Does Notion AI train on your workspace? Training is off by default, one of the better consumer defaults here; its AI providers keep your content for 30 days or fewer on Free, Plus and Business, and most models on Enterprise keep none.
Plain-English risk rating: 2 of 5 (Free/Plus/Business) / 1 of 5 (Enterprise with zero-retention APIs)
Notion AI's risk profile is dominated by one fact most users do not understand: when you use Notion AI, your content is sent to third-party LLM providers (Anthropic and OpenAI primarily) for processing. Notion itself does not train on customer data by default — but "Notion doesn't train" and "your data doesn't leave Notion" are different statements. Notion's pricing page states that on Free, Plus and Business plans its AI providers keep request data for 30 days, and that on Enterprise “our LLM providers utilize zero data retention”. That zero retention is at the providers: Notion still keeps your workspace, including AI outputs, under its own retention. Corrected 3 October 2026.
This is the same architectural pattern as Slack AI, ZoomMate, and most other Embedded Productivity AI products: the embedding company provides the workflow, third-party LLMs provide the inference, and the privacy posture depends on the contractual arrangement between the embedding company and the LLM provider plus the customer's plan tier.
Recommended for
- Sole proprietor: Plus or Business, understanding that AI requests are processed by third-party model providers. Notion now publishes the provider retention period: 30 days or fewer on Free, Plus and Business (Notion AI security page, read 23 October 2026). Updated 23 October 2026: this line said Notion did not publish one, and that the 30 days we had once stated was unsupported. Acceptable for general knowledge work; not appropriate for confidential client information without the Enterprise tier or a separate workflow.
- Small team (2-10 people): Business tier is acceptable for general team work. Enterprise tier with BAA available for HIPAA-covered workflows.
- Regulated industry: Enterprise tier only, with zero-retention APIs, BAA where applicable, and explicit policy guidance to team members about which content classes belong in Notion vs. dedicated regulated-data systems.
- The honest answer for most 1-10 employee businesses using Notion as their company wiki: The Business tier at US$20 a member a month is the practical floor, and the first plan with Notion AI included. The Enterprise tier upgrade (custom pricing) is the right move if any of your Notion content includes information that would be materially damaging if it sat on Anthropic's or OpenAI's systems for up to 30 days.
Data retention default
- Free, Plus, Business: AI providers (Anthropic, OpenAI) keep request data for 30 days (Notion pricing page, read 3 October 2026)
- Enterprise: the LLM providers use zero data retention, so they keep no request data
- Notion-side retention: Notion keeps your workspace content, including AI outputs, under its own data lifecycle on every plan. Enterprise adds custom data retention settings (when pages are deleted from Trash and how long they are kept afterwards) and scheduled deletion of AI meeting transcripts. Corrected 3 October 2026: this line previously said the same lifecycle applied regardless of plan.
- AI LEAP Program (opt-in): Customers who join receive front-of-line access to AI improvements in exchange for sharing workspace data for model improvement — default OFF, opt-in only
Training opt-out
TRAINING IS OFF BY DEFAULT across all plan tiers. Notion does not use customer workspace data for training its models, and the contractual agreements with Anthropic and OpenAI prohibit those providers from using Notion customer data for their own model training.
AI LEAP Program is the opt-in alternative — customers who actively choose to participate share workspace data for model improvement in exchange for early-access perks. Off by default; opt-in only.
The training-off-by-default posture is structurally similar to Jasper and meaningfully better than the Slack general-purpose ML default. Provider retention of up to 30 days on the non-Enterprise tiers is the remaining concern. Band 3 on our scale describes training on by default with an opt-out available; Notion does not train on customer data on any tier, so that band does not fit. What remains is third-party processing with providers keeping data for up to 30 days, which is what band 2 describes. (Updated 23 October 2026: Notion now publishes that period; it said nothing before.)
It is in the contract. Notion’s AI and Notion Credit Supplementary Terms (last updated 27 July 2026), which form part of its Master Subscription Agreement and Personal Use Terms, say: “Notion does not use your Customer Data or permit others to use your Customer Data to train the artificial intelligence and machine learning models used to provide Notion AI.” The same terms keep two exceptions: Notion may use data to improve its models when you give feedback, such as a thumbs up or thumbs down on an answer, or give permission. (Read 25 October 2026.)
Zero Data Retention availability
- Enterprise tier only: Notion says “most models we use offer zero data retention”; models without it are off by default and the workspace owner must opt in (read 23 October 2026), plus the SOC 2 Type 2 certified Turbopuffer vector database for AI Connector embeddings
- HIPAA compliance enabled through zero-retention APIs for Enterprise customers with a Business Associate Agreement
Plan tiers and pricing (read 24 October 2026 from notion.com/pricing)
| Tier | Price (USD) | AI provider retention | Training? | Suitable for |
|---|---|---|---|---|
| Free | $0 | 30 days | No | Personal use; Notion AI as a limited trial only |
| Plus | $10/member/month | 30 days | No | Individual professionals; Notion AI as a limited trial only |
| Business | $20/member/month | 30 days | No | Small teams; the first plan with Notion AI included (Notion Agent, AI Meeting Notes, Enterprise Search beta) |
| Enterprise | Custom | Zero retention | No | Larger orgs or regulated workflows |
Notion AI is included from the Business plan up; Free and Plus get a limited trial. Notion's pricing page says Free, Plus and Business workspaces have 30-day retention with LLM providers, and Enterprise workspaces zero data retention; its AI security page says “30 days or fewer”. Corrected 25 October 2026: this table previously gave Business at US$15, showed provider retention as “Not published” on the lower plans, and implied AI was included on every paid plan.
Jurisdiction
- Primary processor: Notion Labs, Inc., San Francisco, California, USA
- Cloud infrastructure: AWS primarily
- AI inference: OpenAI for embeddings (zero retention), Anthropic for LLM queries (Enterprise: zero retention for most models, non-zero-retention models off by default; Free, Plus and Business: providers keep data for 30 days or fewer, per Notion’s AI security page read 23 October 2026)
- Vector database: Turbopuffer (SOC 2 Type 2 certified)
- SOC 2 Type 2, ISO 27001:2022 certified; HIPAA compliant for Enterprise with BAA; GDPR and CCPA compliant
Breach history (public incidents)
No major direct breach of Notion infrastructure publicly disclosed as of May 2026.
Note on third-party processor risk inheritance: Notion AI inherits the breach exposure of its model providers. Both OpenAI (Mixpanel third-party breach November 2025) and Anthropic (Claude Code source code exposure March 2026, AI-orchestrated cyberattack disclosure November 2025) have had publicly disclosed incidents in the past 12 months. These do not appear to have directly affected Notion AI customer data, but they are the threat baseline for any Embedded Productivity AI that uses these providers' models.
Note on the broader prompt-injection class: Notion AI's agentic features (AI Connectors, real-time document analysis, AI search across the workspace) put it in the same category as EchoLeak-affected Microsoft 365 Copilot. We are not aware of a publicly-disclosed Notion-specific zero-click prompt injection equivalent to EchoLeak as of May 2026, but the category-level risk applies. Treat any unexpected behaviour from Notion's AI Connectors (suggesting odd actions, asking unusual questions about content) as potential prompt injection from content inside the workspace.
What this means in plain English for SMB owners
Three honest takeaways:
- Notion AI's training-off-by-default is structurally good news. This is one of the better consumer-tier defaults in this database. The remaining concern is that its AI providers keep request data for up to 30 days on Free, Plus and Business. Corrected 25 October 2026: this line, and two others on this page, still said the provider retention period was unpublished.
- If you use Notion as your company wiki and it contains client work, internal strategy, or anything you would not want sitting on OpenAI or Anthropic's systems for up to 30 days, upgrade to Enterprise for the zero-retention APIs. This is the inflection point for any team that handles confidential information in Notion.
- The AI Connectors feature is where the agentic risk surface lives. When Notion AI can read across your entire workspace to answer a question, the same class of prompt injection that affected Microsoft 365 Copilot applies in principle. Notion has not had a publicly-disclosed major incident, but the category risk is real and worth factoring into deployment decisions for sensitive content.
The one setting that reverses the no-training default
Notion’s default is sound: by default it does not use your workspace data or personal information to train its models, and it requires subprocessors to agree contractually not to train on customer data either. But Notion also runs an opt-in programme that inverts this. The AI Leap program allows sharing of workspace data to improve the underlying models, in exchange for front-of-line access to future AI improvements and features.
This is worth knowing before someone in your business accepts it. The trade is early access in return for your workspace contents feeding model training — and a workspace is usually where a small business keeps its client notes, pricing and internal plans. It is a reasonable offer for a team working on non-sensitive material, and a poor one for anybody else. The decision belongs with whoever owns your AI policy, not with whichever staff member sees the offer first. If you have an AI acceptable-use policy, name this programme in it.
One caveat on provider naming: Notion says it regularly updates customers on which models are in use, such as those by OpenAI and Anthropic. That wording is illustrative rather than a fixed list, so treat any named provider as a snapshot and check Notion’s disclosures if your policy depends on it.
Sources
- Notion AI and Notion Credit Supplementary Terms: https://notion.notion.site/Notion-AI-Supplementary-Terms-fa9034c8b5a04818a6baf3eac2adddbb (last updated 27 July 2026; read 25 October 2026)
- Notion AI safety commitment page: https://www.notion.com/help/ai-safety (verified 2026-05-24)
- Notion AI security and privacy practices: https://www.notion.com/help/notion-ai-security-practices (read 23 October 2026; it replaces the Enterprise Search security and privacy practices page, which Notion withdrew in October 2026)
- eesel AI: A practical guide to Notion AI security & privacy practices (November 2025)
- Cambridge Analytica project: Notion AI's Enterprise Betrayal critique (February 2026)
- Matthias Frank: Notion AI feature overview (September 2025)
Related on AI Leakage
- Compare all 29 AI tools in the risk directory — see how Notion AI stacks up against the rest, tier by tier.
- Take the 5-minute “Am I Leaking?” check — a personalised view of your business’s AI exposure.
- Check a prompt before you paste it — our free Data-Safe Prompt Rewriter.
- Shadow AI vs AI leakage — why even approved tools like Notion AI can leak data.
- Get plain-English AI Leakage Alerts — we email you when an AI tool you use changes its data policy or has an incident.
- Get the free AI Acceptable Use Policy template — a plain-English policy with the tool-by-tool risk guide built in.
Compare similar tools: Notion AI is one of 4 tools in AI in team work tools compared, which sets out each one’s rating and what it does with your data, side by side.