🔍 Read the full analysis: Notion Says AI Chat Exposure Happened Despite A Zero-Retention Promise on ThorstenMeyerAI.com
TL;DR
Notion says a dataset accessed in the Fireworks AI breach included Notion AI chat transcripts used for its Insights feature, even though Fireworks had made a contractual zero-data-retention commitment. Notion says fewer than 1% of workspaces are affected and that it revoked exposed API keys found in affected messages on November 11. It has not identified which Fireworks system retained the data or how long it was stored.
Notion says chat transcripts from its AI service were included in data accessed during the Fireworks AI breach, despite Fireworks having given Notion a contractual commitment to zero data retention. The company says fewer than 1% of Notion workspaces are affected and that, on November 11, it revoked exposed Notion API keys found in affected user messages.
Notion’s expanded security notice says the dataset Fireworks provided to it on November 8 included Notion AI chat transcripts used for the Insights feature. Insights gives workspace administrators information about how their teams use AI. Notion says that, for the vast majority of affected workspaces, the transcripts were “unattributable”: they were not labeled with the author or workspace and did not include tool-call results.
That does not mean the content was necessarily nonsensitive. Notion defines a transcript as input to or output from the model written to the chat. The company advises affected organizations to review the data, since users may have entered sensitive information. It says AI Meeting Notes, including audio, transcripts and summaries, were not affected unless the material was used as an input in a Notion AI chat transcript. Notion says no other features were affected.
Notion says it learned during its investigation that data was retained from the Fireworks endpoints it used. The company’s notice does not identify the system that stored the data or explain how long it remained there. Notion also says that on November 11 it revoked exposed Notion API keys found in affected user messages. It advises affected customers to treat the data as exposed and rotate credentials that may have been pasted into Notion AI.
Notion AI Chats Were Exposed Despite a Zero-Retention Promise
Notion says a dataset accessed in the Fireworks AI breach included chat transcripts used for Insights. The disclosure raises questions about vendor retention and the limits of contractual promises.
What was in the dataset
Notion says the data came from its Insights work, which helps administrators understand how teams use AI.
AI chat transcripts
Transcripts contained model inputs or outputs written to chats.
Limited labels
Most transcripts lacked author and workspace labels and had no tool-call results. They could still contain sensitive content.
Other features
Notion says no other features were affected. AI Meeting Notes were excluded unless used as chat input.
What the retention promise covered
Notion says Fireworks had made a contractual zero-data-retention commitment, yet data from the endpoints Notion used was retained.
- The dataset came from Insights analysis.
- Live-request commitments did not cover uses requiring stored data, such as chat history and Insights.
- Which Fireworks system retained the data.
- Why it was retained and how long it stayed there.
What affected organizations should do
Notion advises customers it has identified as affected to treat the data as exposed.
Assess whether users entered sensitive information or credentials into Notion AI.
Change passwords, API keys, or other credentials that may have been pasted into chats.
Notion says customers without a notice to them or their workspace owner have not been identified as affected.
Why Stored AI Chats Matter
The disclosure matters because organizations may rely on zero-retention commitments when deciding whether employees can submit business information to AI services. In this case, Notion says stored prompts and responses used for Insights were sent to Fireworks for analysis, and that data was retained despite Fireworks’ contractual commitment. The incident shows that a retention promise for live model requests may not cover every feature that handles AI data.
The exposure could have consequences beyond the confidentiality of chat content. Notion specifically says exposed API keys were found in affected messages and reports revoking those keys. Organizations should check whether chats contained other credentials or sensitive details, while distinguishing Notion’s confirmed findings from broader possibilities: the company has not said that every affected transcript contained sensitive information or that every key entered into a chat was exposed.
The reported scope is fewer than 1% of Notion workspaces, not a count of users or transcripts. Notion says it has not identified a workspace as affected if neither the customer nor its workspace owner has received notice. That gives customers a practical indicator, but the company has not published a total number of affected workspaces.
Popular right now
LG 55-Inch QNED73B Mini LED 4K Smart TV (2026)
De'Longhi Stilosa Compact Manual Espresso Machine with Milk Frother
Bose QuietComfort Wireless Over-Ear Noise-Cancelling Headphones, Sandstone
As an affiliate, we earn on qualifying purchases.
How Insights Used Fireworks
Notion says it used Fireworks for two purposes: running classification jobs for Insights and serving open-weight models as a general inference provider inside its product. The exposed dataset came from the Insights work, according to Notion. The company describes the data as stored requests and responses from Notion AI use that were sent to Fireworks for analysis.
Notion’s notice distinguishes that processing from its zero-retention commitments for live requests sent to model vendors to generate Notion AI responses. It says those commitments were not intended to cover uses that require data to be stored, including chat history and Insights. But Notion also says Fireworks had separately made a contractual zero-retention commitment for Notion’s use of its platform. Notion’s investigation found that data was nevertheless retained.
In its own November 9 update, Fireworks said it had not detected an impact to Inference, Training SDK and Nexus, which it described as zero-retention by default. Fireworks also listed datasets among data accessed for certain customers. The published statements do not identify which Fireworks system retained the Notion data or explain how these descriptions fit together.
„Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.“
— Notion, in its updated security notice
Unanswered Questions About Retention
Notion has not said which Fireworks system retained the data, why it was retained despite the contractual commitment, or how long it was stored. The public notices also do not give a total count of affected workspaces, people or transcripts. The stated scope is fewer than 1% of workspaces.
It is also unclear whether other Fireworks customers experienced the same retention issue. Fireworks’ November 9 update describes certain affected customer data and says it had not detected an impact to specified zero-retention services, but neither company has publicly reconciled those statements with Notion’s finding. The available information does not establish that other customers’ data was retained in the same way.
Notion says most affected transcripts were unattributable, but that does not establish that every record was anonymous or free of sensitive content. The company has not published a detailed breakdown of the material in the dataset or of the API keys it revoked.
Customer Reviews and Vendor Audit
Notion says affected workspaces should conduct a security incident review, assess the relevant data and rotate passwords, API keys or other credentials entered into Notion AI during the incident. Customers who have not received a notice from Notion or their workspace owner have not been identified by the company as affected, according to its guidance.
Notion says it is auditing critical vendors, including inference providers and data processors, to check their data-minimization practices and zero-retention policies. Further clarity will depend on additional findings from Notion and Fireworks, including identification of the system involved, the retention period and whether the issue extended beyond Notion’s use of the platform.
Key Questions
What Notion data was included in the dataset?
Notion says the dataset included Notion AI chat transcripts used for Insights, its feature for showing workspace administrators how teams use AI. It says the transcripts included model inputs or outputs written to chats.
How many Notion workspaces are affected?
Notion says fewer than 1% of workspaces are affected. It has not published an exact count of workspaces, users or transcripts.
Does zero retention mean Notion AI chat history is never stored?
No. Notion says its zero-retention commitments for live requests to model vendors do not cover uses that require stored data, such as chat history and Insights. Separately, Notion says Fireworks had made a contractual zero-retention commitment for its use of the platform, but that its investigation found data had been retained.
What should an affected workspace do?
Notion advises affected customers to treat the data as exposed, review it under a security incident review, and rotate any passwords, API keys or other credentials that may have been pasted into Notion AI during the incident.
Were AI Meeting Notes affected?
Notion says AI Meeting Notes, including audio, transcripts and summaries, were not affected unless they were used as input in a Notion AI chat transcript. It says no other Notion features were affected.
Source: ThorstenMeyerAI.com
