AI tools and client data
Is Notion AI safe for client data?
Short answer: Whether Notion AI is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself. On Free, Plus and Business and on Enterprise, Notion says it does not train its models on what staff type, by default. Every fact on this page is Notion's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap. Obsidian Ridge's free 30-day AI security assessment shows which AI tools your staff actually use.
See which AI tools your staff usePlan by plan, in Notion’s own words
The assistant inside a Notion workspace, answering from the pages and databases a person can already open — which in a small practice is often everything.
| What you are asking | Free, Plus and Business | Enterprise |
|---|---|---|
| Trains the vendor's models by default | No, by default. Notion says neither it nor its AI providers train on customer data, and that its contracts forbid it.“By default, neither Notion nor our AI providers use your Customer Data to train any models.” source, read | The same no-training statement, which Notion says flows through to every provider in the chain.“all are bound by the same contractual commitments including our no-training and data-handling requirements.” source, read |
| How to turn training off | Not found in the pages we read. | Not found in the pages we read. |
| How long data is kept | Thirty days or fewer at the AI provider, on these plans.“Free, Plus, and Business: AI provider retains your data for 30 days or fewer, then deletes it.” source, read | Mostly nothing retained, but not for every model — and the exceptions need an owner's decision.“Most models we use offer zero data retention (ZDR), meaning they process your data only to generate a response and keep nothing afterward.” source, read |
| What an admin can see or control | Not found in the pages we read. | The models that do retain data are off until someone turns them on. That is the setting to check.“These models are off by default and the workspace owner must opt in to use these models.” source, read |
| Single sign-on | Not found in the pages we read. | Business or Enterprise, configured by a workspace owner against a verified domain.“Your workspace must be on a Business Plan or Enterprise Plan.” source, read |
| Business Associate Agreement | Not found in the pages we read. | Enterprise plan only. Notion also puts its beta services outside the agreement.“To be eligible to sign Notion's BAA, you must subscribe to our Enterprise Plan.” source, read |
| Where the data is processed | Not found in the pages we read. | Not found in the pages we read. |
An empty cell is not a reassurance and not a criticism. "Not found in the pages we read." means the Notion pages listed under Sources, read on the dates shown, do not answer it — so there is nothing for us to repeat, and something for you to ask Notion before client information goes near it.
What this means for
The duty does not change because the tool is new. What changes is where the client information ends up.
- Law firms. A client confidence pasted into a personal account has left the firm’s control. Our law firm page sets out the duties we build evidence for; the decision here is whether a personal account may touch a client matter at all.
- Dental and medical practices. Notion publishes a BAA position for this product, which is where that conversation starts. See dental practices.
- CPA and accounting firms. Your written information security plan has to describe the tools people actually use, not the ones you approved. See accounting firms.
- Financial advisers. Client account data in a personal assistant is the exposure; see financial advisers.
- Software teams. A coding assistant reads the repository and can run commands, so the question is what it can reach, not what it was asked. See what AI agents on work laptops can reach.
How to tell which version your staff use
The plan is the whole answer, and you cannot tell from the outside. Three ways to find out, in order of how much they prove.
1. Ask
Quick, free, and incomplete. People forget the tool they installed once and the account they signed in with.
2. Look at the billing and the admin console
This finds what the business pays for. It does not find a personal account, which is the one that matters here.
3. Look on the computers
A tool somebody installed themselves never appears in an IT list. Obsidian Ridge’s free 30-day AI security assessment takes a quiet inventory for 30 days and shows what each tool could reach, then a CISSP goes through it with you. See the assessment, or read a sample set of findings.
Settings to check today
From Notion’s own documentation. Each one is a change somebody can make this afternoon.
- Fix page permissions first. Notion AI reaches whatever the person can already open, which in a small workspace is usually everything.“Notion AI can only ever use content you give it access to.” source, read
- Check whether anyone has turned on a data-retaining model for a feature that needs one.“Notion will make available Workspace settings to enable administrators to turn on data-retaining LLMs.” source, read
Worth knowing
- An Enterprise workspace owner can search the workspace's own content, which is the answer to who can read what staff wrote.“Content search provides Enterprise workspace owners with visibility into workspace content to improve governance of the workspace and resolve page access issues.” source, read
- A practice that signs the agreement still has to keep patient information out of anything Notion labels beta.“Any Beta Services are not covered by the BAA and therefore may not be used or deployed in a manner that processes protected health information.” source, read
Questions we get asked
Is Notion AI safe for client data?
Whether Notion AI is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself.
On Free, Plus and Business and on Enterprise, Notion says it does not train its models on what staff type, by default.
Every fact on this page is Notion's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap.
Does Notion train its models on what our staff type into Notion AI?
On Free, Plus and Business and on Enterprise, Notion says it does not train its models on what staff type, by default. On Free, Plus and Business: No, by default.
Notion says neither it nor its AI providers train on customer data, and that its contracts forbid it. Notion's own words: "By default, neither Notion nor our AI providers use your Customer Data to train any models." (read 2026-11-02).
On Enterprise: The same no-training statement, which Notion says flows through to every provider in the chain.
Notion's own words: "all are bound by the same contractual commitments including our no-training and data-handling requirements." (read 2026-11-02).
How long does Notion keep what we put into Notion AI?
On Free, Plus and Business: Thirty days or fewer at the AI provider, on these plans. Notion's own words: "Free, Plus, and Business: AI provider retains your data for 30 days or fewer, then deletes it." (read 2026-11-02).
On Enterprise: Mostly nothing retained, but not for every model — and the exceptions need an owner's decision.
Notion's own words: "Most models we use offer zero data retention (ZDR), meaning they process your data only to generate a response and keep nothing afterward." (read 2026-11-02).
Can an administrator read what our staff typed into Notion AI?
The models that do retain data are off until someone turns them on. That is the setting to check. Notion's own words: "These models are off by default and the workspace owner must opt in to use these models." (read 2026-11-02).
Will Notion sign a Business Associate Agreement for Notion AI?
Enterprise plan only. Notion also puts its beta services outside the agreement. Notion's own words: "To be eligible to sign Notion's BAA, you must subscribe to our Enterprise Plan." (read 2026-11-02).
A signed BAA is between your practice and Notion; we do not sign it for you, and we do not read a compliance badge as one.
How do we find out which version of Notion AI our staff are using?
Look on the computers. A tool somebody installed themselves, or signed into with a personal account, does not appear in any IT list. Obsidian Ridge's free 30-day AI security assessment takes that inventory for 30 days and shows what each tool could reach.
Sources
Notion’s own pages, with the date each was read. Nothing on this page comes from anywhere else.
- notion.com/help/notion-ai-security-practices, read
- notion.com/help/saml-sso-configuration, read
- notion.com/help/hipaa, read
All 15 tools, side by side, or run the AI tool risk checker over the ones you know about.
Other tools people ask about
Same question, different answers. The ones in the same category are the ones staff swap between.
Is GitHub Copilot safe for client data?
Coding assistant · GitHub
Is ChatGPT safe for client data?
General assistant · OpenAI
Is Microsoft Copilot safe for client data?
General assistant · Microsoft