Notion: Trust page changed
Summary
Summary pending. The diff below shows exactly what changed.
What changed
Struck in red is what Notion removed; blue is what they added. Muted text is unchanged context.
Before: …and through customer-managed key infrastructure. Encryption in transit Enterprise key management Multi-layer envelope encryption Password hashing Encryption audit trails Encryption at rest Access control and authentication Identity verification, role-based permissions,…
After: …and through customer-managed key infrastructure. Encryption in transit Encryption at rest Enterprise key management Restricted encryption key access Multi-layer envelope encryption Key rotation and compromise response Password hashing Encryption audit trails Access control and authentication Identity verification, role-based permissions,…
Before: …workspace access. SAML single sign-on Multi-factor authentication Role-based access control Least privilege access Automated user provisioning Session management…
After: …workspace access. SAML single sign-on Multi-factor authentication Role-based least-privilege access Role-based access control Access approval workflow Quarterly access reviews Least privilege access Automated user provisioning Session management…
Before: …and through customer-managed key infrastructure. Encryption in transit All data transmitted between clients and Notion servers is encrypted using TLS 1.2 or greater, protecting against interception or tampering during transit. Enterprise key management Enterprise customers can manage their…
After: …and through customer-managed key infrastructure. Encryption in transit Customer data transmitted over public networks is protected using secure transport encryption, helping prevent interception and unauthorized modification. Encryption at rest Customer and other sensitive data stored in production systems is encrypted, reducing exposure if storage media or services are accessed improperly. Enterprise key management Enterprise customers can manage their…
Before: …ability to revoke Notion's access at any time. nothing here Multi-layer envelope encryption Notion employs a three-layer envelope…
After: …ability to revoke Notion's access at any time. Restricted encryption key access Encryption keys are stored in approved key management systems and access is limited to authorized personnel. Multi-layer envelope encryption Notion employs a three-layer envelope…
Before: …exceeding traditional two-layer approaches for defense in depth. nothing here Password hashing Customer passwords are hashed using bcrypt,…
After: …exceeding traditional two-layer approaches for defense in depth. Key rotation and compromise response Keys are rotated when compromised and on a defined recurring basis, while suspected compromise triggers prompt revocation or rotation procedures. Password hashing Customer passwords are hashed using bcrypt,…
Before: …Workspace administrators can enforce SSO-only authentication. Multi-factor authentication Two-step verification is available across all plan types with support for SMS-based codes, TOTP via authenticator apps, passkeys with biometric authentication, and backup codes. Role-based access control Notion supports multiple user roles…
After: …Workspace administrators can enforce SSO-only authentication. Multi-factor authentication Multi-factor authentication is enabled for workforce identity accounts, critical systems, privileged access, and production access where supported. Role-based least-privilege access Access is assigned according to job role and limited to the minimum privileges needed to perform authorized responsibilities. Role-based access control Notion supports multiple user roles…
Before: …control over who can access and modify content. nothing here require documented business justification and approval from designated…
After: …control over who can access and modify content. Access approval workflow Requests for access and access changes require documented business justification and approval from designated…
Before: …access changes require documented business justification and approval nothing here Least privilege access Access rights are limited to…
After: …access changes require documented business justification and approval from designated managers or system owners before provisioning. Quarterly access reviews Management reviews user roles and permissions at least quarterly, including privileged access, to identify and correct inappropriate access. Least privilege access Access rights are limited to…
Before: …rotation, and administrative actions across critical production systems. Encryption at rest All customer data stored on Notion's internal networks, cloud storage, database tables, and backups is encrypted at rest using AES-256 encryption. This applies across all Notion products and regions, including Notion core, Notion AI, Calendar, Mail, and all hosting regions. Access control and authentication Identity verification, role-based permissions,…
After: …rotation, and administrative actions across critical production systems. removed Access control and authentication Identity verification, role-based permissions,…
Before: …effectively over a sustained period. SOC 2 Type nothing here SOC 2 Type I certification Independent point-in-time assessment…
After: …effectively over a sustained period. SOC 2 Type II examination An independent service auditor examined the design and operating effectiveness of controls supporting security, availability, and confidentiality over the review period. ISO/IEC 27001 certification The information security management system is certified against ISO/IEC 27001, with annual surveillance audits supporting continued conformity. SOC 2 Type I certification Independent point-in-time assessment…
Before: …II audit, providing transparency into security control effectiveness. nothing here ISO 27001 certification Notion maintains ISO 27001 certification,…
After: …II audit, providing transparency into security control effectiveness. HIPAA and HITECH attestation An independent practitioner reported that the information security and breach notification program conformed to applicable HIPAA Security Rule and HITECH criteria. C5 cloud security attestation An independent practitioner examined the design and operating effectiveness of controls against the BSI C5 cloud computing criteria. ISO 27001 certification Notion maintains ISO 27001 certification,…
Before: …an additional layer of access control beyond authentication. Quarterly access reviews Access rights are reviewed at least quarterly by designated managers or system owners to ensure appropriateness. Inappropriate access is revoked, and discrepancies are escalated to the Information Security team. Access termination within 24 hours User access is…
After: …an additional layer of access control beyond authentication. removed Access termination within 24 hours User access is…
Before: …from design through deployment and ongoing monitoring. Secure nothing here Secure development lifecycle Notion follows a defined SDLC…
After: …from design through deployment and ongoing monitoring. Secure software development lifecycle Security requirements are integrated across software design, implementation, testing, deployment, and operation. Secure development lifecycle Notion follows a defined SDLC…
Before: …security scans after development, and vulnerability management post-launch. nothing here Static application security testing SAST runs on every…
After: …security scans after development, and vulnerability management post-launch. Peer review of code changes Application and infrastructure changes receive independent peer review before production deployment, supporting separation of duties and reducing unauthorized or defective changes. Static application security testing SAST runs on every…
Before: …for known security vulnerabilities, reducing supply chain risk. nothing here risk. Mandatory code review All source code changes…
After: …for known security vulnerabilities, reducing supply chain risk. Pre-production security testing Changes are tested before production deployment, with security-relevant changes receiving validation appropriate to their risk. Mandatory code review All source code changes…
Before: …production, with reviews based on the OWASP framework. nothing here Annual penetration testing Notion conducts annual third-party grey-box…
After: …production, with reviews based on the OWASP framework. Production and non-production separation Development, testing, and production environments are logically separated to reduce the risk of unauthorized access to customer data and uncontrolled production changes. Annual penetration testing Notion conducts annual third-party grey-box…
Before: …compliance with global privacy regulations. Data classification framework Notion maintains a formal Data Classification Policy with four levels: Restricted Data, Highly Confidential, Confidential, and Public Data. Customer data and PII are classified as Restricted Data. Data processing addendum Notion provides a Data Processing…
After: …compliance with global privacy regulations. Data classification framework Information is classified by sensitivity, with customer data and user content designated as the most sensitive category and subject to privileged, monitored, and explicitly approved access. Data processing addendum Notion provides a Data Processing…
Before: …safeguards aligned with GDPR and other privacy regulations. nothing here Data deletion procedures Formal data deletion policies and…
After: …safeguards aligned with GDPR and other privacy regulations. Restricted production data use Customer data is prohibited from being used or stored in non-production environments unless explicitly authorized through a documented process with appropriate safeguards. Data deletion procedures Formal data deletion policies and…
Before: …retention schedules applied by data classification level. Data nothing here Data handling and retention Documented data handling and…
After: …retention schedules applied by data classification level. Data retention and deletion Customer data is retained and deleted according to contractual, legal, regulatory, and documented retention requirements, including deletion upon termination where applicable. Customer-requested deletion Customers may request deletion of their confidential information, and deletion requests are documented and tracked through completion. Data handling and retention Documented data handling and…
Before: …security events through centralized alerting and escalation procedures. nothing here Security incident response plan A formally documented and…
After: …security events through centralized alerting and escalation procedures. Documented incident response plan A formal plan defines incident handling procedures, responsibilities, escalation, and communication expectations for personnel and customers. Continuous incident monitoring Security events are continuously monitored, reviewed, documented, and escalated for resolution by authorized personnel. Security incident response plan A formally documented and…
Before: …validated through SOC 2 and ISO 27001 audits. nothing here Breach notification Upon becoming aware of a security…
After: …validated through SOC 2 and ISO 27001 audits. Customer breach notification Impacted customers are notified of confirmed security incidents in accordance with applicable laws and contractual commitments. Breach notification Upon becoming aware of a security…
Before: …update the incident response plan and prevent recurrence. nothing here recurrence. Annual incident response testing The Incident Response…
After: …update the incident response plan and prevent recurrence. Post-incident improvement Incident evaluations include lessons learned, root-cause analysis where appropriate, and corrective actions intended to reduce recurrence. Annual incident response testing The Incident Response…
Before: …and renewed at least annually by designated owners. nothing here Business continuity and disaster recovery plans define recovery…
After: …and renewed at least annually by designated owners. Documented continuity and recovery plans Business continuity and disaster recovery plans define recovery…
Before: …recovery plans Business continuity and disaster recovery plans nothing here Disaster recovery plan A documented Disaster Recovery Plan…
After: …recovery plans Business continuity and disaster recovery plans define recovery priorities, responsibilities, communication methods, and restoration procedures for major disruptions. Customer data backups Automated backups are performed for data stores containing customer data, supporting recovery from deletion, corruption, incidents, or disasters. Disaster recovery plan A documented Disaster Recovery Plan…
Before: …with multi-tiered, cross-region backup capabilities for production databases. nothing here Automated data backups Production databases are backed up…
After: …with multi-tiered, cross-region backup capabilities for production databases. Availability-zone replication Databases are replicated to secondary availability zones and production environments use a multi-location strategy to support continued operations after a facility or system failure. Automated data backups Production databases are backed up…
Before: …and regions, validating plan effectiveness and team readiness. nothing here Service level commitment Notion commits to 99.9% service…
After: …and regions, validating plan effectiveness and team readiness. Annual recovery testing Disaster recovery and backup restoration tests are performed at least annually, with results and lessons learned documented for improvement. Service level commitment Notion commits to 99.9% service…
Before: …anomalous behavior, with alerts routed to security teams. Network segmentation Production servers do not face the internet directly and are positioned behind a DMZ. Internet-facing services operate with a deny-by-default posture and least-privilege network connectivity. SIEM-based monitoring A Security Information and Event Management…
After: …anomalous behavior, with alerts routed to security teams. Production network protection Firewalls, security groups, and web application protections restrict unauthorized traffic to production systems and support controlled connectivity. Network segmentation Production systems and customer-facing applications are logically separated from corporate information systems and other network environments. Intrusion detection Network activity is monitored for potentially malicious traffic, with alerts reviewed and resolved by authorized personnel. SIEM-based monitoring A Security Information and Event Management…
Before: …internet or employee-accessible VPN, minimizing the attack surface. nothing here Change control for network configuration All cloud network…
After: …internet or employee-accessible VPN, minimizing the attack surface. Traffic distribution and availability Traffic distribution controls support production reliability and availability by balancing requests across available service capacity. Change control for network configuration All cloud network…
Before: …remediation of security vulnerabilities across applications and infrastructure. nothing here Vulnerability management program A formal Vulnerability Management Policy…
After: …remediation of security vulnerabilities across applications and infrastructure. Continuous vulnerability scanning Internal production infrastructure is scanned continuously and external application scans are performed at least weekly to identify potential weaknesses. Vulnerability management program A formal Vulnerability Management Policy…
Before: …internal dependency and vulnerability monitoring across the codebase. nothing here Threat intelligence monitoring Notion subscribes to threat intelligence…
After: …internal dependency and vulnerability monitoring across the codebase. Annual penetration testing Qualified independent testing is performed at least annually to identify vulnerabilities that could affect the production environment. Threat intelligence monitoring Notion subscribes to threat intelligence…
Before: …up-to-date vulnerability information, enabling proactive identification and response. nothing here Patch management Security patches are tested in non-production…
After: …up-to-date vulnerability information, enabling proactive identification and response. Risk-based vulnerability remediation Confirmed vulnerabilities are validated, risk-ranked, assigned to responsible owners, and remediated according to severity-based timelines. Patch management Security patches are tested in non-production…
Before: …Critical vulnerabilities may trigger emergency incident response procedures. nothing here Responsible disclosure program A published Responsible Disclosure Policy…
After: …Critical vulnerabilities may trigger emergency incident response procedures. Public bug bounty program Independent researchers and customers can submit potential bugs and vulnerabilities to the security team, expanding external security coverage. Responsible disclosure program A published Responsible Disclosure Policy…
Before: …event types, timestamps, and success or failure indicators. nothing here 24/7 security monitoring System and data security is…
After: …event types, timestamps, and success or failure indicators. Centralized security monitoring Security events and production activity are collected in centralized monitoring systems that alert authorized personnel to potential incidents. 24/7 security monitoring System and data security is…
Before: …and anomalous behavior automatically routed to security channels. nothing here Privileged access monitoring All changes to privileged user…
After: …and anomalous behavior automatically routed to security channels. Access activity logging Critical systems record account management, login, object access, policy change, and privileged-use events to support accountability and investigation. Alert investigation and resolution Alerts are reviewed and resolved in a timely manner, with relevant events tracked through documented operational or security processes. Privileged access monitoring All changes to privileged user…
Before: …are logged and periodically reviewed for unauthorized behavior. nothing here Log archival and retention Application logs are archived…
After: …are logged and periodically reviewed for unauthorized behavior. Protected audit records Access to audit logs is restricted, and the number of personnel able to modify or delete them is limited to help preserve evidentiary integrity. Log archival and retention Application logs are archived…
Before: …Notion's security and compliance standards. Vendor risk assessments All third-party vendors undergo security assessments including questionnaire distribution, attestation report review, penetration test evaluation, and artifact analysis based on criticality and risk factors. Subprocessor transparency An up-to-date list of subprocessors is…
After: …Notion's security and compliance standards. Vendor risk assessments Vendors undergo risk assessments before contributing to service delivery, with reviews repeated at least annually or when material changes occur. Security and confidentiality contracts Contracts with vendors handling confidential data or providing critical services include security, confidentiality, incident reporting, and data return or deletion commitments. Subprocessor transparency An up-to-date list of subprocessors is…
Before: …including review of attestation reports and security artifacts. nothing here Supplier code of conduct Notion maintains supplier-facing standards…
After: …including review of attestation reports and security artifacts. Independent assurance review Independent assurance reports and other security evidence for critical vendors are reviewed at least annually, with findings and action items documented. Vendor offboarding controls Exit planning addresses access revocation, data return or export, secure deletion, transition responsibilities, and timing for higher-dependency vendors. Supplier code of conduct Notion maintains supplier-facing standards…
Before: …and policy acknowledgment to maintain a security-aware workforce. Security awareness training All employees complete mandatory annual security and privacy awareness training, including incident response training. Resources expected to respond to security incidents receive specialized training. Confidentiality agreements All employees sign an Employee Proprietary…
After: …and policy acknowledgment to maintain a security-aware workforce. Background checks Background checks are initiated for new personnel before their start date in accordance with applicable laws. Confidentiality agreements All employees sign an Employee Proprietary…
Before: …reviewed annually to ensure alignment with evolving requirements. nothing here Code of ethics and conduct A comprehensive Code…
After: …reviewed annually to ensure alignment with evolving requirements. Security awareness training Personnel complete security and privacy awareness training during onboarding and at least annually, with completion records retained. Code of ethics and conduct A comprehensive Code…
Before: …discrimination prevention. All employees must acknowledge it annually. nothing here Privacy compliance monitoring Personnel are regularly monitored for…
After: …discrimination prevention. All employees must acknowledge it annually. Role-based security training Personnel with specialized responsibilities, including developers and incident responders, receive training tailored to their security duties. Confidentiality commitments Personnel acknowledge confidentiality and proprietary information obligations upon hire, limiting unauthorized use or disclosure of company and customer information. Privacy compliance monitoring Personnel are regularly monitored for…
Before: …accompanied by a Notion employee throughout their visit. nothing here Facility access controls Physical access to facilities and…
After: …accompanied by a Notion employee throughout their visit. Badge-controlled facility access Physical access to corporate facilities is restricted through access credentials that track entry and exit activity. Restricted-area access reviews Access permissions for restricted areas are reviewed periodically, including monthly review where designated secondary controls are not present. Facility access controls Physical access to facilities and…
Before: …limited to authorized personnel and logged for accountability. nothing here Cloud infrastructure security Notion is hosted on AWS…
After: …limited to authorized personnel and logged for accountability. Visitor management and escorting Visitors are logged, issued temporary identification, and escorted by Notion personnel while on company premises. Cloud infrastructure security Notion is hosted on AWS…
Before: …Notion does not operate its own data centers. nothing here Endpoint security Controls protecting employee devices through detection,…
After: …Notion does not operate its own data centers. Physical access monitoring Physical access, visitor, maintenance, and repair records are retained to support investigations, audits, and accountability. Endpoint security Controls protecting employee devices through detection,…
Before: …employee devices through detection, response, and configuration management. nothing here Endpoint detection and response An EDR solution is…
After: …employee devices through detection, response, and configuration management. Full-disk encryption Company-managed endpoint drives are encrypted to reduce the risk of data exposure if a device is lost or stolen. Endpoint detection and response An EDR solution is…
Before: …Employees cannot modify or disable the anti-malware configuration. Mobile device management A mobile device management (MDM) tool continuously enforces security configurations and EDR deployment across all company-managed devices, ensuring consistent security posture. Unauthorized AI tool prevention Technical controls are maintained…
After: …Employees cannot modify or disable the anti-malware configuration. Endpoint malware protection Anti-malware protection is installed and continuously enforced on company-managed endpoint devices and applicable infrastructure systems. Unauthorized AI tool prevention Technical controls are maintained…
Before: …requiring immediate reporting per the incident response policy. nothing here Change management Formal procedures governing application, system, and…
After: …requiring immediate reporting per the incident response policy. Mobile device management Mobile devices supporting the service are centrally managed, enabling consistent security configuration and administrative oversight. Secure workstation controls Workstations are configured to lock and require authentication after inactivity, helping limit unauthorized access to unattended devices. Change management Formal procedures governing application, system, and…
Before: …infrastructure changes with full traceability and approval workflows. nothing here Ticket-linked change control All changes to Notion's application…
After: …infrastructure changes with full traceability and approval workflows. Documented change approval Application and infrastructure changes are tracked, reviewed, tested, and approved before production deployment. Ticket-linked change control All changes to Notion's application…
Before: …quality and security before release candidates are promoted. nothing here Red team assessments Notion conducts risk-based red teaming…
After: …quality and security before release candidates are promoted. Controlled production deployment Production changes are deployed through controlled release mechanisms, with migration access restricted to authorized personnel. Red team assessments Notion conducts risk-based red teaming…
Before: …and identify weaknesses before they can be exploited. nothing here Environment segregation Application development is separated from production…
After: …and identify weaknesses before they can be exploited. Change traceability Changes are maintained in version control and linked to records that identify the change and supporting implementation evidence. Environment segregation Application development is separated from production…
Before: …in development or testing without customer coordination. Rollback nothing here Rollback strategy A rollback strategy is in place…
After: …in development or testing without customer coordination. Rollback procedures Documented rollback procedures support recovery when a production change introduces an error, vulnerability, or service impact. Rollback strategy A rollback strategy is in place…
Before: …AI Tools Usage and Governance Policy Request access nothing here Request access Questionnaires Notion - CAIQ (Consensus Assessment…
After: …AI Tools Usage and Governance Policy Request access Security White Papers Workers Security White Paper Request access Questionnaires Notion - CAIQ (Consensus Assessment…
1 noise-only block(s) hidden (dates, counters, testimonials, tokens).
Compared with the previous archived version (#258 to #3634). Text is normalized before comparing: dates, counters and tokens show as ‹date›, ‹count›, ‹tok›, and noise-only edits are hidden. Rewindex shows changed passages with a few words of context, not a copy of the page. View the live page (opens in new tab).
Archive proof
Rewindex commits each page capture it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.
How the archive is checked, and what it cannot prove.
Before captured
In the 2026-10-17 checkpoint, timestamped by FreeTSA and DigiCert on . Record hash
26728e756c8a0f33…After captured
In the 2026-10-20 checkpoint, timestamped by FreeTSA and DigiCert on . Record hash
bc018875c498b889…
History of this page
YesterdayWednesday, November 4Wed, Nov 4
1 page change
- Content changedPage change
Trust pagechanged
Notion’s Trust page added an “MCP and AI” Security White Paper listing and removed security FAQ text describing its trust center and SOC 2 Type II compliance. These are documentation and wording changes; the evidence does not show a change to Notion’s compliance status.
Monday, November 2
1 page change
- Content changedPage change
Trust pagechanged
Notion’s Trust page replaced Wolfia promotional copy about answering security questionnaires with an invitation to get a Wolfia trust center. This is marketing wording only; no customer-facing security controls or documentation changes are shown.
Friday, October 30
1 page change
- Content changedPage change
Trust pagechanged
Notion’s Trust page increased its subprocessor count from 26 to 31, adding entries for AssemblyAI Inc., Browserbase, Inc., Modal Labs, Inc. and PlanetScale, Inc., and removing Amplitude. These disclosures update customers’ view of third parties providing transcription, AI-agent web access, AI compute, database hosting and analytics.
Thursday, October 29
1 page change
- Content changedPage change
Trust pagechanged
Notion’s Trust page reordered navigation links, moving Security advisories first and Controls last. Only navigation order changed; no security features or terms were added or removed.
Tuesday, October 27
1 page change
- Content changedPage change
Trust pagechanged
Notion’s Trust page increased its stated independent compliance certifications from 14 to 15 without identifying the additional certification. Other edits mainly rearranged navigation and added a Security advisories link; no substantive security-control changes were shown.
Thursday, October 22
1 page change
- Content changedPage change
Trust pagechanged
Notion’s Trust page added a Network Architecture Diagram with “Request access” and labeled the Workers Security White Paper “(Beta).” Customers can request the network diagram and see the white paper’s beta designation.
Wednesday, October 21
1 page change
- Content changedPage change
Trust pagechanged
Notion’s Trust page added data-handling and deletion policy listings and removed an access-control list including SAML single sign-on and Multi-factor authentication. Report categories were also renamed; these are documentation edits, with no evidence that customer feature availability changed.
Tuesday, October 20
1 page change
- Content changedPage change
Trust pagechangedthis change
Cite this
Trust page changed on Notion’s Trust page, changed 2026-10-20 12:05 UTC (change 1 of 8).
- Title
- Trust page changed
- Vendor
- Notion
- Date
- URL
- https://rewindex.com/change/p3634