Notion
Work management · notion.com · last read 2026-11-09
At a glance
- Is Notion GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Notion itself publishes, each answer linked to its source and the date we read it.
- Which version of the Notion DPA is current?
- On 2026-10-09, Notion's DPA at notion.so printed “Data Processing Addendum (Deprecated August 14, 2026)”. Source and date
- Does Notion have a SOC 2 report?
- Notion says a SOC 2 report is available on request (no type given). In Notion's words: “Notion undergoes multiple, annual, industry standard audits including SOC 2, ISO 27001, ISMAP, BSI C5, and more! All audit reports are available on the Notion Trust Center.” We read this on 2026-10-19. Source and date
- Is Notion ISO 27001 certified?
- Notion states ISO/IEC 27001 certification, and says the certificate or audit report is available on request. In Notion's words: “Notion undergoes multiple, annual, industry standard audits including SOC 2, ISO 27001, ISMAP, BSI C5, and more! All audit reports are available on the Notion Trust Center.” We read this on 2026-10-19. Source and date
- Where is Notion's trust center?
- Notion publishes a page it calls “Trust Center” at trust.notion.com. Some of its documents sit behind a request or sign-in: the page says “Powered by Wolfia. Review compliance certifications, security policies, subprocessors, and request access to detailed documentation”. The page mentions SOC 2, ISO 27001, a penetration test, subprocessors, security questionnaires and a DPA. We read it on 2026-11-03. Source and date
- Does Notion use your data to train AI models?
- For every plan (Notion AI): By default neither Notion nor its AI providers use Customer Data to train any models; providers contractually prohibited. Source and date
- What is Notion's data retention for AI prompts and outputs?
- For consumer plans (Notion AI on Free and Plus): AI provider retains data for 30 days or fewer, then deletes it. For business plans (Notion AI on Business): AI provider retains data for 30 days or fewer, then deletes it. Source and date
- Does Notion offer zero data retention?
- For business plans (Notion AI for Enterprise customers): Most models offer zero data retention; a few retaining models are off by default (opt-in by workspace owner). Source and date
- Can Notion process AI data in the EU?
- For business plans (Notion Enterprise Plan (data residency)): Enterprise Plan can store certain Customer Data at rest in EU (Frankfurt); processing by subprocessors, including LLM providers, may occur outside the data region. Source and date
- How does Notion transfer personal data out of the EU?
- Notion Labs, Inc. is on the official Data Privacy Framework List (status: Active - Re-certification under Review). Source and date
- Does Notion offer EU data residency?
- An EU location exists but only on the enterprise tier. Plan it needs: Enterprise to migrate an existing workspace. Source and date
- Who are Notion's subprocessors?
- Notion lists 37 third-party subprocessors; 21 of them name at least one processing country outside the EEA. We last read the list on 2026-11-02. We have recorded 1 change to it, the latest on 2026-11-02. Source and date
- How do you report a security vulnerability to Notion?
- Notion publishes a security.txt at www.notion.com naming https://www.notion.so/Responsible-Disclosure-Policy-5f18bb6b86804eaf989c006131778b9c. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | Notion Labs, Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | US |
| EU contracting entity | — |
| LEI | 2138005T88RDXMNXG698 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | notion.notion.site · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Notion data residency
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Enterprise only | Enterprise to migrate an existing workspace | notion.com | 2026-09-18 |
EU: CORRECTION of our 2026-09-17 reading of unstated. Data region EU-Central-1 (Frankfurt) with backup in EU-West-1 (Ireland). Page states eligible workspace owners may choose a region, and that moving an EXISTING workspace requires the Enterprise plan and the Notion account team.
The same question for every vendor: where SaaS vendors store EU data.
Notion's subprocessor list names AWS and Google for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
Subprocessor chain
37 third parties · 7 of the vendor's own group companies · 21 with a country outside the EEA · all read 2026-11-02
| Subprocessor | Country | Purpose |
|---|---|---|
| Anthropic | — | — |
| Anthropic | — | LLMs from vetted providers |
| Anthropic | — | Service provider for AI agents, hosting large language models and embeddings, and for abuse prevention. |
| Anysource Inc., dba Runlayer | US | Security for MCP connections. |
| AssemblyAI Inc. | US | Transcription services. |
| AWS | — | Cloud hosting, with data center physical security, environmental safeguards, and geographic redundancy |
| AWS | US, EU, KR, JP | Hosting and storage systems provider. |
| AWS | — | infrastructure and hosting |
| Baseten Labs, Inc. | — | Compute infrastructure for serving large language models and powering AI services. |
| Browserbase, Inc. | US, ES | Service provider for browser-based web access and automation for AI agents. |
| Cerebras Systems Inc. | US | Service provider for hosting large language models and embeddings. |
| Cinder Technologies Inc. | US | Service provider for abuse prevention. |
| Cloudflare | — | infrastructure and hosting |
| Confluent | US, DE, KR, JP | Kafka managed streaming storage platform used for in-product audit log data and analytics. |
| Customer.io | US | Transactional, broadcast, and marketing messaging. |
| DeepL | US | Translation services. |
| Exa | US | Service provider for providing web search results. |
| Fireworks | — | Compute infrastructure for serving large language models and powering AI services. |
| Fivetran | US, DE, KR, JP | Data pipeline for connecting systems to our data warehouse. |
| Google Cloud | — | infrastructure and hosting |
| Google LLC | — | Service provider for hosting large language models and embeddings and for abuse prevention. |
| Mailgun Technologies, Inc. | US | Transactional, broadcast, and marketing messaging. |
| Mathpix, Inc. | US, DE, SG | PDF file conversion. |
| Modal Labs, Inc. | — | Compute infrastructure for serving large language models and powering AI services. |
| OpenAI | — | LLMs from vetted providers |
| OpenAI | — | Service provider for hosting large language models and embeddings and for abuse prevention. |
| Parallel Web Systems | US | Service provider for providing web search results and for hosting large language models and embeddings. |
| PlanetScale, Inc. | US, DE, JP | Hosting and management of large-scale databases. |
| Runlayer | — | — |
| Splunk | US | Security and application logging. |
| StarTree, Inc. | US, DE, KR, JP | Storage platform used for in-product analytics. |
| Teleperformance | GR | Support services. |
| Turbopuffer | US, DE, KR, JP | Vector database for storing embeddings. |
| Twilio | US | Multi-factor Authentication. |
| TypeSafe AI, Inc. | — | Service provider for hosting structured classification and other models. |
| Vercel Inc. | US | Compute services that enable code execution and AI agent actions. |
| X.AI LLC | US, GB | Service provider for hosting large language models and embeddings. |
Notion's own group companies listed as subprocessors (7)
| Company | Country | Purpose |
|---|---|---|
| Brain Capital Labs PVT Ltd. | IN | Support services. |
| Notion International Inc. | US | Support services. |
| Notion Labs Australia Pty Ltd | AU | Support services. |
| Notion Labs Japan, G.K. | JP | Support services. |
| Notion Labs Korea Ltd | KR | Support services. |
| Notion Labs United Kingdom, Private Limited | GB | Support services. |
| Notion Labs, Ireland Limited | IE | Support services. |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
No data processing agreement read yet.
Which version applies
On 2026-10-09, the agreement printed: Data Processing Addendum (Deprecated August 14, 2026)
at notion.so
Last updated 2026-08-14
This version is in our copies from 2026-10-09.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
AI and your data
What Notion's own pages state about the data you send its AI products, plan by plan. Compared with other vendors on AI vendors and your data.
| Plans | Term | What the page says | Source | Observed |
|---|---|---|---|---|
| All plans Notion AI | Training on your data | Not used By default neither Notion nor its AI providers use Customer Data to train any models; providers contractually prohibited | notion.com | 2026-10-28 |
| Consumer Notion AI on Free and Plus | Data retention | 30 days AI provider retains data for 30 days or fewer, then deletes it | notion.com | 2026-10-28 |
| Business Notion AI on Business | Data retention | 30 days AI provider retains data for 30 days or fewer, then deletes it | notion.com | 2026-10-28 |
| Business Notion AI for Enterprise customers | Zero data retention | Available Most models offer zero data retention; a few retaining models are off by default (opt-in by workspace owner) | notion.com | 2026-10-28 |
| Business Notion Enterprise Plan (data residency) | EU processing | EU storage only Enterprise Plan can store certain Customer Data at rest in EU (Frankfurt); processing by subprocessors, including LLM providers, may occur outside the data region | notion.com | 2026-10-28 |
Assurance
Does Notion have a SOC 2 report?
Notion says a SOC 2 report is available on request (no type given). We read this on 2026-10-19.
- Available on request “Notion undergoes multiple, annual, industry standard audits including SOC 2, ISO 27001, ISMAP, BSI C5, and more! All audit reports are available on the Notion Trust Center.”
Source: notion.com, 2026-10-19
Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.
Is Notion ISO 27001 certified?
Notion states ISO/IEC 27001 certification, and says the certificate or audit report is available on request. We read this on 2026-10-19.
- Available on request “Notion undergoes multiple, annual, industry standard audits including SOC 2, ISO 27001, ISMAP, BSI C5, and more! All audit reports are available on the Notion Trust Center.”
Source: notion.com, 2026-10-19
On the same list Notion also names ISO/IEC 27018 and ISO/IEC 27701. Each standard's page says how it relates to ISO/IEC 27001.
Of the 122 vendors in this registry whose own pages state ISO/IEC 27001, 16 link to the certificate, 43 say it is available on request, and 63 state it without saying how to get it. A certificate names the certification body, the scope and the expiry date: those are the three things to check.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| BSI C5 · C5 | Available on request | — | notion.com | 2026-10-19 |
| CCPA | Claimed | California privacy laws | notion.com | 2026-10-19 |
| CPRA · CCPA | Claimed | California privacy laws | notion.com | 2026-10-19 |
| GDPR | Claimed | — | notion.com | 2026-10-19 |
| HIPAA | Claimed | Enterprise-grade HIPAA security features, with a Business Associate Agreement (BAA) available to Enterprise customers | notion.com | 2026-10-19 |
| HITECH | Claimed | — | notion.com | 2026-10-19 |
| ISMAP | Available on request | — | notion.com | 2026-10-19 |
| ISO 27001 · ISO27001 | Available on request | — | notion.com | 2026-10-19 |
| ISO 27018 · ISO27018 | Claimed | privacy by design across the data lifecycle | notion.com | 2026-10-19 |
| ISO 27701 · ISO27701 | Claimed | privacy by design across the data lifecycle | notion.com | 2026-10-19 |
| OWASP LLM Top 10 | Claimed | adversarial testing of AI features | notion.com | 2026-10-19 |
| SOC 2 · SOC2 | Available on request | — | notion.com | 2026-10-19 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Notion Labs, Inc. | Active - Re-certification under Review | HR data, non-HR data | 2025-10-08 | 2026-10-05 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Notion Labs, Inc. | Active - Re-certification under Review | HR data, non-HR data | 2025-10-08 | 2026-10-05 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Notion Labs, Inc. | Active - Re-certification under Review | HR data, non-HR data | 2025-10-08 | 2026-10-05 |
| Global LEI Index (GLEIF) | NOTION LABS, INC. · NOTION LABS, INC. | ISSUED | US-DE | 2027-02-11 | 2026-10-08 |
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under Notion; Notion Labs, Inc.
- ISO 27001 on the basis of IT-Grundschutz (BSI, Germany): checked 2026-11-09, no entry under Notion; Notion Labs, Inc.
- CISPE Data Protection Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Notion; Notion Labs, Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under Notion; Notion Labs, Inc.
- Data Privacy Framework List (US): checked 2026-11-09, 3 entries under Notion; Notion Labs, Inc.
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under Notion; Notion Labs, Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Notion; Notion Labs, Inc.
- FedRAMP Marketplace (US): checked 2026-11-09, no entry under Notion; Notion Labs, Inc.
- GPAI Code of Practice signatories (European Commission): checked 2026-11-09, no entry under Notion; Notion Labs, Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under Notion; Notion Labs, Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Notion (SaaS) | — | Service only | unknown | notion.so | 2026-09-18 |
Vulnerability reporting: notion.so (security.txt, expires 2030-01-01; read 2026-10-17)
How other vendors publish theirs: security.txt across the registry.
Documents
Where is Notion's trust center?
Notion publishes a page it calls “Trust Center” at trust.notion.com. Some of its documents sit behind a request or sign-in. The page mentions SOC 2, ISO 27001, a penetration test, subprocessors, security questionnaires and a DPA. We read it on 2026-11-03. Open trust.notion.com
- Name “Notion Trust Center”
- Request step “Powered by Wolfia. Review compliance certifications, security policies, subprocessors, and request access to detailed documentation.”
Source: trust.notion.com, 2026-11-03. Read from the page's text, without a model; every vendor's trust center.
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| ai | Public | full | 200 | 2026-10-28 |
| ai-2 | Public | full | 200 | 2026-10-28 |
| certifications | Public | full | 200 | 2026-10-19 |
| subprocessors | Public | full | 200 | 2026-11-02 |
| tia | Public | full | 200 | 2026-10-20 |
| trust-center | JavaScript only | full | 200 | 2026-10-05 |
History
| Detected | What moved | Why | Source |
|---|---|---|---|
| 2026-11-02 | Subprocessors added AssemblyAI Inc.; Browserbase, Inc.; Cinder Technologies Inc.; Customer.io; Google Cloud; Mailgun Technologies, Inc.; Modal Labs, Inc.; PlanetScale, Inc.; Runlayer; TypeSafe AI, Inc. Subprocessors removed Amplitude; Customer; Mailgun | the vendor changed it | trust.notion.com |
| 2026-10-19 | Status Claimed → Available on request | the vendor changed it | notion.com |
| 2026-10-19 | Status Claimed → Available on request | the vendor changed it | notion.com |
| 2026-09-18 | EU data location Not stated → Enterprise only Minimum plan set to Enterprise to migrate an existing workspace Note rewritten | we read a better page | notion.com |
Every reviewed change across the registry, newest first: vendor changes.