Does Notion AI train on your data?
Notion AI by NotionWorkplace suitesVendor's pages read on
Not by default, according to the vendor's published terms.
The vendor states that inputs are not used for training by default on All workspace plans. Read on 12 Nov 2026. The plan your company actually holds, and any negotiated terms, decide what applies to you.
A summary of what the vendor publishes, not legal advice, not an assessment of the vendor and not an endorsement. How this page was made.
What the vendor states, plan by plan
| Plan | Trains on your data | Default retention | Human review of inputs | Single sign-on |
|---|---|---|---|---|
| All workspace plansTeam / business | No | Unknown | Unknown | Yes |
“Unknown” means the vendor's page that would answer this was not read, or could not be opened. It does not mean “no”.
All workspace plans
On All workspace plans, the vendor states that inputs are not used for training. Stated as available: SSO, audit logs and data residency options. Not verified: default retention and human review of inputs.
- Trains on customer data
- No
“By default, neither Notion nor our AI providers use your Customer Data to train any models.”
The vendor states this on notion.com, read on 12 Nov 2026
- Single sign-on (SSO)
- Yes
The page does not say which plans include it.
“Sign in with SSO, add MFA, and enforce role-based and least-privilege permissions.”
The vendor states this on notion.com, read on 12 Nov 2026
- Audit logs
- Yes
The page does not say which plans include it.
“Get detailed audit log information about security and safety-related activity in your workspace.”
The vendor states this on notion.com, read on 12 Nov 2026
- Data residency options
- Available (regions not listed on the page read)
“Ensure your data is stored in your specified region.”
The vendor states this on notion.com, read on 12 Nov 2026
Unknown for this plan: Default retention; Zero-retention option; Deletion on request; Human review of inputs; SCIM provisioning; Admin console; Customer-managed keys.
Attestations and company facts the vendor states
- SOC 2 Type II
- Yes
“Notion AI is in scope for our SOC 2 Type 2 report and ISO 27001 certification”
The vendor states this on notion.com, read on 12 Nov 2026
- ISO/IEC 27001
- Yes
“Notion AI is in scope for our SOC 2 Type 2 report and ISO 27001 certification”
The vendor states this on notion.com, read on 12 Nov 2026
- Model providers used
- Third-party AI providers (named on the vendor's subprocessor page)
“Our contracts with AI providers prohibit them from using your data to train their models”
The vendor states this on notion.com, read on 12 Nov 2026
“Yes” means the vendor's page says so, with the page linked. GhostAudit has not audited the vendor. Scope by product is on the vendor's page.
What remains unknown
- Default retention
- Zero-retention option
- Deletion on request
- Human review of inputs
- SCIM provisioning
- Admin console
- Customer-managed keys
- ISO/IEC 42001
- HIPAA BAA available
- FedRAMP
- GDPR DPA available
- Company headquarters
- Data processing location
None of these was guessed, inferred from another vendor or filled from memory. Ask the vendor, using the list below.
- No DPA found in this review. The vendor pages read for this card did not include a data processing agreement. Many vendors publish one or provide it on request: ask the vendor.
How to check Notion AI in your own company
- 01Find out which plan each account is on. People who signed up with a personal address are on the personal terms, whatever the company bought.
- 02Read the vendor's own page, linked under each fact below, and check that the sentence quoted here is still there. Pages change; the date shows when this one was read.
- 03Compare with your contract or order form. Where a data processing agreement or negotiated terms exist, they take precedence over the public pages.
- 04Record the plan, the setting and the date in your AI inventory, so that the answer exists the next time a customer or auditor asks.
What to ask the vendor
Neutral questions for the points the vendor's public pages left open. Ask for the answer in writing.
- 01How long are prompts, files and outputs kept by default, and can an administrator shorten that period?
- 02Is a zero-retention option available on our plan, and what does it exclude (for example abuse monitoring logs)?
- 03How do we request deletion of our data, and within how many days is it completed, including backups?
- 04Can your staff or contractors read our inputs? In which cases, and is that access logged?
- 05Is SCIM provisioning available, so that leavers lose access automatically?
- 06Is there an administrator console where data controls can be set for every account in our organisation?
- 07Can we hold the encryption keys for our data?
- 08Is this product in the scope of an ISO/IEC 42001 certificate?
- 09Do you sign a business associate agreement, and for which plans?
- 10Do the statements on your public pages apply to our contract as written, or do negotiated terms override them?
Questions about Notion AI
- Does Notion AI train on your data?
- Not by default, according to the vendor's published terms. The vendor states that inputs are not used for training by default on All workspace plans. Read on 12 Nov 2026. The plan your company actually holds, and any negotiated terms, decide what applies to you.
- Is Notion AI safe to use at work?
- GhostAudit does not rate tools. Whether Notion AI is acceptable for your company depends on the plan you hold, the data people put into it and your own policy. This page records what the vendor states, with the wording and the source, so that decision can be made on facts: All workspace plans: no (training on customer data).
- Which attestations does the vendor of Notion AI state?
- The vendor's pages state: SOC 2 Type II and ISO/IEC 27001. This is the vendor's statement, with the page linked; GhostAudit has not audited the vendor, and the scope by product is on the vendor's page.
- When were these facts checked, and how do I report an error?
- The vendor's pages were read on 12 Nov 2026. Every quotation was checked against the stored text of its source page on that date. To report an inaccuracy, email [email protected] with the page that shows the current wording.
How this page was made, and how to correct it
Every fact above is a statement found on a page Notion itself publishes. The page was fetched and reduced to text, the statement was recorded with its exact wording, and the quotation was checked against the stored text of the page. Quotations are at most 25 words. Search results, blogs and third-party summaries were not used.
These are summaries of statements the vendor publishes, as read on the date shown. They are not legal advice, not an assessment of the vendor and not an endorsement. Vendors change their terms: open the linked source and check your own contract before you rely on a statement.
Found an error, or are you the vendor? Report an inaccuracy with the page that shows the current wording. The page is re-read; the fact, its quotation and its date are corrected, or the fact is set to unknown if the page cannot be opened. The full method.
The vendor's official pages
- Trust centrenotion.com
Notion AI is a product of Notion. GhostAudit is not affiliated with, endorsed by or sponsored by Notion.
Is Notion AI in use at your company, and on which plan?
GhostAudit shows which AI tools your people use, from Google Workspace or Microsoft 365 and from the browser, and sets each one beside the terms on this page. It records tool names and time, never prompts.