Security @ Notion

Authentication & Access Controls

Sign in with SSO, add MFA, and enforce role‑based and least‑privilege permissions.

Your Data, Your Rules

You decide what data to enter into the platform, what you retain, delete with backup controls for continuity.

Data Residency

Ensure your data is stored in your specified region. Available to Enterprise customers only.

Audit Logging

Get detailed audit log information about security and safety-related activity in your workspace. Notion can integrate with your DLP or SIEM of choice.

Domain Management

Claim ownership over an email address domain associated with your workspace, allowing you to control workspace creation and configure connections.

Enterprise Ready Controls

Enforce SAML SSO, manage encryption keys, automate user provisioning and deprovisioning with SCIM, and apply organization-wide policies for guest access, public sharing, exports, and data retention.⁠

Industry Standard Encryption

Your data, encrypted in transit (TLS 1.2 or higher) and at rest (AES-256) with keys rotated regularly.

Strict Access Controls

Least privilege access based on role, business need, and need-to-know coupled with time-bound access, reviewed frequently.

Robust Vulnerability Management

Regular vulnerability management via scanning, package monitoring, and patching. Notion also maintains a bug bounty program.

24/7 Incident Response

Defense-in-depth monitoring using network and host-based IDS/IPS. Centralized security information and event management (SIEM) logging and security alerting for 24/7 incident response.

SDLC

Secure software development lifecycle (SDLC) with threat modeling, secure design reviews, code analysis and review, and security testing to ensure changes are managed and deployed securely.

Employee Security

Background checks and ongoing security training so every Notion teammate helps keep your data safe.

Environment Separation

Separate development, testing, and production environments. Customer data is logically separated.

Strong Technical Controls

Web Application Firewalls (WAF) and Distributed denial of service (DDoS) protection through third-party services.

Defense-in-depth monitoring using network and host-based IDS/IPS.

Endpoint Security

Managed employee devices through centralized mobile device management (MDM) system allowing for remote wipe and block capabilities.

Audit and Compliance

Notion undergoes multiple, annual, industry standard audits including SOC 2, ISO 27001, ISMAP, BSI C5, and more! All audit reports are available on the Notion Trust Center.

Annual Penetration Testing

Annual, external, third-party performed penetration tests against the Notion Web, Mobile, Desktop and Calendar applications. Penetration tests are available on the Notion Trust Center.

SOC 2 data center certification

An independent, up-to-date audit of data center service providers means your data is protected behind the latest technology and the best physical and technical controls.

Redundancy

Notion’s infrastructure is built on highly available cloud services with multi-region failover capabilities to minimize downtime and provide seamless service continuity in case of localized failures.

Backups

Automated cross region backups to protect your data against accidental loss or corruption.

Disaster Recovery and Business Continuity

Notion maintains a comprehensive Disaster Recovery (DR) and Business Continuity Plan (BCP) that is tested annually to verify its effectiveness.

Third-party Management

AI features and partners are reviewed for security and legal compliance before being used in Notion. These reviews follow the same rigorous security practices applied to the rest of the platform.

Data Governance

Customer data is never used to train AI models by Notion or its subprocessors. Controls and permissions over data access and use are strictly enforced.

AI Security

Features include prompt-injection guardrails, least-privilege permission enforcement, human-in-the-loop confirmation, hidden-command detection, and OWASP LLM Top 10-aligned adversarial testing.

Data retention & deletion

Notion keeps data only as long as needed to provide our services and meet legal requirements, as documented in our Terms and Privacy.

Subprocessors

Notion works with vetted service providers for infrastructure, analytics, and email. Each subprocessor is bound by contract, assessed for privacy and security, and processes data only under our instructions.

Privacy-by-Design

Notion embeds privacy by design across the data lifecycle, with controls aligned to GDPR and CCPA and independently attested to against ISO 27701 and ISO 27018.

CCPA

Notion complies with California privacy laws, including CCPA and CPRA, which grant rights such as data access, deletion, and opt-out of data sale.

GDPR

Notion is aligned with the General Data Protection Regulation (GDPR), ensuring transparency, accountability, and user control over personal data.

HIPAA and HITECH

Businesses subject to HIPAA can leverage Notion's Enterprise-grade HIPAA security features, with a Business Associate Agreement (BAA) available to Enterprise customers.