# Notion: Trust page changed > Trust page changed. Detected 2026-10-20 by Rewindex: what changed on Notion’s trust page, with the before/after diff. Canonical: https://rewindex.com/change/p3634 Last updated: 2026-10-20T12:05:17Z **Summary:** _summary pending_ - Kind: Trust / security · Label: Changed (not classified) (rule) - Changed: 2026-10-20 12:05 UTC · Detected: 2026-10-20 12:05 UTC - [Source: https://trust.notion.com](https://trust.notion.com) - [Company: Notion](https://rewindex.com/company/notion.md) - Versions: before page\_version:258 → after page\_version:3634 - Change 1 of 8 for this page ## What changed **1. Changed** ```diff …and through customer-managed key infrastructure. Encryption in transit - Enterprise key management Multi-layer envelope encryption Password hashing Encryption audit trails Encryption at rest + Encryption at rest Enterprise key management Restricted encryption key access Multi-layer envelope encryption Key rotation and compromise response Password hashing Encryption audit trails Access control and authentication Identity verification, role-based permissions,… ``` **2. Changed** ```diff …workspace access. SAML single sign-on Multi-factor authentication Role-based - access control + least-privilege access Role-based access control Access approval workflow Quarterly access reviews Least privilege access Automated user provisioning Session management… ``` **3. Changed** ```diff …and through customer-managed key infrastructure. Encryption in transit - All data transmitted between clients and Notion servers is encrypted using TLS 1.2 or greater, protecting against interception or tampering during transit. + Customer data transmitted over public networks is protected using secure transport encryption, helping prevent interception and unauthorized modification. Encryption at rest Customer and other sensitive data stored in production systems is encrypted, reducing exposure if storage media or services are accessed improperly. Enterprise key management Enterprise customers can manage their… ``` **4. Added** ```diff …ability to revoke Notion's access at any time. + Restricted encryption key access Encryption keys are stored in approved key management systems and access is limited to authorized personnel. Multi-layer envelope encryption Notion employs a three-layer envelope… ``` **5. Added** ```diff …exceeding traditional two-layer approaches for defense in depth. + Key rotation and compromise response Keys are rotated when compromised and on a defined recurring basis, while suspected compromise triggers prompt revocation or rotation procedures. Password hashing Customer passwords are hashed using bcrypt,… ``` **6. Changed** ```diff …Workspace administrators can enforce SSO-only authentication. Multi-factor authentication - Two-step verification is available across all plan types with support for SMS-based codes, TOTP via authenticator apps, passkeys with biometric authentication, and backup codes. + Multi-factor authentication is enabled for workforce identity accounts, critical systems, privileged access, and production access where supported. Role-based least-privilege access Access is assigned according to job role and limited to the minimum privileges needed to perform authorized responsibilities. Role-based access control Notion supports multiple user roles… ``` **7. Added** ```diff …control over who can access and modify content. + Access approval workflow Requests for access and access changes require documented business justification and approval from designated… ``` **8. Added** ```diff …access changes require documented business justification and approval + from designated managers or system owners before provisioning. Quarterly access reviews Management reviews user roles and permissions at least quarterly, including privileged access, to identify and correct inappropriate access. Least privilege access Access rights are limited to… ``` **9. Removed** ```diff …rotation, and administrative actions across critical production systems. - Encryption at rest All customer data stored on Notion's internal networks, cloud storage, database tables, and backups is encrypted at rest using AES-256 encryption. This applies across all Notion products and regions, including Notion core, Notion AI, Calendar, Mail, and all hosting regions. Access control and authentication Identity verification, role-based permissions,… ``` **10. Added** ```diff …effectively over a sustained period. SOC 2 Type + II examination An independent service auditor examined the design and operating effectiveness of controls supporting security, availability, and confidentiality over the review period. ISO/IEC 27001 certification The information security management system is certified against ISO/IEC 27001, with annual surveillance audits supporting continued conformity. SOC 2 Type I certification Independent point-in-time assessment… ``` **11. Added** ```diff …II audit, providing transparency into security control effectiveness. + HIPAA and HITECH attestation An independent practitioner reported that the information security and breach notification program conformed to applicable HIPAA Security Rule and HITECH criteria. C5 cloud security attestation An independent practitioner examined the design and operating effectiveness of controls against the BSI C5 cloud computing criteria. ISO 27001 certification Notion maintains ISO 27001 certification,… ``` **12. Removed** ```diff …an additional layer of access control beyond authentication. - Quarterly access reviews Access rights are reviewed at least quarterly by designated managers or system owners to ensure appropriateness. Inappropriate access is revoked, and discrepancies are escalated to the Information Security team. Access termination within 24 hours User access is… ``` **13. Added** ```diff …from design through deployment and ongoing monitoring. Secure + software development lifecycle Security requirements are integrated across software design, implementation, testing, deployment, and operation. Secure development lifecycle Notion follows a defined SDLC… ``` **14. Added** ```diff …security scans after development, and vulnerability management post-launch. + Peer review of code changes Application and infrastructure changes receive independent peer review before production deployment, supporting separation of duties and reducing unauthorized or defective changes. Static application security testing SAST runs on every… ``` **15. Added** ```diff …for known security vulnerabilities, reducing supply chain risk. + Pre-production security testing Changes are tested before production deployment, with security-relevant changes receiving validation appropriate to their risk. Mandatory code review All source code changes… ``` **16. Added** ```diff …production, with reviews based on the OWASP framework. + Production and non-production separation Development, testing, and production environments are logically separated to reduce the risk of unauthorized access to customer data and uncontrolled production changes. Annual penetration testing Notion conducts annual third-party grey-box… ``` **17. Changed** ```diff …compliance with global privacy regulations. Data classification framework - Notion maintains a formal Data Classification Policy with four levels: Restricted Data, Highly Confidential, Confidential, and Public Data. Customer data and PII are classified as Restricted Data. + Information is classified by sensitivity, with customer data and user content designated as the most sensitive category and subject to privileged, monitored, and explicitly approved access. Data processing addendum Notion provides a Data Processing… ``` **18. Added** ```diff …safeguards aligned with GDPR and other privacy regulations. + Restricted production data use Customer data is prohibited from being used or stored in non-production environments unless explicitly authorized through a documented process with appropriate safeguards. Data deletion procedures Formal data deletion policies and… ``` **19. Added** ```diff …retention schedules applied by data classification level. Data + retention and deletion Customer data is retained and deleted according to contractual, legal, regulatory, and documented retention requirements, including deletion upon termination where applicable. Customer-requested deletion Customers may request deletion of their confidential information, and deletion requests are documented and tracked through completion. Data handling and retention Documented data handling and… ``` **20. Added** ```diff …security events through centralized alerting and escalation procedures. + Documented incident response plan A formal plan defines incident handling procedures, responsibilities, escalation, and communication expectations for personnel and customers. Continuous incident monitoring Security events are continuously monitored, reviewed, documented, and escalated for resolution by authorized personnel. Security incident response plan A formally documented and… ``` **21. Added** ```diff …validated through SOC 2 and ISO 27001 audits. + Customer breach notification Impacted customers are notified of confirmed security incidents in accordance with applicable laws and contractual commitments. Breach notification Upon becoming aware of a security… ``` **22. Added** ```diff …update the incident response plan and prevent recurrence. + Post-incident improvement Incident evaluations include lessons learned, root-cause analysis where appropriate, and corrective actions intended to reduce recurrence. Annual incident response testing The Incident Response… ``` **23. Added** ```diff …and renewed at least annually by designated owners. + Documented continuity and recovery plans Business continuity and disaster recovery plans define recovery… ``` **24. Added** ```diff …recovery plans Business continuity and disaster recovery plans + define recovery priorities, responsibilities, communication methods, and restoration procedures for major disruptions. Customer data backups Automated backups are performed for data stores containing customer data, supporting recovery from deletion, corruption, incidents, or disasters. Disaster recovery plan A documented Disaster Recovery Plan… ``` **25. Added** ```diff …with multi-tiered, cross-region backup capabilities for production databases. + Availability-zone replication Databases are replicated to secondary availability zones and production environments use a multi-location strategy to support continued operations after a facility or system failure. Automated data backups Production databases are backed up… ``` **26. Added** ```diff …and regions, validating plan effectiveness and team readiness. + Annual recovery testing Disaster recovery and backup restoration tests are performed at least annually, with results and lessons learned documented for improvement. Service level commitment Notion commits to 99.9% service… ``` **27. Changed** ```diff …anomalous behavior, with alerts routed to security teams. - Network segmentation Production servers do not face the internet directly and are positioned behind a DMZ. Internet-facing services operate with a deny-by-default posture and least-privilege network connectivity. + Production network protection Firewalls, security groups, and web application protections restrict unauthorized traffic to production systems and support controlled connectivity. Network segmentation Production systems and customer-facing applications are logically separated from corporate information systems and other network environments. Intrusion detection Network activity is monitored for potentially malicious traffic, with alerts reviewed and resolved by authorized personnel. SIEM-based monitoring A Security Information and Event Management… ``` **28. Added** ```diff …internet or employee-accessible VPN, minimizing the attack surface. + Traffic distribution and availability Traffic distribution controls support production reliability and availability by balancing requests across available service capacity. Change control for network configuration All cloud network… ``` **29. Added** ```diff …remediation of security vulnerabilities across applications and infrastructure. + Continuous vulnerability scanning Internal production infrastructure is scanned continuously and external application scans are performed at least weekly to identify potential weaknesses. Vulnerability management program A formal Vulnerability Management Policy… ``` **30. Added** ```diff …internal dependency and vulnerability monitoring across the codebase. + Annual penetration testing Qualified independent testing is performed at least annually to identify vulnerabilities that could affect the production environment. Threat intelligence monitoring Notion subscribes to threat intelligence… ``` **31. Added** ```diff …up-to-date vulnerability information, enabling proactive identification and response. + Risk-based vulnerability remediation Confirmed vulnerabilities are validated, risk-ranked, assigned to responsible owners, and remediated according to severity-based timelines. Patch management Security patches are tested in non-production… ``` **32. Added** ```diff …Critical vulnerabilities may trigger emergency incident response procedures. + Public bug bounty program Independent researchers and customers can submit potential bugs and vulnerabilities to the security team, expanding external security coverage. Responsible disclosure program A published Responsible Disclosure Policy… ``` **33. Added** ```diff …event types, timestamps, and success or failure indicators. + Centralized security monitoring Security events and production activity are collected in centralized monitoring systems that alert authorized personnel to potential incidents. 24/7 security monitoring System and data security is… ``` **34. Added** ```diff …and anomalous behavior automatically routed to security channels. + Access activity logging Critical systems record account management, login, object access, policy change, and privileged-use events to support accountability and investigation. Alert investigation and resolution Alerts are reviewed and resolved in a timely manner, with relevant events tracked through documented operational or security processes. Privileged access monitoring All changes to privileged user… ``` **35. Added** ```diff …are logged and periodically reviewed for unauthorized behavior. + Protected audit records Access to audit logs is restricted, and the number of personnel able to modify or delete them is limited to help preserve evidentiary integrity. Log archival and retention Application logs are archived… ``` **36. Changed** ```diff …Notion's security and compliance standards. Vendor risk assessments - All third-party vendors undergo security assessments including questionnaire distribution, attestation report review, penetration test evaluation, and artifact analysis based on criticality and risk factors. + Vendors undergo risk assessments before contributing to service delivery, with reviews repeated at least annually or when material changes occur. Security and confidentiality contracts Contracts with vendors handling confidential data or providing critical services include security, confidentiality, incident reporting, and data return or deletion commitments. Subprocessor transparency An up-to-date list of subprocessors is… ``` **37. Added** ```diff …including review of attestation reports and security artifacts. + Independent assurance review Independent assurance reports and other security evidence for critical vendors are reviewed at least annually, with findings and action items documented. Vendor offboarding controls Exit planning addresses access revocation, data return or export, secure deletion, transition responsibilities, and timing for higher-dependency vendors. Supplier code of conduct Notion maintains supplier-facing standards… ``` **38. Changed** ```diff …and policy acknowledgment to maintain a security-aware workforce. - Security awareness training All employees complete mandatory annual security and privacy awareness training, including incident response training. Resources expected to respond to security incidents receive specialized training. + Background checks Background checks are initiated for new personnel before their start date in accordance with applicable laws. Confidentiality agreements All employees sign an Employee Proprietary… ``` **39. Added** ```diff …reviewed annually to ensure alignment with evolving requirements. + Security awareness training Personnel complete security and privacy awareness training during onboarding and at least annually, with completion records retained. Code of ethics and conduct A comprehensive Code… ``` **40. Added** ```diff …discrimination prevention. All employees must acknowledge it annually. + Role-based security training Personnel with specialized responsibilities, including developers and incident responders, receive training tailored to their security duties. Confidentiality commitments Personnel acknowledge confidentiality and proprietary information obligations upon hire, limiting unauthorized use or disclosure of company and customer information. Privacy compliance monitoring Personnel are regularly monitored for… ``` **41. Added** ```diff …accompanied by a Notion employee throughout their visit. + Badge-controlled facility access Physical access to corporate facilities is restricted through access credentials that track entry and exit activity. Restricted-area access reviews Access permissions for restricted areas are reviewed periodically, including monthly review where designated secondary controls are not present. Facility access controls Physical access to facilities and… ``` **42. Added** ```diff …limited to authorized personnel and logged for accountability. + Visitor management and escorting Visitors are logged, issued temporary identification, and escorted by Notion personnel while on company premises. Cloud infrastructure security Notion is hosted on AWS… ``` **43. Added** ```diff …Notion does not operate its own data centers. + Physical access monitoring Physical access, visitor, maintenance, and repair records are retained to support investigations, audits, and accountability. Endpoint security Controls protecting employee devices through detection,… ``` **44. Added** ```diff …employee devices through detection, response, and configuration management. + Full-disk encryption Company-managed endpoint drives are encrypted to reduce the risk of data exposure if a device is lost or stolen. Endpoint detection and response An EDR solution is… ``` **45. Changed** ```diff …Employees cannot modify or disable the anti-malware configuration. - Mobile device management A mobile device management (MDM) tool continuously enforces security configurations and EDR deployment across all company-managed devices, ensuring consistent security posture. + Endpoint malware protection Anti-malware protection is installed and continuously enforced on company-managed endpoint devices and applicable infrastructure systems. Unauthorized AI tool prevention Technical controls are maintained… ``` **46. Added** ```diff …requiring immediate reporting per the incident response policy. + Mobile device management Mobile devices supporting the service are centrally managed, enabling consistent security configuration and administrative oversight. Secure workstation controls Workstations are configured to lock and require authentication after inactivity, helping limit unauthorized access to unattended devices. Change management Formal procedures governing application, system, and… ``` **47. Added** ```diff …infrastructure changes with full traceability and approval workflows. + Documented change approval Application and infrastructure changes are tracked, reviewed, tested, and approved before production deployment. Ticket-linked change control All changes to Notion's application… ``` **48. Added** ```diff …quality and security before release candidates are promoted. + Controlled production deployment Production changes are deployed through controlled release mechanisms, with migration access restricted to authorized personnel. Red team assessments Notion conducts risk-based red teaming… ``` **49. Added** ```diff …and identify weaknesses before they can be exploited. + Change traceability Changes are maintained in version control and linked to records that identify the change and supporting implementation evidence. Environment segregation Application development is separated from production… ``` **50. Added** ```diff …in development or testing without customer coordination. Rollback + procedures Documented rollback procedures support recovery when a production change introduces an error, vulnerability, or service impact. Rollback strategy A rollback strategy is in place… ``` **51. Added** ```diff …AI Tools Usage and Governance Policy Request access + Security White Papers Workers Security White Paper Request access Questionnaires Notion - CAIQ (Consensus Assessment… ``` _1 noise-only block(s) hidden (dates, counters, testimonials, tokens)._ ## History of this page | When (UTC) | Change | Label | | --- | --- | --- | | 2026-10-20 12:05 UTC | Trust page changed (this change) | Changed (not classified) | | 2026-10-21 08:45 UTC | [Trust page changed](https://rewindex.com/change/p4394.md) | Changed (not classified) | | 2026-10-22 08:44 UTC | [Trust page changed](https://rewindex.com/change/p5234.md) | Changed (not classified) | | 2026-10-27 08:45 UTC | [Trust page changed](https://rewindex.com/change/p8726.md) | Changed (not classified) | | 2026-10-29 08:45 UTC | [Trust page changed](https://rewindex.com/change/p10328.md) | Changed (not classified) | | 2026-10-30 08:45 UTC | [Trust page changed](https://rewindex.com/change/p11168.md) | Changed (not classified) | | 2026-11-02 08:45 UTC | [Trust page changed](https://rewindex.com/change/p12967.md) | Changed (not classified) | | 2026-11-04 08:44 UTC | [Trust page changed](https://rewindex.com/change/p14492.md) | Changed (not classified) | Next: [change](https://rewindex.com/change/p4394.md) · All Notion changes: [timeline](https://rewindex.com/company/notion/changes.md) _Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._ ## Cite this Trust page changed on Notion’s Trust page, changed 2026-10-20 12:05 UTC (change 1 of 8). - Canonical URL: https://rewindex.com/change/p3634 - Citation: Notion, “Trust page changed” (2026-10-20 12:05 UTC). Archived by Rewindex: https://rewindex.com/change/p3634 (CC BY 4.0). - Markdown link: `[Notion: Trust page changed (2026-10-20)](https://rewindex.com/change/p3634)` --- Canonical: https://rewindex.com/change/p3634 · Markdown: https://rewindex.com/change/p3634.md · JSON: https://rewindex.com/api/v1/changes/p3634 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-05T13:31:33.167Z