Vendor record · notion.com
What Notion promises about your data.
Where Notion publishes its promises, how long it gives you when it adds a sub-processor, and what has changed.
- Where it publishes
Notion lists its sub-processors at trust.notion.com/subprocessors. We last read it on October 15, 2026.
- What has changed
We've recorded no change to its sub-processor list or data processing agreement between September 10, 2026 and September 15, 2026. Subscribers hear about a change the morning we read it; the public record shows it 30 days later.
- Its window
We couldn't quote a notice window: we haven't found a data processing agreement from Notion anywhere we've looked.
- Window
- —
- Sub-processors
- 33
- Pages
- 4
- Copies
- 15
no window we can quote yet
sub-processors named
pages we watch
dated copies of all its pages, since August 31, 2026
Notion DPA
We have not found a data processing agreement published by Notion anywhere we looked. There is no sub-processor notice window we can quote.
How it says it sends notice
“How do I subscribe to new Subprocessor notifications? Customers may sign up to receive notification of new Subprocessors by e-mailing [email address on the vendor's page] with the subject “Subscribe to New Subprocessors.” Infrastructure Hosting and storage systems that store and process data within the Service.”
trust.notion.com/subprocessors · read 2026-09-30
Notion sub-processors
Notion publishes a sub-processor list at trust.notion.com/subprocessors; we last read it on October 15, 2026. It names 33 entries. The first 15, as the list prints them: Amplitude; Anthropic; Anysource Inc., dba Runlayer; AWS; Baseten Labs, Inc.; Brain Capital Labs PVT Ltd.; Cerebras Systems Inc.; Cloudflare; Confluent; Customer; DeepL; Exa; Fireworks; Fivetran; Google LLC; and 18 more in the full table below. The public record holds no change to the list read before September 15, 2026. A change we read after September 15, 2026 is published 30 days after we read it.
33 named · full table
Every public change we have recorded · Where vendors publish their lists
How long Notion keeps your data
Notion's sub-processor list (trust.notion.com/subprocessors, in the copy read September 30, 2026) says: “AI embeddings are deleted within 60 days of page or workspace deletion.”
Training on customer data
“These reviews follow the same rigorous security practices applied to the rest of the platform. ### Data Governance Customer data is never used to train AI models by Notion or its subprocessors.”
notion.com/security · read 2026-10-13
Training on customer data
“We do not process Workspace API user data to develop, improve, or train generalized AI and/or ML models.”
www.notion.com/trust/privacy-policy · read 2026-10-13
Training on customer data
“No customer data for AI training User data is never used to train or influence Notion AI models.”
trust.notion.com/subprocessors · read 2026-09-30
Training on customer data
“Notion and its AI subprocessors have contractual agreements prohibiting the use of customer data for model training.”
trust.notion.com/subprocessors · read 2026-09-30
Retention windows vendors publish · What vendors say about training
What the pages say
Read automatically from the pages below and shown as printed. A missing row is a gap in our reading, not proof it isn’t there.
Sub-processors named · 33 · 6 name an AI provider we list
Amplitude
Event logging for analytics.
USA
AnthropicAI · Anthropic
Global
Anysource Inc., dba Runlayer
Security for MCP connections.
USA
AWS
Hosting and storage systems provider.
USA, European Union, Korea, Japan
Baseten Labs, Inc.AI · Baseten
Service provider for hosting large language models and embeddings.
Global
Brain Capital Labs PVT Ltd.
Support services.
India
Cerebras Systems Inc.AI · Cerebras
Service provider for hosting large language models and embeddings.
USA
Cloudflare
Content distribution and processing, security, abuse prevention and DNS services.
Global
Confluent
Kafka managed streaming storage platform used for in-product audit log data and analytics.
USA, Germany, Korea, Japan
Customer
Transactional, broadcast, and marketing messaging.
USA
DeepL
Translation services.
USA
Exa
Service provider for providing web search results.
USA
FireworksAI · Fireworks AI
Service provider for hosting large language models and embeddings.
Global
Fivetran
Data pipeline for connecting systems to our data warehouse.
USA, Germany, Korea, Japan
Google LLC
Global
Mailgun
Transactional, broadcast, and marketing messaging.
USA
Mathpix, Inc.
PDF file conversion.
USA, Germany, Singapore
Notion Labs, Inc
Certificate of Amendment of Articles of Incorporation
Notion Labs Australia Pty Ltd
Support services.
Australia
Notion International Inc.
Support services.
USA
Notion Labs, Ireland Limited
Support services.
Ireland
Notion Labs Japan, G.K.
Support services.
Japan
Notion Labs Korea Ltd
Support services.
South Korea
Notion Labs United Kingdom, Private Limited
Support services.
UK
OpenAIAI · OpenAI
Global
Parallel Web Systems
USA
Splunk
Security and application logging.
USA
StarTree, Inc.
Storage platform used for in-product analytics.
USA, Germany, Korea, Japan
Teleperformance
Support services.
Greece
Turbopuffer
Vector database for storing embeddings.
USA, Germany, Korea, Japan
Twilio
Multi-factor Authentication.
USA
Vercel Inc.
Compute services that enable code execution and AI agent actions.
USA
X.AI LLCAI · xAI
Service provider for hosting large language models and embeddings.
USA, UK
Certifications the trust page names · BSI C5 · ISO 27001 · ISO 27018 · ISO 27701 · SOC 2
Laws the trust page names · GDPR · HIPAA
International transfer notice · United States
“International data transfers All information processed by us may be transferred, processed, and stored anywhere in the world, including but not limited to, the United States or other countries, which may have data protection laws that are different from the laws where you live.”
www.notion.com/trust/privacy-policy · read 2026-10-13
The pages' own stamps: effective 2025-04-10 · Last Updated 2025-09-29
The pages we watch
Every page we read, so you can check it. Each is re-read on a schedule, and we keep a dated copy when it changes.
Where we get nothing
What Notion does not publish where we can read it
Of the 4 public pages we watch for Notion, these give us nothing right now.
Changelog
the page at that URL is not that document
notion.com/changelogTerms of service
the page returned too little text to be the document — usually a shell rendered by a script we cannot run
notion.com/termsData processing agreement
we have not found one published anywhere we looked
Before you conclude anything
This only means we couldn’t read it on a public page. Notion may share it in its agreement, a trust portal, or with any customer who asks.
So treat it as a question to ask them: “Can you send your sub-processor list, and tell us when it changes?”
What this page doesn’t tell you
No score.
Nothing here rates Notion. A short notice window is a contract term, not a criticism.
Public pages only.
Private notices and negotiated terms are invisible to us. Your agreement may say something different.
Wrong? Tell us.
Corrections are free, always. We reply within 2–3 business days.
How we read a page · The change log
Work at Notion? With an email at notion.com you can claim this record, suggest pages we should watch, and take a free copy of it. Claiming changes nothing we publish.
Is Notion in your product? Hear the morning we read a change.
You get the lines that moved, in Notion’s own words, and the date any window closes. No card. Nothing to cancel.