eucsoft

Notion

work-management · notion.com · last checked 2026-09-19

Identity

Legal entity—
HQUS
Ultimate ownershipUS
EU contracting entity—
LEI—
US CLOUD Act reachdirect
Sourcetrust.notion.com · 2026-09-17

Data location

RegionEU data locationMinimum planSourceObserved
euEnterprise onlyEnterprise to migrate an existing workspacenotion.com2026-09-18

eu: CORRECTION of our 2026-09-17 reading of unstated. Data region EU-Central-1 (Frankfurt) with backup in EU-West-1 (Ireland). Page states eligible workspace owners may choose a region, and that moving an EXISTING workspace requires the Enterprise plan and the Notion account team.

Subprocessor chain

7 transcribed · 7 with a country outside the EEA

SubprocessorCountryPurposeObserved
AWSUS, EU, KR, JPHosting and storage systems provider2026-09-17
AnthropicGlobalAI agents, hosting large language models and embeddings2026-09-17
Anysource Inc., dba RunlayerUSSecurity for MCP connections2026-09-17
Baseten Labs, Inc.GlobalHosting large language models and embeddings2026-09-17
Cerebras Systems Inc.USHosting large language models and embeddings2026-09-17
CloudflareGlobalContent distribution and processing, security, abuse prevention and DNS2026-09-17
ConfluentUS, DE, KR, JPKafka managed streaming storage for in-product audit log data and analytics2026-09-17

The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.

Assurance

SchemeStatusScopeSourceObserved
C5claimedListed on the Notion trust centre as an annual third-party audittrust.notion.com2026-09-17
HIPAAclaimedListed on the Notion trust centre as an annual third-party audittrust.notion.com2026-09-17
ISO27001claimedListed on the Notion trust centre as an annual third-party audittrust.notion.com2026-09-17
ISO27017claimedListed on the Notion trust centre as an annual third-party audittrust.notion.com2026-09-17
ISO27018claimedListed on the Notion trust centre as an annual third-party audittrust.notion.com2026-09-17
ISO27701claimedListed on the Notion trust centre as an annual third-party audittrust.notion.com2026-09-17
SOC2T2claimedListed on the Notion trust centre as an annual third-party audittrust.notion.com2026-09-17

Claimed means the vendor asserts the certification on its own page and we have not seen the certificate. That is a distinction an auditor makes, so we make it too.

Support window

ProductSupport periodStateSBOMSourceObserved
Notion (SaaS)—Service onlyunknownnotion.so2026-09-18

Documents

What we read, how it was disclosed, and when.
DocumentDisclosureTranscriptionHTTPObserved
trust-centerJavaScript onlypartial2002026-09-17

History

DetectedWhat movedWhySource
2026-09-19
EU data location unstated → enterprise-only
Minimum plan set to Enterprise to migrate an existing workspace
Note rewritten
we read a better pagenotion.com