Skip to main content
Notion logo

Notion

Security and trust center evidence

Build Custom Agents, search across all your apps, and automate

notion.soCollaborationLast verified 3 Nov 2026

Summary

Notion has 11 vendor-stated rows, and 1 expired in the CertReports index, last verified 3 Nov 2026. The strongest row is HIPAA: Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured). This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

Notion states on its trust centre that it holds SOC 2 Type II and SOC 3 reports, as of 21 Sep 2026. Notion also states on its trust centre that it holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 27017 and ISO/IEC 27018 certifications, as of 21 Sep 2026. Notion states on its trust centre that it displays a HIPAA badge, though BAA availability is not confirmed by the evidence, as of 21 Sep 2026. Notion states on its trust centre that it addresses GDPR, CCPA/CPRA, PCI Merchant status and BSI C5, as of 21 Sep 2026. Notion's EU-US Data Privacy Framework registry listing is marked inactive as of 17 Sep 2026.

  • States on its trust centre that it holds SOC 2 Type II, SOC 3, ISO/IEC 27001, 27701, 27017 and 27018, as of 21 Sep 2026
  • States on its trust centre that it displays a HIPAA badge; BAA availability is not confirmed, as of 21 Sep 2026
  • EU-US Data Privacy Framework registry listing is inactive as of 17 Sep 2026

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 22 Sep 2026; it is regenerated whenever a row changes.

Among collaboration vendors

0verified rows

Category median 1, across 95 indexed collaboration vendors. Notion has no registry-verified row yet, like 42 percent of them; its evidence is vendor-stated or reported.

ai workspacecollaborationnotesproject managementwiki

Compliance grid

Subprocessors (31)

  • Anthropic logo
    AnthropicService provider for AI agents, hosting large language models and embeddings, and for abuse prevention. · Global
  • AssemblyAI logo
    AssemblyAITranscription services. · USA
  • AWS logo
    AWSHosting and storage systems provider. · USA, European Union, Korea, Japan
  • BA
    BasetenCompute infrastructure for serving large language models and powering AI services. · Global
  • BR
    BrowserbaseService provider for browser-based web access and automation for AI agents. · USA, Spain
  • CS
    Cerebras Systems Inc.Service provider for hosting large language models and embeddings. · USA
  • CI
    CinderService provider for abuse prevention. · USA
  • Cloudflare logo
    CloudflareContent distribution and processing, security, abuse prevention and DNS services. · Global
  • Confluent logo
    ConfluentKafka managed streaming storage platform used for in-product audit log data and analytics. · USA, Germany, Korea, Japan
  • Customer logo
    CustomerTransactional, broadcast, and marketing messaging. · USA
  • DT
    DeepL TranslateTranslation services. · USA
  • Exa logo
    ExaService provider for providing web search results. · USA
  • Fireworks logo
    FireworksCompute infrastructure for serving large language models and powering AI services. · Global
  • Fivetran logo
    FivetranData pipeline for connecting systems to our data warehouse. · USA, Germany, Korea, Japan
  • Google Cloud logo
    Google CloudService provider for hosting large language models and embeddings and for abuse prevention. · Global
  • Mailgun logo
    MailgunTransactional, broadcast, and marketing messaging. · USA
  • MA
    MathpixPDF file conversion. · USA, Germany, Singapore
  • ML
    Modal LabsCompute infrastructure for serving large language models and powering AI services. · Global
  • Notion logo
    NotionSupport services. · India
  • OpenAI logo
    OpenAIService provider for hosting large language models and embeddings and for abuse prevention. · Global
  • PW
    Parallel Web SystemsService provider for providing web search results and for hosting large language models and embeddings. · USA
  • PlanetScale logo
    PlanetScaleHosting and management of large-scale databases. · USA, Germany, Japan
  • RU
    RunlayerSecurity for MCP connections. · USA
  • Splunk logo
    SplunkSecurity and application logging. · USA
  • SI
    StarTree, Inc.Storage platform used for in-product analytics. · USA, Germany, Korea, Japan
  • Teleperformance logo
    TeleperformanceSupport services. · Greece
  • TU
    TurbopufferVector database for storing embeddings. · USA, Germany, Korea, Japan
  • Twilio logo
    TwilioMulti-factor Authentication. · USA
  • TA
    TypeSafe AIService provider for hosting structured classification and other models. · Global
  • Vercel logo
    VercelCompute services that enable code execution and AI agent actions. · USA
  • XAI logo
    XAIService provider for hosting large language models and embeddings. · USA, UK

Security profile

Displayed as a security profile from public statements, not as attestations, as of 3 Nov 2026.

Change history

  1. 31 Oct 2026Subprocessor added: AssemblyAIAssemblyAI appeared on the subprocessor list.
  2. 31 Oct 2026Subprocessor added: BrowserbaseBrowserbase appeared on the subprocessor list.
  3. 31 Oct 2026Subprocessor added: CinderCinder appeared on the subprocessor list.
  4. 31 Oct 2026Subprocessor added: Modal LabsModal Labs appeared on the subprocessor list.
  5. 31 Oct 2026Subprocessor added: PlanetScalePlanetScale appeared on the subprocessor list.
  6. 31 Oct 2026Subprocessor added: TypeSafe AITypeSafe AI appeared on the subprocessor list.
  7. 31 Oct 2026Subprocessor removed: AmplitudeAmplitude left the subprocessor list.
  8. 20 Sep 2026Subprocessor added: MathpixMathpix appeared on the subprocessor list.
  9. 20 Sep 2026Subprocessor added: NotionNotion appeared on the subprocessor list.
  10. 20 Sep 2026Subprocessor added: OpenAIOpenAI appeared on the subprocessor list.

Similar vendors with evidence

Related by product tags and the Collaboration category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.

Evidence against regulations

All regulations for Notion

How much of each regulation’s vendor requirements Notion’s public evidence reaches.

All articles