Built from public records and checked 2026-10-22. Not an audit of Notion. How scores are made · spotted a mistake? Tell us.

SaaS products

Notion

Connected workspace for docs, wikis and projects · Score 84/100 · Last checked 2026-10-22

The short version

Be careful what documents the AI features can read, and which workspace content is shared with them.

Built from: public records, checked 2026-10-22.

Score breakdown

Security record84

Documented incidents and safeguards (public record, not a technical test)

Data jurisdiction88

Which laws and governments can reach your data

Ownership transparency72

How plainly the owner can be traced

Third-party exposure92

Documented analytics, advertising and attribution partners

Who owns it

Notion→Notion Labs, Incorporated

Parent based in: 🇺🇸 United States

Laws that can apply: US CLOUD Act, FISA 702

Where your data can go

The company does not name its data partners anywhere we could read automatically. That is a gap in the record, not a clean result.

Jurisdictions touched: 🇺🇸 United States

What the public record says

mediumResearchers showed data exfiltration through the Notion 3.0 AI agent

In September 2025 researchers reported that a hidden-text PDF could make the agent send workspace data out through its web-search tool. Source

lowAI providers may keep data for up to 30 days on non-Enterprise plans

Notion says that on Free, Plus and Business plans the AI provider retains data for 30 days or fewer. By default customer data is not used to train models. Source

good to knowSOC 2 Type II and ISO 27001 cited by Notion

Notion's March 2026 post says its controls align with SOC 2 Type II, ISO 27001 and ISO 27701. Claims are Notion's own. Source

Sources

Ownership, locations and data partners come from the company's own pages and filings where they exist. Last checked 2026-10-22.