🔍 Read the full analysis: Notion Says AI Transcripts Were Exposed Despite A Retention Promise on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Notion says chat transcripts used for its Insights feature were included in data accessed during a breach at AI provider Fireworks. The company says fewer than 1% of Notion workspaces are affected and that it revoked exposed API keys found in affected messages on November 11. Notion says Fireworks had promised zero data retention, but data from the endpoints Notion used was retained; how and for how long remains unknown.
Notion says chat transcripts from its AI Insights feature were included in data accessed by attackers during a breach at its vendor Fireworks AI, even though Fireworks had given Notion a contractual commitment to zero data retention. Notion says fewer than 1% of workspaces are affected and that on November 11 it revoked exposed Notion API keys found in affected user messages.
In an updated security advisory and help page, Notion said a dataset Fireworks provided on November 8 included Notion AI chat transcripts used for Insights, a feature that gives workspace administrators information about how teams use AI. Notion says the exposed data came from its Insights use of Fireworks, not from the separate role Fireworks had as a general inference provider for open-weight models in Notion products.
Notion describes most affected transcripts as unattributable: they were not labeled with the author or workspace and did not include tool-call results. But the company says a transcript includes any input or output written to the chat. That means its contents could still include sensitive information entered by users. Notion recommends reviewing affected data and treating it as exposed.
Notion said it identified fewer than 1% of workspaces as affected. It also said that on November 11 it revoked exposed Notion API keys found in affected user messages. The company advises affected users to review the incident guidance and rotate passwords, API keys or other credentials they may have pasted into Notion AI during the incident.
Notion AI transcripts were exposed despite a retention promise
Notion says chat transcripts used for Insights were included in data accessed during a breach at AI provider Fireworks. The incident raises questions about vendor retention promises and what users enter into AI chats.
What was exposed
Notion says the accessed dataset included transcripts from its Insights feature.
Chat inputs and outputs
A transcript includes anything written to the chat, so it may contain sensitive details or credentials.
Often unattributable
Notion says most affected transcripts lacked author and workspace labels and did not include tool-call results.
How the response unfolded
What the promise covered
Notion says Fireworks had promised zero data retention, but data from the endpoints used for Insights was retained.
- The agreement promised zero data retention.
- Insights requests and responses were sent to Fireworks for analysis.
- Live model requests and stored feature data are distinct use cases.
- Which Fireworks system retained the data.
- How long it was kept or why retention occurred.
- Whether other Fireworks customers were affected.
What customers can do
Notion advises affected users to treat the data as exposed and review it individually.
- Review the incident guidance and affected data.
- Rotate passwords, API keys and other credentials that may have been pasted into Notion AI.
- Notion says it is auditing critical vendors for data-minimization practices.
The Limits of the Retention Promise
The disclosure matters because zero data retention can shape how organizations assess the privacy risks of using AI services. Notion says its Fireworks agreement promised that data would not be retained, but its investigation found that data from the endpoints it used had in fact been retained. The incident raises a practical question for customers: whether a contractual commitment accurately reflects how a vendor’s systems handle their data.
Notion’s notice also draws a distinction between live requests sent to model vendors and data stored to support product features. The company says its zero-retention commitments for live model requests do not cover use cases such as chat history and Insights, where it retains information to provide the feature. For Insights, Notion says stored requests and responses were sent to Fireworks for analysis. That distinction may matter to organizations deciding what employees can enter into AI tools and what assurances they need from vendors.
The reported scope is limited to fewer than 1% of workspaces, according to Notion, but the contents of individual transcripts may vary. A transcript could include ordinary questions or sensitive details such as customer information, contract material or credentials. The company’s advice to assess affected data individually reflects that range.
Popular right now
Vitamix VX1 Professional-Grade Blender, 64 oz, Black
Vitamix 5200 Professional-Grade Blender
Dyson V8 Motorhead Origin Cordless Vacuum
As an affiliate, we earn on qualifying purchases.
How Fireworks Fits the Incident
Notion’s November update follows a breach at Fireworks AI, a provider it used for more than one product function. Notion says Fireworks first notified it on November 2 that a small amount of data had been accessed by malicious actors. Notion initially understood that data to be synthetic testing data. It says it disconnected its systems from Fireworks on November 3, deleted its data in the Fireworks system and halted training runs.
Notion’s account then changed as the investigation developed. It says Fireworks provided a dataset on November 8 that included the Insights transcripts. Notion updated its security materials on November 10 and 11 to describe the newly identified exposure and its response. Fireworks’ own bulletin, as cited in the source material, was last updated November 9 and says it had not detected an impact to Inference, Training SDK and Nexus, which it describes as zero-retention by default. It also lists datasets among information accessed for certain customers.
The two companies’ published statements do not identify which Fireworks system retained Notion’s data or explain how that retention occurred. Notion says it has disconnected from Fireworks, while Fireworks’ public update distinguishes its products and systems. The available notices do not establish a more specific technical explanation.
“Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.”
— Notion, in its updated security notice
What the Notices Do Not Explain
The public notices do not say which Fireworks system retained Notion’s data, how long it was kept or why the retention happened despite the stated commitment. They also do not provide an exact number of affected people or workspaces beyond Notion’s estimate that the affected share is below 1% of workspaces.
It remains unclear whether the same retention issue affected data belonging to other Fireworks customers. Fireworks says it has not detected an impact to some named services that are zero-retention by default, while also saying datasets were among the information accessed for certain customers. The published information does not reconcile those statements with Notion’s account, so the specific system and circumstances remain unconfirmed.
Notion says affected transcripts were generally unattributable, but that does not establish that every transcript lacked identifying or sensitive content. The company’s notice says users may have entered such material directly into chats. The precise content of exposed records, and whether any credentials beyond the API keys Notion says it revoked were present, has not been disclosed.
Vendor Audit and Customer Reviews
Notion says it is auditing critical vendors, including inference providers and data processors, to check their data-minimization practices and retention policies. The company has not given a completion date for that review or said when it expects to publish further findings.
For customers who have been notified, Notion recommends treating the data as exposed, reviewing it under its Security incident review guidance and rotating passwords, API keys and other credentials that may have been pasted into Notion AI. Notion says workspaces it has identified as affected have been notified; users who have received no notice have not been identified by the company as affected.
Further clarity depends on additional information from Notion and Fireworks about the retained data, the system involved and the breach investigation. Until those details are published, the scope beyond Notion’s stated workspace estimate and the possible effect on other Fireworks customers remain unresolved.
Key Questions
What Notion data was exposed?
Notion says a dataset accessed during the Fireworks breach included chat transcripts used for its Insights feature. It says transcripts contain inputs and outputs written in the chat, which may include sensitive information.
How many Notion workspaces are affected?
Notion says fewer than 1% of workspaces are affected. It has not published an exact count in the source material.
Did Notion AI Meeting Notes data get exposed?
Notion says AI Meeting Notes, including audio, transcripts and summaries, were not affected unless that material was used as an input in a Notion AI chat transcript.
What should affected users do?
Notion advises affected users to treat the data as exposed, review it using its Security incident review guidance and rotate credentials they may have entered into Notion AI. Notion also says it revoked exposed Notion API keys found in affected user messages on November 11.
Why is the zero-retention commitment in question?
Notion says Fireworks had given it a contractual zero-retention commitment, but Notion’s investigation found that data was retained from the Fireworks endpoints it used. The companies have not said which system retained it or for how long.
Source: ThorstenMeyerAI.com
