relevant events tracked through documented operational or security processes. Privileged access monitoring All changes to privileged user access rights are tracked across all systems, including those with scoped data. Privileged access activities are logged and periodically reviewed for unauthorized behavior. Protected audit records Access to audit logs is restricted, and the number of personnel able to modify or delete them is limited to help preserve evidentiary integrity. Log archival and retention Application logs are archived with retention schedules applied in accordance with Data Handling and Retention, Data Classification, and Data Deletion policies for compliance and forensic readiness. Botnet and malware detection Security monitoring includes behavioral analysis capabilities to detect botnet traffic patterns, malware infections, and suspicious activity through IDS and SIEM correlation rules. Third-party risk management Vendor risk assessment and ongoing monitoring ensuring third-party services meet Notion's security and compliance standards. Vendor risk assessments Vendors undergo risk assessments before contributing to service delivery, with reviews repeated at least annually or when material changes occur. Security and confidentiality contracts Contracts with vendors handling confidential data or providing critical services include security, confidentiality, incident reporting, and data return or deletion commitments. Subprocessor transparency An up-to-date list of subprocessors is publicly available, providing customers full transparency into the third-party services involved in processing their data. Annual vendor reviews Subprocessors are monitored and reviewed at least annually to ensure continued compliance with Notion's security requirements, including review of attestation reports and security artifacts. Independent assurance review Independent assurance reports and other security evidence for critical vendors are reviewed at least annually, with findings and action items documented. Vendor offboarding controls Exit planning addresses access revocation, data return or export, secure deletion, transition responsibilities, and timing for higher-dependency vendors. Supplier code of conduct Notion maintains supplier-facing standards requiring vendors and subcontractors to comply with applicable laws, ethical labor practices, and responsible purchasing procedures. Employee security Personnel security controls including training, screening, and policy acknowledgment to maintain a security-aware workforce. Background checks Background checks are initiated for new personnel before their start date in accordance with applicable laws. Confidentiality agreements All employees sign an Employee Proprietary Information and Inventions Assignment Agreement (PIIA) as a condition of employment, reviewed annually to ensure alignment with evolving requirements. Security awareness training Personnel complete security and privacy awareness training during onboarding and at least annually, with completion records retained. Code of ethics and conduct A comprehensive Code of Ethics and Business Conduct covers standards of conduct, ethics, conflicts of interest, confidentiality, anti-bribery, and discrimination prevention. All employees must acknowledge it annually. Role-based security training Personnel with specialized responsibilities, including developers and incident responders, receive training tailored to their security duties. Confidentiality commitments Personnel acknowledge confidentiality and proprietary information obligations upon hire, limiting unauthorized use or disclosure of company and customer information. Privacy compliance monitoring Personnel are regularly monitored for privacy compliance through annual training, policy acknowledgement upon hire, and ongoing compliance monitoring by the Privacy Operations team. Physical and environmental security Physical access controls and environmental safeguards protecting facilities and computing infrastructure. Visitor escort policy All visitors to Notion facilities are required to have an escort at all times. On-site visitors and vendors must be accompanied by a Notion employee throughout their visit. Badge-controlled facility access Physical access to corporate facilities is restricted through access credentials that track entry and exit activity. Restricted-area access reviews Access permissions for restricted areas are reviewed periodically, including monthly review where designated secondary controls are not present. Facility access controls Physical access to facilities and computing areas is restricted through badge-controlled entry, visitor management systems, and surveillance, with access limited to authorized personnel and logged for accountability. Visitor management and escorting Visitors are logged, issued temporary identification, and escorted by Notion personnel while on company premises. Cloud infrastructure security Notion is hosted on AWS with data center physical security, environmental safeguards, and geographic redundancy managed by AWS. Notion does not operate its own data centers. Physical access monitoring Physical access, visitor, maintenance, and repair records are retained to support investigations, audits, and accountability. Endpoint security Controls protecting employee devices through detection, response, and configuration management. Full-disk encryption Company-managed endpoint drives are encrypted to reduce the risk of data exposure if a device is lost or stolen. Endpoint detection and response An EDR solution is deployed on all company-managed endpoint devices with continuous updates pushed automatically. Employees cannot modify or disable the anti-malware configuration. Endpoint malware protection Anti-malware protection is installed and continuously enforced on company-managed endpoint devices and applicable infrastructure systems. Unauthorized AI tool prevention Technical controls are maintained to prevent access to unauthorized AI tools on corporate devices, with any incidents requiring immediate reporting per the incident response policy. Mobile device management Mobile devices supporting the service are centrally managed, enabling consistent security configuration and administrative oversight. Secure workstation controls Workstations are configured to lock and require authentication after inactivity, helping limit unauthorized access to unattended devices. Change management Formal procedures governing application, system, and infrastructure changes with full traceability and approval workflows. Documented change approval Application and infrastructure changes are tracked, reviewed, tested, and approved before production deployment. Ticket-linked change control All changes to Notion's application are tied to tracked records in a version control system, requiring independent peer review and approval before deployment to production. Pre-production testing Changes undergo testing in non-production environments before deployment, with continuous integration pipelines validating quality and security before release candidates are promoted. Controlled production deployment Production changes are deployed through controlled release mechanisms, with migration access restricted to authorized personnel. Red team assessments Notion conducts risk-based red teaming exercises to evaluate the effectiveness of security controls and identify weaknesses before they can be exploited. Change traceability Changes are maintained in version control and linked to records that identify the change and supporting implementation evidence. Environment segregation Application development is separated from production and test environments. Active production environments are never re-used for testing, and production data is not used in development or testing without customer coordination. Rollback procedures Documented rollback procedures support recovery when a production change introduces an error, vulnerability, or service impact. Rollback strategy A rollback strategy is in place before changes are implemented, with previous software versions retained as a contingency measure and configuration control systems tracking all implemented changes. Documentation Featured SOC 2 Type II Report ISO/IEC 27001 Certificate Notion Security & Trust Audit Reports and Certifications SOC 2 Type II Report ISO/IEC 27001 Certificate SOC 3 Type II Report HIPAA Compliance Attestation Report ISO 27001 Statement of Applicability Notion – Accessibility Conformance Report WCAG Edition Penetration Test Reports Notion Security Audit Summary: Web, Mobile, Desktop (2026) Notion Web, App and Mobile Penetration Retesting Report 2026 Notion Calendar Penetration Test Notion Calendar Penetration Retesting Report 2026 Notion Mail Penetration Test Notion Mail Penetration Retesting Report Security Policies Acceptable Use Policy Asset Management Policy Backup Policy Business Continuity Plan Code of Ethics and Business Conduct Data Classification Policy Data Deletion Policy Data Handling and Retention Policy Data Protection Policy Disaster Recovery Plan Encryption Policy Information Security and Privacy Policy Information Security and Privacy Risk Assessment Policy Password Policy Physical Security Policy Security Incident Response Plan Software Development Lifecycle Policy System Access Control Policy Vendor Management Policy Vulnerability Management Policy AI Tools Usage and Governance Policy Security White Papers and Feature Guidebooks Workers (Beta) Security White Paper MCP and AI Security White Paper Slack Connector Security Feature Guidebook Questionnaires Notion - CAIQ (Consensus Assessment Initiative Questionnaire) - July 2026 Notion - VSA (Vendor Security Assessment) - July 2026 Notion - HECVAT (Higher Education Community Vendor Assessment Toolkit) - July 2026 Privacy and Legal Notion Labs, Inc - Certificate of Amendment of Articles of Incorporation 2026 Evidence of Insurance (until November 2027) Notion Labs, Inc. - Covered Telecommunications Equipment or Services Representation Notion Labs, Inc. - Form W-9 Notion Labs, Inc. - California Statement of Information Notion Labs Korea Ltd. - Business Registration Certificate Notion Labs, Inc. - Certificate of Good Standing Notion Labs Singapore - Certificate of Incorporation Other Security Information Notion Security & Trust Network Architecture Diagram What is a Subprocessor? In order to provide our Services, Notion engages the Subprocessors listed in the tables below. A Subprocessor is a third-party engaged by Notion and its applicable Affiliates, to process Customer Personal Data. Capitalized terms used herein are defined in Notion’s Data Processing Addendum. How do I subscribe to new Subprocessor notifications? Customers may sign up to receive notification of new Subprocessors by e-mailing team@makenotion.com with the subject “Subscribe to New Subprocessors.” Infrastructure Hosting and storage systems that store and process data within the Service. AWS · USA, European Union, Korea, Japan Hosting and storage systems provider. USA, European Union, Korea, Japan Platform Services that help manage and provide the Notion platform. Anthropic · Global Service provider for AI agents, hosting large language models and embeddings, and for abuse prevention. Global Anysource Inc., dba Runlayer · USA Security for MCP connections. USA AssemblyAI Inc. · USA Transcription services. USA Baseten Labs, Inc. · Global Compute infrastructure for serving large language models and powering AI services. Global Browserbase, Inc. · USA, Spain Service provider for browser-based web access and automation for AI agents. USA, Spain Cerebras Systems Inc. · USA Service provider for hosting large language models and embeddings. USA Cinder Technologies Inc. · USA Service provider for abuse prevention. USA Cloudflare · Global Content distribution and processing, security, abuse prevention and DNS services. Global Confluent · USA, Germany, Korea, Japan Kafka managed streaming storage platform used for in-product audit log data and analytics. USA, Germany, Korea, Japan DeepL · USA Translation services. USA Exa · USA Service provider for providing web search results. USA Fireworks · Global Compute infrastructure for serving large language models and powering AI services. Global Google LLC · Global Service provider for hosting large language models and embeddings and for abuse prevention. Global Mathpix, Inc. · USA, Germany, Singapore PDF file conversion. USA, Germany, Singapore Modal Labs, Inc. · Global Compute infrastructure for serving large language models and powering AI services. Global OpenAI · Global Service provider for hosting large language models and embeddings and for abuse prevention. Global Parallel Web Systems · USA Service provider for providing web search results and for hosting large language models and embeddings. USA PlanetScale, Inc. · USA, Germany, Japan Hosting and management of large-scale databases. USA, Germany, Japan Splunk · USA Security and application logging. USA StarTree, Inc. · USA, Germany, Korea, Japan Storage platform used for in-product analytics. USA, Germany, Korea, Japan Turbopuffer · USA, Germany, Korea, Japan Vector database for storing embeddings. USA, Germany, Korea, Japan Twilio · USA Multi-factor Authentication. USA TypeSafe AI, Inc. · Global Service provider for hosting structured classification and other models. Global Vercel Inc. · USA Compute services that enable code execution and AI agent actions. USA X.AI LLC · USA, UK Service provider for hosting large language models and embeddings. USA, UK Customer and support services Services that offer direct support to customers and their teams. Teleperformance · Greece Support services. Greece Business operations Services that manage business operations including analytics, messaging, and data pipelines. Customer.io · USA Transactional, broadcast, and marketing messaging. USA Fivetran · USA, Germany, Korea, Japan Data pipeline for connecting systems to our data warehouse. USA, Germany, Korea, Japan Mailgun Technologies, Inc. · USA Transactional, broadcast, and marketing messaging. USA Notion entities Notion affiliated entities involved in offering the Services. Brain Capital Labs PVT Ltd. · India Support services. India Notion International Inc. · USA Support services. USA Notion Labs Australia Pty Ltd · Australia Support services. Australia Notion Labs, Ireland Limited · Ireland Support services. Ireland Notion Labs Japan, G.K. · Japan Support services. Japan Notion Labs Korea Ltd · South Korea Support services. South Korea Notion Labs United Kingdom, Private Limited · UK Support services. UK Loading content... Latest Updates Overview