Vendor Privacy Scorecard · Notion
Notion AI: is it safe for client information?
AI writing, search and summaries inside Notion workspaces.
Bottom line
Solid on Business and Enterprise. Confirm the BAA before storing health information.
Does it train on your data? By plan
All paid plans: No training
Notion states customer data is not used to train models, and AI subprocessors are bound by the same terms.
Enterprise: No training
Adds zero data retention with AI providers and admin controls.
What an auditor will ask
- Trains AI on your data? No
- Not used for training.
- Retention you can control? Depends on plan
- Enterprise includes zero retention with AI subprocessors.
- Signs a HIPAA BAA? Depends on plan
- Notion offers a BAA on Enterprise plans.
- Staff may read your content? No
- Not reviewed for training.
Security certifications
- SOC 2 Type II
- ISO/IEC 27001
- ISO/IEC 27701
Set it up the safe way
- Use a Business or Enterprise workspace for client work.
- Sign the BAA first if any health information is stored.
- Limit which pages AI can search through workspace permissions.
Notion trust centerBusiness privacy terms
Summarized from Notion's published terms, last checked 10/1/2026. Vendors change terms. Confirm every point against the agreement you actually signed. This is not legal advice.
Using Notion AI at work? An unvetted tool can cost you your license.
When an employee pastes client information or confidential files into Notion AI without the correct safeguards, licensing boards and regulatory bodies hold you responsible. AI Governance Rule Watch™ documents your approved tool roster, vendor reviews, and staff guidelines in permanent diligence records ready for any audit.
Founding member rate. Cancel anytime. Plus applicable taxes. Renews until canceled. Not legal advice and not a compliance certification.