# Notion violated their own security policy and exposed user data as a result > Source: > Published: 2026-11-13 21:08:29+00:00 [← Back to posts](https://www.quinnbatten.com/notebook/) # Scoop: Notion may have failed to follow their own security policies, resulting in a data breach that impacted enterprise accounts Tags: [AI](https://www.quinnbatten.com/notebook/tags/ai/) ### Note: I need your help! If you are an enterprise Notion customer, I’d love to talk to you. I believe Notion violated their own AI policy, and I’m digging into it. I have a handful of sources, but I’d love more eyes on this. ## Context Notion had a major data breach, which impacted many enterprise customers. Notion uses Fireworks as an AI provider. Fireworks got hacked, and Notion user data was exposed in the hack. The Notion feature that exposed user data is called “Insights.” If Notion had been following their own AI policy, enterprise user data would not have been exposed by this feature, and enterprise users would not have been affected by the Fireworks breach. Notion has been telling their customers that Notion only uses AI providers who promise to never ever store Notion’s data: the AI provider just processes the data, sends it back, and never saves it. That’s called a “zero data retention” (ZDR) policy. ZDR is important, because if Fireworks stores zero data from Notion, and then Fireworks gets hacked, Notion’s users are actually pretty safe. Fireworks doesn’t have any data from Notion’s users, so the hackers can’t steal any of it. (Editor’s note: I gloss over the nitty-gritty of what Notion told customers in this summary, but go into the details below.) So, Notion customers thought that Fireworks wouldn’t store any of their data. But they clearly did store some, because hackers were able to get a bunch of Notion user data from Fireworks’s servers/storage. ## Why was Fireworks storing Notion user data? [One of the Fireworks cofounders](https://x.com/dzhulgakov/status/2120888103602708631?a=OtICW-qhlFuhAs-Vntc&s=20) posted on Twitter/X claiming that Fireworks was storing Notion’s user data because Notion chose to use the Fireworks Batch Inference API, and that that API is clearly documented as “not compatible with zero data retention.” We’ll assume here that the Batch Inference API is the Fireworks endpoint that Notion used, and which collected stored data which was then later exposed. It should be obvious to any engineer that a batch API is not zero data retention. The way a batch API works is, you send a bunch of data to the provider, they store that data and they slowly process it, and when they’re done they send it back to you. Note that they have to store the data here! So I have limited sympathy for Notion’s claims that Fireworks was supposed to be using ZDR for Notion’s data (more on those claims in the final section). ## Did Notion violate its promise to users about ZDR? Many customers seem to have been under the impression that their data was protected by ZDR, and they’re very surprised that a third-party AI provider had been storing their data. In fact, before this breach, Notion had a clear policy on ZDR. [Here’s an archive.org link to the relevant section](https://web.archive.org/web/20260905201510/https://www.notion.com/help/notion-ai-security-practices#what-are-the-data-retention-obligations-of-third-party-ai-providers), and a snippet of the text: “… there are certain AI-powered features that may require the use of data-retaining LLMs; in such cases, Notion will make available Workspace settings to enable administrators to turn on data-retaining LLMs. Otherwise, such data-retaining LLMs will remain off in your Workspace by default.“ So, Notion says that there may be some AI features that do not use ZDR, but also promises that those features are off by default on enterprise accounts, and can only be enabled if an account admin flips a switch to enable them. Here’s the problem: I have had half a dozen enterprise Notion customers tell me that they have never turned on such a setting. In fact they can’t find it anywhere in the admin console… and that they were automatically opted-in to “Insights,” the AI feature that was non-ZDR and which resulted in a breach. One of my sources, who is an account administrator on an enterprise account that was affected by the breach says that Notion support has confirmed, in writing, that: “Insights was enabled by default (not opt-in), that on my account the option to decline it wasn’t findable, and that while Fireworks was on the general subprocessor list, no separate notice was given about Insights itself.” (Insights is the Notion feature from which data was exposed.) Another source, who is head of engineering at a startup, said “My understanding is they enabled Insights by default. I certainly don’t remember flipping a toggle, and I DEFINITELY didn’t agree to forfeiting ZDR!!! There is no toggle currently.” (“Toggle” here refers to the “Enforce ZDR” switch that Notion’s AI policy says should’ve been available and defaulted to “ON”.) It certainly seems like Notion violated its own AI and ZDR policy, deceived customers about the handling of their data, and as a result of their mishandling, exposed customer data to a breach. Notion sent sensitive enterprise user data to a Fireworks endpoint that was clearly labelled as not compatible with ZDR. Further, it seems that they turned the “Insights” feature on for all users without any protection or opt-in, which is directly against their own policy. In their existing communications, Notion has not acknowledged this. In fact, they seem to be attempting to gloss over it and push additional liability onto Fireworks. ## How did this happen? Notion has implied that Fireworks had a contractual obligation to apply zero data retention for all Notion data ([see the “I have ZDR as part of my Enterprise plan” section in the FAQ at the bottom of their security notice](https://www.notion.com/help/security-incident-involving-a-third-party-ai-vendor)). I find it implausible that Notion did not understand that their usage of Fireworks’s Batch Inference API would require Fireworks to store Notion user data. Further, Fireworks has a setting to enforce ZDR for the whole account. If that setting were active, Notion would have been unable to use any Fireworks endpoints that require data retention. That includes the Batch Inference API, which is the Fireworks endpoint that backed Notion’s “Insights” feature. What, specifically, happened? Here are some possibilities that I can think of: - Notion turned off the “enforce ZDR” setting in their Fireworks account on purpose, built the “Insights” feature knowing that Fireworks would retain user data for it. But Notion failed to implement the default opt-out for enterprise users for this feature, and also failed to implement the “enforce ZDR” switch promised in their AI policy. - Notion thought that their contract meant that Fireworks would automatically enforce ZDR for the entire Notion account, even for features where the Fireworks documentation indicates that it is not compatible with ZDR. - Fireworks failed to turn on (or tell Notion to turn on) the “enforce ZDR” setting in Notion’s Fireworks account. ### Sources & Links Notion: - [Security bulletin](https://www.notion.com/security/advisories/security-incident-involving-a-third-party-ai-vendor) ([Archive.org link, 2026-11-10](https://web.archive.org/web/20260000000000*/https://www.notion.com/help/security-incident-involving-a-third-party-ai-vendor) ) - [Notice about Fireworks incident](https://www.notion.com/help/security-incident-involving-a-third-party-ai-vendor) ([Archive.org link, 2026-11-10](https://web.archive.org/web/20260000000000*/https://www.notion.com/help/security-incident-involving-a-third-party-ai-vendor) ). This is the most detailed document they’ve shared. I do not understand why this isn’t linked from the bulletin. - Notion’s AI Security Practices Policy: - [Live link](https://www.notion.com/help/notion-ai-security-practices) - [Prior to the breach, on 2026-09-05 (Archive.org link)](https://web.archive.org/web/20260905201510/https://www.notion.com/help/notion-ai-security-practices#what-are-the-data-retention-obligations-of-third-party-ai-providers) . This is presumably the version that was applicable prior to and during the breach. Fireworks: - [Twitter/X post by a Fireworks co-founder](https://x.com/dzhulgakov/status/2120888103602708631?a=OtICW-qhlFuhAs-Vntc&s=20) objecting to Notion’s claims. - [Fireworks security bulletin](https://fireworks.ai/security/bulletins/october-2026-security-incident) - [Fireworks ZDR documentation](https://docs.fireworks.ai/accounts/zero-data-retention#what-it-controls) Other: