AI tool register · Workspace
Is Notion AI safe for your firm’s workspace?
Notion says it does not train on customer content on any plan. Notion AI follows existing permissions, so it can use anything the person asking can already open. Outside the Enterprise plan, the AI providers Notion uses can keep data for up to 30 days.
PlanTrains on your content
- Free, Plus, BusinessNo
- EnterpriseNo
Read October 5, 2026Notion
What Notion AI does with your data, plan by plan
Free, Plus, Business
No
By default, Notion and its AI subprocessors do not use customer data to train models. Notion says its contracts with AI providers prohibit training on customer data. Source (opens in a new tab)
- How long it is kept
- Outside AI providers may keep customer data for up to 30 days. Deleted pages can be restored for 30 days, then are deleted. Embeddings are deleted within 60 days of page deletion.
- Admin controls
- Workspace owners can turn AI web search on or off and require confirmation for web requests. Business adds SAML SSO. The pricing page lists SCIM and audit log under Enterprise only.
Enterprise
No
By default, Notion and its AI subprocessors do not use customer data to train models. Notion says its contracts with AI providers prohibit training on customer data. Source (opens in a new tab)
- How long it is kept
- By default, AI providers store no customer data for Enterprise workspaces. Custom data retention settings are available. Deleted pages can be restored for 30 days.
- Admin controls
- SAML SSO, SCIM, audit log, granular admin roles, domain management, admin content search, custom data retention settings, and data loss prevention alerts through third-party integrations.
Where your data is stored
Stored in the United States by default, on Amazon Web Services. Enterprise can request storage at rest in Frankfurt, Tokyo, or Seoul. Data processed by subprocessors may be stored outside the chosen region.
Source (opens in a new tab)Attestations
What the vendor has had audited
Notion AI is included in the scope of Notion's SOC 2 Type 2 report and ISO 27001 certification.
Source (opens in a new tab)Worth knowing
What to watch for
Outside the Enterprise plan, outside AI providers can keep customer data for up to 30 days. Providers storing no data is the default only on Enterprise.
Source (opens in a new tab)Notion AI creates an embedding for each page in the workspace using an OpenAI embeddings API with no data retention, and stores the embeddings in a vector database such as Turbopuffer.
Source (opens in a new tab)Notion AI honors existing permissions. It can use any workspace content the person asking already has access to.
Source (opens in a new tab)Data residency covers page content, uploaded files, and the search index at rest. It does not cover data processed by subprocessors, Notion Calendar, or Notion Mail.
Source (opens in a new tab)
Our take
For a firm of 15 to 200 people
Low risk if your workspace permissions are in order, since the AI sees what the person sees. If client material lives in Notion, the 30-day retention by outside providers below Enterprise is the thing to weigh.
This is our reading of the facts above, not a rating. We have no product to sell and take no referral fee from any vendor.
Compare and decide
How this was checked
Every fact on this page is taken from Notion’s own documentation as it read on . Vendors change these terms often, sometimes monthly. Check the linked page before you rely on it.
Your brief · 1 of 3
What brings you here?
See what we’d build first at a firm like yours.
A tool we haven’t covered?
Run the same questions on it yourself with the vendor risk assessment template.