This tool is not currently part of our weekly active audit cycle
You are viewing historical data. We actively monitor only the top 20 enterprise AI tools. If you need a fresh, up-to-date risk intelligence report for Notion, let us know and we'll prioritize it.
Verified Compliance Facts
Cited and timestamped — every claim traceable to an official vendor source.
Enterprise Verdict
Detailed community analysis available in report body
Critical Unpatched Vulnerability: Notion Web Clipper Dirty NIB Attack
Risk Assessment
Seven-category enterprise risk analysis derived from community and vendor signals. Each card shows the evidence tier and the underlying finding.
Medium risk — DPA available but specific data handling clauses need review. Derived from aggregated community data.
Organizations should verify directly with the vendor.
Medium risk — limited reliability data; monitor SLA adherence. Derived from aggregated community data.
Medium risk — some export options exist but depend on vendor cooperation. Derived from aggregated community data.
Medium risk — some AI governance signals found but not fully verified. Derived from aggregated community data.
Vendor financial stability score: 65/100. Total funding raised: $343M. Enterprises should negotiate fixed-rate contracts and monitor pricing changes.
Due Diligence Alerts
Priority reviews, recommended inquiries, and verified strengths — based on 218+ community data points
CVE-2024-23745 (CVSS 9.8) indicates a critical vulnerability in Notion Web Clipper 1.0.3(7) susceptible to the Dirty NIB attack, allowing arbitrary command execution. This poses a severe risk to endpoint security.
CVE-2020-10594 (CVSS 9.1) highlights a critical issue in drf-jwt 1.15.x, allowing attackers with invalidated tokens to obtain new, working tokens via the refresh endpoint, bypassing blacklist protection.
The vendor's public documentation does not explicitly state whether customer data is excluded from AI model training for non-Enterprise plans, requiring a written opt-out DPA.
Notion's terms lack specific data retention timeframes and automated deletion commitments, posing a significant compliance risk for GDPR/CCPA regulated entities.
Community reports indicate persistent mobile app glitches, crashes, and instances of data loss, severely impacting user experience and data integrity on mobile devices.
Security & Compliance
Data Security
Security Features
IT Hardening Guide
Critical Settings
Deployment Checklist
Legal & IP Risk
IP Ownership
Liability & Indemnification
Exit Terms
ToS Red Flags
Exposes enterprise data to potential use in AI model training without explicit consent or opt-out, creating significant privacy and IP risks.
Lack of clear data retention and deletion policies complicates compliance with data protection regulations like GDPR and CCPA.
Absence of explicit IP indemnification clauses leaves the enterprise exposed to legal liabilities arising from third-party IP claims related to Notion's service.
Ambiguity regarding ownership of content generated within Notion, especially with AI features, could lead to disputes over intellectual property.
Lack of transparency on liability limits and service warranties increases financial exposure for the enterprise in case of service failures or damages.
Data & Migration Lock-in Risk
- Proprietary data format within Notion databases and pages.
- Deep integration of workflows and knowledge bases within the Notion ecosystem.
- Reliance on Notion's AI features for automated tasks, which may not be easily transferable.
- Opaque data export terms and lack of explicit transition assistance.
Enterprise Contract Intelligence
DPA availability, data residency, and contract risk signals for procurement teams
Notion provides a Data Processing Addendum (DPA) that outlines its data privacy processes and compliance with GDPR and CCPA. However, specific details regarding AI training data opt-out for non-Enterprise plans and explicit data retention timelines require further clarification and negotiation.
Notion offers data residency options for US and EU regions, which is critical for compliance with regional data protection laws. While EU hosting is available, the default region is inferred to be the US. Customers should verify their specific data residency requirements and ensure proper configuration to meet compliance obligations, especially concerning cross-border data transfers.
⚠ 5 contract risk flags — click to review
Notion's contract terms present a high lock-in risk. Key area warranting further due diligences include inferred unilateral ToS change rights, potential vendor use of data for AI training without explicit opt-out, and a lack of clear data portability guarantees on exit. These clauses significantly increase legal exposure and switching costs for enterprise customers. A thorough legal review and negotiation of custom terms are essential.
Community Evidence
Sentiment analysis and recurring issues from developer & enterprise community signals this week.
Recurring Issues
Enterprise Impact: Reported by community on GitHub with 1 comments.
Enterprise Impact: Reported by community on GitHub with 1 comments.
Enterprise Impact: Reported by community on GitHub with 1 comments.
Enterprise Impact: Reported by community on GitHub with 1 comments.
Enterprise Impact: Discussed on Hacker News.
Enterprise Impact: Discussed on Hacker News.
Source Highlights This Week
Specific signals from GitHub, Hacker News, and Reddit — what the community is actually saying
Analysis Pending
Community signals collected this week. Analysis and synthesis will be available in the next report update.
Financial Impact Panel
Cost intelligence and pricing signals for enterprise procurement decisions
Pricing Tiers
Free
- Trial AI capabilities
- Basic forms
- Publish Notion page to web
Plus
- Everything in Free
- Remove Notion branding
- Custom forms
- Unlimited charts
- Unlimited collaborative blocks
- Unlimited file uploads
Business
- Everything in Plus
- Notion Agent
- AI Meeting Notes
- Enterprise Search Beta
- SAML SSO
- Granular database permissions
- Private teamspaces
- Domain verification
Enterprise
- Everything in Business
- Zero data retention with LLM providers
- User provisioning (SCIM)
- Advanced security & controls
- Audit log
- Customer success manager
- Security & Compliance integrations (DLP, SIEM)
- Domain management
- Custom Agents
Pricing Observations
Pricing is tiered, with significant enterprise features (SSO, audit logs, zero data retention) locked behind Business and Enterprise plans. The 'Plus' tier is €9.50/member/month, which converts to approximately $10.26 USD. The 'Business' tier is €19.50/member/month, converting to approximately $21.06 USD. Custom Agents incur additional costs based on credit consumption, which can be unpredictable. The lack of transparent enterprise API rate limits could lead to unexpected costs.
Pricing data from public sources — enterprise rates differ. Verify with vendor.
TCO Calculator
Calculate the real monthly cost for your team. Adjust seats, usage, and pricing tier below.
Estimated Monthly Cost
Synthesized from 20+ independent public sources: developer forums & repositories, security databases, vendor disclosures, regulatory filings, and community review platforms. Not affiliated with any vendor. Corrections?
Download PDF Report
Create a free account to download the full enterprise audit PDF.
Sign up — it's free →Already have an account? Log in