🔍 Read the full analysis: Could Zero Retention Have Prevented Notion’s AI Transcript Exposure? on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Notion says a dataset accessed in the Fireworks AI breach included Notion AI chat transcripts from fewer than 1% of workspaces. Notion says Fireworks had promised zero data retention, but its investigation found data had been retained; the companies have not disclosed which system stored it or for how long.
Notion’s updated security advisory says Fireworks provided it with a dataset on November 8 that included chat transcripts used for Notion’s Insights feature. Insights helps workspace administrators understand how their teams use AI. Notion says the transcripts from the vast majority of affected workspaces were unattributable: they were not labeled with the author or workspace and did not include tool-call results.
That does not mean the transcripts were necessarily free of sensitive material. Notion defines a transcript as any input to or output from the model that was written to the chat. It advises affected customers to review the data, because chat content could include customer details, contract information, passwords or other credentials. Notion says AI Meeting Notes were not affected unless their audio, transcripts or summaries were used as input in a Notion AI chat, and says no other Notion features were affected.
On November 11, Notion said it revoked exposed Notion API keys found in affected user messages. It says customers whose workspaces it identified as affected should treat the data as exposed, review the incident under its Security incident review guidance, and rotate credentials pasted into Notion AI during the incident. Notion says it has not identified a workspace as affected if neither the customer nor its workspace owner has received a notice from the company.
Could Zero Retention Have Prevented Notion’s AI Transcript Exposure?
Notion says transcripts used for Insights were in a dataset accessed during a Fireworks AI breach. The incident shows why a retention promise, product data practices and actual handling all matter.
What was exposed
The dataset included Notion AI chat transcripts used for Insights, which helps administrators understand team AI use.
Chat content
Transcripts included inputs or outputs written to chat and could contain customer details, contracts or credentials.
Mostly unlabeled
Most affected records lacked author and workspace labels and did not include tool-call results. Their text could still be sensitive.
Limited disclosure
Notion says fewer than 1% of workspaces were affected. It has not given an exact count of workspaces or people.
Why the retention promise fell short
Notion says Fireworks contractually promised zero data retention, but its investigation found data from the endpoints used had been retained.
- Live API requests sent to model vendors to generate responses
- Does not cover data Notion retains for chat history and Insights
- Stored requests and responses were sent to Fireworks for Insights analysis
- Which Fireworks system stored the data
- How long it was retained
- Why retention occurred despite the reported contract commitment
Response and customer review
Notion says it disconnected from Fireworks, deleted its data there and halted training runs after learning of the breach.
Notion says affected customers or workspace owners receive a notice.
Follow Notion’s security incident review guidance and examine affected data.
Change credentials pasted into Notion AI during the incident.
What the disclosures do not establish
The published statements leave important questions open about the records and the breach scope.
- How many people’s messages were included
- Whether attackers accessed or used credentials in messages
- Whether the same issue affected other Fireworks customers
- How Fireworks’ statement about zero-retention-by-default products relates to Notion’s retained Insights data
Why the Retention Commitment Matters
The incident puts a practical limit on what customers may infer from a zero-retention promise. Notion says its own ZDR commitments apply to live API requests sent to model vendors to generate responses. They do not cover data Notion retains to provide features such as chat history and Insights. For Insights, Notion says it sent stored requests and responses to Fireworks for analysis.
Notion also says Fireworks had contractually committed to zero data retention for Notion’s use of its platform, but that its investigation found data had been retained from the endpoints involved. This distinction matters to organizations that send sensitive information through AI services: a vendor’s stated policy, a customer’s product-specific data practices and the actual handling of data by an outside processor are separate questions. The disclosure does not establish that every AI request was retained or exposed.
Notion says it is auditing critical vendors, including inference providers and data processors, to check their data-minimization practices. The incident may prompt customers to ask vendors not only what their contracts promise, but how retention rules apply to stored chat data, analytics features and breach response.
Products Worth Considering
Apple iPad 11-inch (A16), 128GB, Wi-Fi, Silver
Samsung 27-inch Odyssey OLED G6 QHD Gaming Monitor
Kindle Paperwhite Signature Edition 32GB E-Reader, 7-Inch Display, Seaglass Green
As an affiliate, we earn on qualifying purchases.
How Notion Used Fireworks
Notion says it used Fireworks in two ways: to run classification jobs for Insights and as a general inference provider for open-weight models in its product. The transcript data described in the advisory came from the Insights work, rather than from all Notion AI interactions indiscriminately.
Notion’s published timeline says Fireworks told it on the evening of November 2 that malicious actors had accessed a small set of data, initially identified as synthetic testing data. On November 3, Notion says it disconnected its systems from Fireworks, deleted its data from the Fireworks system, stopped communications with the provider and halted training runs. Notion updated its advisory on November 10 and 11 with further information about the dataset.
Fireworks’ own security bulletin, according to the supplied source material, was last updated on November 9. It says the breach involved data accessed for certain customers and that it had not detected an impact to Inference, Training SDK and Nexus, which it describes as zero-retention by default. The published statements do not identify the Fireworks system that retained Notion’s data.
““Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.””
— Notion, in its security notice
What the Investigation Has Not Established
Notion and Fireworks have not publicly identified which Fireworks system retained the data, how long it was stored, or how many people’s messages were included. The available statements also do not explain why data was retained despite Fireworks’ reported contractual commitment or whether the same issue affected other Fireworks customers.
Notion says fewer than 1% of its workspaces were affected, but the disclosure does not give an exact workspace count or a count of individual users. The description of most transcripts as unattributable is limited: it means the records lacked labels identifying the author or workspace, not that the text itself could not contain identifying or sensitive details. The companies have not said whether attackers accessed or used credentials found in messages.
Fireworks says it has not detected an impact to some products that it describes as zero-retention by default. That statement does not resolve how Notion’s Insights data was retained, and the published materials do not reconcile the two accounts. There is not enough information in the disclosures to determine the full scope beyond what Notion has reported.
Vendor Audits and Customer Reviews
Notion says it is auditing critical vendors for compliance with data-minimization practices, including zero-retention policies. It has not provided a date for completing that review or announced further findings. Customers who received an incident notice should follow Notion’s review guidance, examine affected chat content and rotate credentials that may have been entered into Notion AI.
The next material updates would be a clearer account from Notion or Fireworks of the system involved, the retention period and the number of affected records, along with any findings about exposure at other customers. Until the companies provide those details, the stated workspace estimate and Notion’s advice to treat affected data as exposed remain the available guidance.
Key Questions
What Notion data was included in the Fireworks breach dataset?
Notion says the dataset included Notion AI chat transcripts used for its Insights feature. It says most affected transcripts were not labeled with an author or workspace, but their text could still contain sensitive information.
How many Notion workspaces were affected?
Notion says fewer than 1% of workspaces were affected. It has not provided an exact count. The company says it has not identified a workspace as affected if neither the user nor workspace owner has received a notice.
Did zero data retention prevent the exposure?
No. Notion says Fireworks had made a contractual zero-retention commitment, but Notion’s investigation found that data had been retained from the endpoints it used. The companies have not explained which system stored the data or for how long.
Were Notion AI Meeting Notes affected?
Notion says AI Meeting Notes were not affected unless their audio, transcripts or summaries were used as input in a Notion AI chat transcript. It says no other Notion features were affected.
What should customers who received a notice do?
Notion advises affected customers to treat the data as exposed, review it using its Security incident review guidance, and rotate passwords, API keys or other credentials pasted into Notion AI during the incident.
Source: ThorstenMeyerAI.com
