Snapshot 98500
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Notion maintains an up-to-date Trust Center that houses our Information Security policies, industry standard security audit reports, penetration tests results and additional security resources. For more detailed information about the technical and organizational measures Notion maintains to protect customer data, review our Security Exhibit and the Technical and Organisational Security Measures in our Data Processing Addendum. Notion also operates a Shared Responsibility Model to ensure that Notion and its users work together to create a safe and effective workspace experience. Product Security Controls for You Notion takes a security-by-design approach to protecting your data. Our team continues to make investments so you can use Notion with confidence. Authentication & Access Controls Sign in with SSO, add MFA, and enforce role‑based and least‑privilege permissions. Logging in and out of Notion Your Data, Your Rules You decide what data to enter into the platform, what you retain, delete with backup controls for continuity. Back up your data Data Residency Ensure your data is stored in your specified region. Available to Enterprise customers only. Data residency for Notion Audit Logging Get detailed audit log information about security and safety-related activity in your workspace. Notion can integrate with your DLP or SIEM of choice. Audit log Domain Management Claim ownership over an email address domain associated with your workspace, allowing you to control workspace creation and configure connections. Domain management Enterprise Ready Controls Enforce SAML SSO, manage encryption keys, automate user provisioning and deprovisioning with SCIM, and apply organization-wide policies for guest access, public sharing, exports, and data retention. Notion Enterprise security provisions Supported by Organization Security Controls Industry Standard Encryption Your data, encrypted in transit (TLS 1.2 or higher) and at rest (AES-256) with keys rotated regularly. Strict Access Controls Least privilege access based on role, business need, and need-to-know coupled with time-bound access, reviewed frequently. Robust Vulnerability Management Regular vulnerability management via scanning, package monitoring, and patching. Notion also maintains a bug bounty program. Notion bug bounty 24/7 Incident Response Defense-in-depth monitoring using network and host-based IDS/IPS. Centralized security information and event management (SIEM) logging and security alerting for 24/7 incident response. SDLC Secure software development lifecycle (SDLC) with threat modeling, secure design reviews, code analysis and review, and security testing to ensure changes are managed and deployed securely. Employee Security Background checks and ongoing security training so every Notion teammate helps keep your data safe. Environment Separation Separate development, testing, and production environments. Customer data is logically separated. Strong Technical Controls Web Application Firewalls (WAF) and Distributed denial of service (DDoS) protection through third-party services. Defense-in-depth monitoring using network and host-based IDS/IPS. Endpoint Security Managed employee devices through centralized mobile device management (MDM) system allowing for remote wipe and block capabilities. Compliance Audit and Compliance Notion undergoes multiple, annual, industry standard audits including SOC 2, ISO 27001, ISMAP, BSI C5, and more! All audit reports are available on the Notion Trust Center. Visit the Notion Trust Center Annual Penetration Testing Annual, external, third-party performed penetration tests against the Notion Web, Mobile, Desktop and Calendar applications. Penetration tests are available on the Notion Trust Center. Visit the Notion Trust Center SOC 2-audited data centers An independent, up-to-date audit of data center service providers means your data is protected behind the latest technology and the best physical and technical controls. Availability Redundancy Notion’s infrastructure is built on highly available cloud services with multi-region failover capabilities to minimize downtime and provide seamless service continuity in case of localized failures. Backups Automated cross region backups to protect your data against accidental loss or corruption. Disaster Recovery and Business Continuity Notion maintains a comprehensive Disaster Recovery (DR) and Business Continuity Plan (BCP) that is tested annually to verify its effectiveness. Artificial intelligence (AI) governance Notion leverages AI to improve the core product experience and provide real value to our users in their day-to-day work. We strive to do this in a way that’s trustworthy, reliable, and user-centric. Our AI security and privacy practices Third-party Management AI features and partners are reviewed for security and legal compliance before being used in Notion. These reviews follow the same rigorous security practices applied to the rest of the platform. Data Governance Customer data is never used to train AI models by Notion or its subprocessors. Controls and permissions over data access and use are strictly enforced. AI Security Features include prompt-injection guardrails, least-privilege permission enforcement, human-in-the-loop confirmation, hidden-command detection, and OWASP LLM Top 10-aligned adversarial testing. How Notion protects against prompt injection risks Privacy Our Terms and Privacy Policies Data retention & deletion Notion keeps data only as long as needed to provide our services and meet legal requirements, as documented in our Terms and Privacy. View our Terms and Privacy Subprocessors Notion works with vetted service providers for infrastructure, analytics, and email. Each subprocessor is bound by contract, assessed for privacy and security, and processes data only under our instructions. Subprocessor List Privacy-by-Design Notion embeds privacy by design across the data lifecycle, with controls aligned to GDPR and CCPA and independently attested to against ISO 27701 and ISO 27018. CCPA Notion complies with California privacy laws, including CCPA and CPRA, which grant rights such as data access, deletion, and opt-out of data sale. GDPR Notion is aligned with the General Data Protection Regulation (GDPR), ensuring transparency, accountability, and user control over personal data. HIPAA and HITECH Businesses subject to HIPAA can leverage Notion's Enterprise-grade HIPAA security features, with a Business Associate Agreement (BAA) available to Enterprise customers. HIPAA configuration Contact us about security issues: [email protected] Contact us with platform safety or account-integrity issues: [email protected] Learn about our enterprise plan Interested in advanced security and control? Let us know your needs and we can help! Get Notion freeRequest a demo