Security page — Notion Wikis

Cited by

Facts read from this source

• Trust center Report an error

  “Notion maintains an up-to-date Trust Center that houses our Information Security policies, industry standard security audit reports, penetration tests results and additional security resources.”

• DPA Report an error

  “review our Security Exhibit and the Technical and Organisational Security Measures in our Data Processing Addendum”

• Shared responsibility model Report an error

  “Notion also operates a Shared Responsibility Model to ensure that Notion and its users work together to create a safe and effective workspace experience.”

• SSO MFA Report an error

  “Sign in with SSO, add MFA, and enforce role‑based and least‑privilege permissions.”

• Backup controls Report an error

  “You decide what data to enter into the platform, what you retain, delete with backup controls for continuity.”

• Data residency Report an error

  “Ensure your data is stored in your specified region. Available to Enterprise customers only.”

• Audit logging Report an error

  “Get detailed audit log information about security and safety-related activity in your workspace. Notion can integrate with your DLP or SIEM of choice.”

• Domain management Report an error

  “Claim ownership over an email address domain associated with your workspace, allowing you to control workspace creation and configure connections.”

• Enterprise controls Report an error

  “Enforce SAML SSO, manage encryption keys, automate user provisioning and deprovisioning with SCIM, and apply organization-wide policies for guest access, public sharing, exports, and data retention.”

• Encryption Report an error

  “Your data, encrypted in transit (TLS 1.2 or higher) and at rest (AES-256) with keys rotated regularly.”

• Bug bounty Report an error

  “Notion also maintains a bug bounty program.”

• Incident response Report an error

  “Centralized security information and event management (SIEM) logging and security alerting for 24/7 incident response.”

• Audits Report an error

  “Notion undergoes multiple, annual, industry standard audits including SOC 2, ISO 27001, ISMAP, BSI C5, and more! All audit reports are available on the Notion Trust Center.”

• Penetration testing Report an error

  “Annual, external, third-party performed penetration tests against the Notion Web, Mobile, Desktop and Calendar applications. Penetration tests are available on the Notion Trust Center.”

• Data center audits Report an error

  “An independent, up-to-date audit of data center service providers means your data is protected behind the latest technology and the best physical and technical controls.”

• High availability Report an error

  “Notion’s infrastructure is built on highly available cloud services with multi-region failover capabilities to minimize downtime and provide seamless service continuity in case of localized failures.”

• Backups Report an error

  “Automated cross region backups to protect your data against accidental loss or corruption.”

• Disaster recovery Report an error

  “Notion maintains a comprehensive Disaster Recovery (DR) and Business Continuity Plan (BCP) that is tested annually to verify its effectiveness.”

• AI training data Report an error

  “Customer data is never used to train AI models by Notion or its subprocessors. Controls and permissions over data access and use are strictly enforced.”

• AI security features Report an error

  “Features include prompt-injection guardrails, least-privilege permission enforcement, human-in-the-loop confirmation, hidden-command detection, and OWASP LLM Top 10-aligned adversarial testing.”

• Retention Report an error

  “Notion keeps data only as long as needed to provide our services and meet legal requirements, as documented in our Terms and Privacy.”

• List Report an error

  “Notion works with vetted service providers for infrastructure, analytics, and email. Each subprocessor is bound by contract, assessed for privacy and security, and processes data only under our instructions.”

• ISO privacy Report an error

  “Notion embeds privacy by design across the data lifecycle, with controls aligned to GDPR and CCPA and independently attested to against ISO 27701 and ISO 27018.”

• CCPA Report an error

  “Notion complies with California privacy laws, including CCPA and CPRA, which grant rights such as data access, deletion, and opt-out of data sale.”

• GDPR Report an error

  “Notion is aligned with the General Data Protection Regulation (GDPR), ensuring transparency, accountability, and user control over personal data.”

• HIPAA Report an error

  “Businesses subject to HIPAA can leverage Notion's Enterprise-grade HIPAA security features, with a Business Associate Agreement (BAA) available to Enterprise customers.”

• Security contact Report an error

  “Contact us about security issues: security@makenotion.com”

• Abuse contact Report an error

  “Contact us with platform safety or account-integrity issues: abuse@makenotion.com”

• Entity Report an error

  “© 2026 Notion Labs, Inc.”

Scores citing this record

• The Engineering Lead Permissions, SSO & administration
• The Engineering Lead European sovereignty
• The IT Administrator Verification, ownership & freshness
• The IT Administrator Permissions, SSO & administration
• The IT Administrator European sovereignty
• The Operations Lead Verification, ownership & freshness
• The Operations Lead Permissions, SSO & administration
• The Operations Lead European sovereignty
• The Quality Manager Verification, ownership & freshness
• The Quality Manager Permissions, SSO & administration
• The Quality Manager European sovereignty
• The Skeptic Verification, ownership & freshness
• The Skeptic Permissions, SSO & administration
• The Support Knowledge Manager Permissions, SSO & administration
• The Support Knowledge Manager European sovereignty