Notion AI leak at Fireworks: the zero-retention promise failed, how to check your workspace

What leaked, and what did not

On 9 November 2026, Notion contacted the owners of affected workspaces and published a security advisory, revised on 10 November “for style and clarity” without changing the facts. The data was stolen not from Notion but from Fireworks AI, a US platform that runs AI models for other companies, as the French tech site Numerama put it on 10 November 2026 (in French). Notion used Fireworks to serve open-weight models and to classify Notion AI chats for Insights, a feature that shows administrators how their teams use AI.

According to the advisory, fewer than 1% of Notion workspaces are affected, and the dataset contains Notion AI chat transcripts used for Insights, mostly “unattributable”, meaning “the chats weren't labeled with who wrote them or which workspace they came from, and the transcripts did not contain tool call results.” Notion states the limit itself: “Beyond what’s in the chat transcript itself, there’s no information tying the chat back to workspaces, users, or companies.”

Whatever someone typed or pasted into the chat is therefore exposed as written: “Any input to or output from the model that was written to the chat is included in that chat transcript”, says the Help Center notice. A client’s name or an API key is enough to identify someone. AI Meeting Notes were not affected unless pasted into a Notion AI chat.

The zero-retention promise did not hold

In the FAQ of its Help Center notice, Notion writes that Fireworks gave it “a contractual commitment to zero data retention for our use of its platform”, then: “Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.”

The same FAQ explains that the Enterprise zero data retention (ZDR) promise covers the API requests sent to model vendors to generate answers, not features that require Notion to store conversations, such as chat history and Insights: “Our zero data retention commitments are not intended to cover these use cases where we are required to retain the data to deliver the feature.” Insights conversations were stored, then sent to Fireworks for analysis, so an Enterprise customer was not covered for this feature.

Fireworks wrote in its first bulletin, published at 10pm Pacific time on 9 October 2026, that it “does not store prompts or outputs by default”. Its update of 9 November 2026 reports that datasets and incomplete models of some accounts were accessed, and that no impact was detected on Inference, Training SDK and Nexus. Neither says which service kept Notion’s conversations. Notion announces an audit of its critical vendors’ retention practices.

Two intrusions at Fireworks, a week to understand

Side by side, the two chronologies show that Notion first believed only synthetic testing data was involved.

Fireworks links the attack to a financially motivated group that sells tokens from hijacked access to large language models, a practice it calls “LLMJacking”, according to its update of 9 November 2026. Notion has disabled Insights and no longer serves open-weight models through Fireworks. On 11 November 2026, the Notion AI settings page read: “Insights is temporarily paused.”

How to check whether your workspace is affected

If neither you nor your workspace owner has heard from Notion, your workspace has not been identified and “no action is needed right now”, according to the Help Center notice; the investigation is ongoing. Insights is a setting of the Business and Enterprise plans, per the settings documentation; Notion does not say which plans were affected.

If you own a notified workspace:

1. Open the review tool on a computer. Sidebar, ? menu, then Security incident review, in a desktop browser with the latest version of Notion. The data is not accessible on mobile.
2. Download the list of affected members (Download affected members): names, emails, membership status, user IDs and the number of affected rows per person.
3. Retrieve the exposed content, if your workspace has a verified domain: affected_content.csv (the text exactly as it was accessed) and affected_content_annotated.csv, which adds record, workspace, user and thread IDs plus an __analysis column that flags potentially sensitive information. Without a verified domain these files are not offered; Notion tells you to contact your account team.
4. Share the review link (Copy link) with affected members: each one sees only their own data.

More step-by-step guides for independent workers are in the Guides section.

Which secrets to rotate, and in what order

Notion asks affected customers to “treat this data as if it were exposed” and to rotate any password, API key or other credential pasted into Notion AI “during the timeframe of the incident”, according to its advisory. In order:

• Revoke first, at the issuer, in the console of the service that issued the key. Fireworks reminds its own customers that “Removing a stored secret alone does not invalidate the underlying credential” in its first bulletin: the same logic applies here.
• Look for what the analysis column may miss: an ordinary password, a contract number, health or employee data. Secret scanners share that blind spot, as a guide on credentials left by Claude Code in GitHub repositories (in French) shows.
• Check the access logs of each service concerned (sign-ins, downloads) before closing the file, as the Fireworks bulletin advises for exposed credentials.

For the future, the Controls tab of Notion AI settings lets owners choose which model providers and models people can use, according to the settings documentation. On 11 November 2026, Notion’s subprocessor list still showed Fireworks, with “Global” as its location. The same Trust Center page states that “Workspace owners on the Enterprise Plan can promptly disable Notion AI features in settings, immediately preventing data from being sent to AI subprocessors.”

Do you have to notify a regulator or your clients?

If an exposed chat contains personal data about clients, candidates or staff: under Article 4(12) of the General Data Protection Regulation (GDPR), unauthorised “access to” personal data is a personal data breach. Article 33(1) then requires the controller to notify the competent supervisory authority “without undue delay and, where feasible, not later than 72 hours after having become aware of it”, unless the breach is unlikely to result in a risk to people’s rights and freedoms. Article 33(5) requires every breach to be documented, notified or not, and Article 34 requires the people concerned to be told when the risk is high.

Who is the controller? Often not you: a freelancer who handles a client’s customer or staff data usually acts as that client’s processor, and Article 33(2) of the GDPR is short: “The processor shall notify the controller without undue delay after becoming aware of a personal data breach.” Tell your client as soon as you have read the file, with what you found. Article 28 explains why Fireworks matters: a processor engages another processor only with the controller’s written authorisation and remains “fully liable” for that other processor’s obligations. Notion started contacting affected workspaces on 9 November 2026.

In France, the authority is the CNIL (Commission nationale de l’informatique et des libertés), France’s data protection authority. Its breach notification page (in French) accepts an initial notification within 72 hours where possible, completed later, and advises notifying when in doubt. Elsewhere in the EU, Article 33 applies with your national authority. The same regulation governs objecting to AI training on your personal data; recruiters storing candidate data will find related duties in the guide to AI CV screening under the CNIL and the EU AI Act.

Outside the EU: the UK rule

The UK kept the same deadline. The ICO (Information Commissioner’s Office), the UK’s data protection regulator, writes in its guide to personal data breaches that a notifiable breach must be reported “without undue delay, but not later than 72 hours after becoming aware of it”, and that a processor must inform its controller. A breach affecting people in EEA countries “will engage the EU GDPR”, so a UK business with European clients may face both regimes. Failing to notify can lead to a fine of up to £8.7 million or 2 per cent of global turnover, according to the same guide.

What is still unknown

Notion gives neither the number of affected workspaces or conversations nor the period covered by the stolen transcripts: its recommendation refers only to “the timeframe of the incident”. Neither company says whether the data was sold or published. One last point: the Help Center FAQ says that Notion once used data volunteered by members of its Learning and Early Access Program (LEAP) “to experiment with training task-specific models on Fireworks”, and that it has halted all training runs; it does not say whether that data was in the stolen dataset. Notion’s Trust Center, for its part, states that “Only synthetic data is used for training”. If Notion or Fireworks revise these facts, this guide will be corrected as set out in the editorial method.