Notion
Security and trust center evidence
Build Custom Agents, search across all your apps, and automate
Summary
Notion has 11 vendor-stated rows, and 1 expired in the CertReports index, last verified 3 Nov 2026. The strongest row is HIPAA: Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured). This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.
Reviewer brief
Notion states on its trust centre that it holds SOC 2 Type II and SOC 3 reports, as of 21 Sep 2026. Notion also states on its trust centre that it holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 27017 and ISO/IEC 27018 certifications, as of 21 Sep 2026. Notion states on its trust centre that it displays a HIPAA badge, though BAA availability is not confirmed by the evidence, as of 21 Sep 2026. Notion states on its trust centre that it addresses GDPR, CCPA/CPRA, PCI Merchant status and BSI C5, as of 21 Sep 2026. Notion's EU-US Data Privacy Framework registry listing is marked inactive as of 17 Sep 2026.
- States on its trust centre that it holds SOC 2 Type II, SOC 3, ISO/IEC 27001, 27701, 27017 and 27018, as of 21 Sep 2026
- States on its trust centre that it displays a HIPAA badge; BAA availability is not confirmed, as of 21 Sep 2026
- EU-US Data Privacy Framework registry listing is inactive as of 17 Sep 2026
Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 22 Sep 2026; it is regenerated whenever a row changes.
Among collaboration vendors
0verified rows
Category median 1, across 95 indexed collaboration vendors. Notion has no registry-verified row yet, like 42 percent of them; its evidence is vendor-stated or reported.
ai workspacecollaborationnotesproject managementwiki
Compare with similar vendors
Pick your own comparisonCompliance grid
- HIPAAVendor-stated
Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured)
as of 3 Nov 202623 sources
SOC 2Vendor-statedVendor states SOC 2 Type II on its trust centre
as of 3 Nov 202623 sources- GDPRVendor-stated
Vendor states GDPR on its trust centre
as of 3 Nov 202623 sources
PCI DSSVendor-statedVendor states PCI Merchant on its trust centre
as of 3 Nov 202623 sources
ISO/IEC 27001Vendor-statedVendor states ISO 27001 on its trust centre
as of 3 Nov 202623 sources
ISO/IEC 27701Vendor-statedVendor states ISO 27701 on its trust centre
as of 3 Nov 202623 sources
SOC 3Vendor-statedVendor states SOC 3 on its trust centre
as of 3 Nov 202623 sources
ISO/IEC 27017Vendor-statedVendor states ISO 27017 on its trust centre
as of 3 Nov 202623 sources
ISO/IEC 27018Vendor-statedVendor states ISO 27018 on its trust centre
as of 3 Nov 202623 sources
EU-US Data Privacy FrameworkExpiredInactive
as of 2 Nov 20261 source- CCPA / CPRAVendor-stated
Vendor states CCPA on its trust centre
as of 3 Nov 202623 sources
BSI C5Vendor-statedVendor states C5 on its trust centre
as of 3 Nov 202623 sources
No public evidence yet for FedRAMP, CSA STAR, Cyber Essentials, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.
Legal artefacts
Subprocessors (31)
AnthropicService provider for AI agents, hosting large language models and embeddings, and for abuse prevention. · Global
AssemblyAITranscription services. · USA
AWSHosting and storage systems provider. · USA, European Union, Korea, Japan- BABasetenCompute infrastructure for serving large language models and powering AI services. · Global
- BRBrowserbaseService provider for browser-based web access and automation for AI agents. · USA, Spain
- CSCerebras Systems Inc.Service provider for hosting large language models and embeddings. · USA
- CICinderService provider for abuse prevention. · USA
CloudflareContent distribution and processing, security, abuse prevention and DNS services. · Global
ConfluentKafka managed streaming storage platform used for in-product audit log data and analytics. · USA, Germany, Korea, Japan- CustomerTransactional, broadcast, and marketing messaging. · USA
- DTDeepL TranslateTranslation services. · USA
ExaService provider for providing web search results. · USA
FireworksCompute infrastructure for serving large language models and powering AI services. · Global
FivetranData pipeline for connecting systems to our data warehouse. · USA, Germany, Korea, Japan
Google CloudService provider for hosting large language models and embeddings and for abuse prevention. · Global
MailgunTransactional, broadcast, and marketing messaging. · USA- MAMathpixPDF file conversion. · USA, Germany, Singapore
- MLModal LabsCompute infrastructure for serving large language models and powering AI services. · Global
NotionSupport services. · India
OpenAIService provider for hosting large language models and embeddings and for abuse prevention. · Global- PWParallel Web SystemsService provider for providing web search results and for hosting large language models and embeddings. · USA
PlanetScaleHosting and management of large-scale databases. · USA, Germany, Japan- RURunlayerSecurity for MCP connections. · USA
SplunkSecurity and application logging. · USA- SIStarTree, Inc.Storage platform used for in-product analytics. · USA, Germany, Korea, Japan
- TeleperformanceSupport services. · Greece
- TUTurbopufferVector database for storing embeddings. · USA, Germany, Korea, Japan
- TwilioMulti-factor Authentication. · USA
- TATypeSafe AIService provider for hosting structured classification and other models. · Global
VercelCompute services that enable code execution and AI agent actions. · USA
XAIService provider for hosting large language models and embeddings. · USA, UK
Security profile
Displayed as a security profile from public statements, not as attestations, as of 3 Nov 2026.
Change history
- 31 Oct 2026Subprocessor added: AssemblyAIAssemblyAI appeared on the subprocessor list.
- 31 Oct 2026Subprocessor added: BrowserbaseBrowserbase appeared on the subprocessor list.
- 31 Oct 2026Subprocessor added: CinderCinder appeared on the subprocessor list.
- 31 Oct 2026Subprocessor added: Modal LabsModal Labs appeared on the subprocessor list.
- 31 Oct 2026Subprocessor added: PlanetScalePlanetScale appeared on the subprocessor list.
- 31 Oct 2026Subprocessor added: TypeSafe AITypeSafe AI appeared on the subprocessor list.
- 31 Oct 2026Subprocessor removed: AmplitudeAmplitude left the subprocessor list.
- 20 Sep 2026Subprocessor added: MathpixMathpix appeared on the subprocessor list.
- 20 Sep 2026Subprocessor added: NotionNotion appeared on the subprocessor list.
- 20 Sep 2026Subprocessor added: OpenAIOpenAI appeared on the subprocessor list.
Similar vendors with evidence
Related by product tags and the Collaboration category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.
Taskworld
Collaboration
Taskworld is a cloud-based collaboration platform created by Fred Mouawad
Aprimo
Collaboration
Discover Aprimo, the leading platform for agentic digital asset management and content
zencoder
Collaboration
Discover Zencoder's AI Coding Agent Platform for seamless code execution and
Kahua
Project management
Kahua, Inc. provides an industry-leading cloud-based collaborative platform specifically designed to transform and elevate project management across the c...
Evidence against regulations
All regulations for NotionHow much of each regulation’s vendor requirements Notion’s public evidence reaches.
Reviewing a vendor on public evidence
All articlesWhat Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
What Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read