Does Notion Have End to End Encryption? No. Here's What That Means for Your Workspace.

If you manage a business or enterprise Notion workspace and you're asking does Notion have end to end encryption, the answer is no. Notion says so itself. Your data is encrypted at rest and in transit, but Notion holds the keys, not you. That distinction matters more now than it did a year ago, because Notion AI, custom agents, and a new developer platform are all reading across your workspace content at inference time. The encryption question is no longer academic. It's operational.

Key Takeaways

• Notion does not offer end-to-end encryption. Data is encrypted at rest (AES-256) and in transit (TLS 1.2+), but Notion controls the decryption keys, not the customer.
• Notion AI routes workspace content through subprocessors at inference. On Free, Plus, and Business plans, AI providers can retain that data for up to 30 days. Enterprise plans use zero-data-retention APIs with the AI provider, but Notion itself still holds the keys to the underlying content.
• Notion's Enterprise Search documentation uses the phrase "end-to-end encryption between Notion and all sub-processors," which describes server-to-server TLS, not classical E2EE where only the user holds keys. The semantic gap is worth understanding before you check a compliance box.
• The May 2026 Developer Platform launch (Workers, External Agents API, 1M+ custom agents already built) has materially expanded the surface area of content that flows through AI processing, making the absence of E2EE a growing concern rather than a static one.
• Enterprise customers can layer on AWS KMS-based key management for additional control, though independent analyses dispute whether true customer-managed encryption keys (CMEK) are broadly available as of 2026.

What Encryption Does Notion Actually Provide?

Notion encrypts customer data at rest using AES-256 and encrypts data in transit using TLS 1.2 or greater. These are standard, well-understood protections. They prevent someone intercepting network traffic from reading your pages, and they prevent someone stealing a hard drive from Notion's data center from reading raw data off disk.

What they do not do is prevent Notion from reading your data. Notion holds the decryption keys. This is the fundamental difference between encryption-at-rest and end-to-end encryption, where only the communicating endpoints (you and the intended recipient) can decrypt. In an E2EE system, the service provider is cryptographically locked out. In Notion's architecture, Notion theoretically holds the keys to decrypt and access your data.

This is not a secret. Notion's own documentation states plainly that it does not offer end-to-end encryption. The architecture is designed for collaboration, full-text search, real-time syncing, and now AI inference across content. All of those features require server-side access to plaintext. E2EE would break every one of them.

Why Does Notion's Documentation Say "End-to-End Encryption" in Some Places?

Because they're using the term differently than the classical cryptographic definition.

Notion's Enterprise Search security documentation states there is "end-to-end encryption between Notion and all sub-processors for data in transit when using Notion AI." Read that carefully. "Between Notion and all sub-processors" means TLS between Notion's servers and the AI vendor's servers. It does not mean end-to-end from your browser to the final output, with Notion unable to see the content in between.

This is server-to-server transit encryption. It is a real protection. It is also not what most security engineers, compliance officers, or privacy-conscious users mean when they say "end-to-end encryption." The classical definition requires that the service operator cannot access plaintext at any point. Notion can.

I've watched this semantic drift happen across the industry. Vendors adopt the term "E2EE" and then qualify it with a scope that shrinks the guarantee to something much narrower. If you're filling out a vendor security questionnaire and the question asks "Is data end-to-end encrypted?", the honest answer for Notion is no. The honest answer with a footnote is: transit between Notion and its AI subprocessors is encrypted, and data at rest is encrypted, but the provider holds the keys throughout.

How Does Notion AI Change the Encryption Picture?

Substantially. Before Notion AI, the encryption question was about storage and transit. Now it's about inference.

When you use Notion AI features, the relevant content is processed by Notion and its AI subprocessors to generate the response. That means your workspace content leaves Notion's infrastructure and enters a frontier AI provider's infrastructure for processing. The data retention policies differ by plan tier:

• Free, Plus, and Business plans: AI providers can retain your data for up to 30 days.
• Enterprise plans: AI providers use zero-data-retention APIs, meaning data is deleted after processing. Notion's help center confirms that no data is stored with LLM providers for Enterprise workspaces.

That 30-day window on non-Enterprise plans is not a minor detail. It means a frontier AI provider may hold copies of your workspace content for a month. Your internal roadmaps, customer data pasted into pages, financial projections, HR notes. Whatever you fed to Notion AI or whatever Notion AI pulled from your workspace to generate a response.

Enterprise plans close that retention gap with the AI provider, but Notion itself still holds the keys. The content still passes through Notion's servers in plaintext before reaching the AI subprocessor. There is no point in the chain where the data is opaque to the service operator.

What About Notion's Enterprise Key Management?

This is where the story gets complicated, possibly contradictory.

Notion's Trust Center describes a three-layer envelope encryption architecture for enterprise customers: a Customer Managed Key (CMK), a Workspace Encryption Key (WEK), and Data Encryption Keys (DEK). The claim is that enterprise customers can manage their own encryption keys through AWS Key Management Service, with the ability to revoke Notion's access at any time.

However, an independent enterprise-IT analysis published in May 2026 states that encryption is managed by Notion and that customer-managed encryption keys (CMEK) are not available as of 2026.

I can't resolve that contradiction from public documentation alone, and neither can you. That itself is the problem. If you're running a compliance-sensitive workspace and you can't get a consistent answer from the vendor's own published materials about whether you actually custody your own keys, that's a signal. Either the feature exists with limited rollout and unclear documentation, or the documentation is ahead of the implementation. Neither is great for a security review.

Even in the best case, where CMK through AWS KMS is fully operational, this still is not end-to-end encryption in the classical sense. Notion's servers must decrypt content to serve it to your browser, to index it for search, and to pass it to AI subprocessors. Key management gives you a kill switch (revoke the CMK and Notion can't decrypt), but it does not prevent Notion from accessing plaintext during normal operation.

How Does the New Developer Platform Affect Data Exposure?

In May 2026, Notion launched a Developer Platform that introduced Workers (a hosted custom-code runtime), an External Agents API, and the ability for third-party agents to operate inside your workspace. Customers had already built over 1 million agents since the Custom Agents feature launched in February 2026.

Each of those agents is a new path through which workspace content flows to an AI model for processing. Workers deployment is available across all plan tiers for the CLI, while deploying and managing Workers is limited to Business and Enterprise plans, so the expanded surface area primarily affects the tiers where the data is most sensitive.

The privacy question about Notion is no longer a static audit. Every new agent, every new Worker, every external agent connected through the API expands the set of processing paths that touch your content. Governance controls have been shipped alongside this expansion (per-agent spending caps, unusual-spend detection, agent-creation permissions), but those are administrative controls, not cryptographic ones. They govern who can create agents and how much they can spend, not whether the content those agents process is encrypted in a way that excludes the platform operator.

What Controls Does Notion Offer Instead of E2EE?

Notion's enterprise security model is built around governance tools rather than cryptographic privacy guarantees. Enterprise provisions include:

• DLP integrations that can recognize sensitive data (credit card numbers, PHI, secret codes), trigger automated redaction, and alert on external sharing. Integrations with Nightfall AI and Polymer are documented.
• SOC 2 Type II and ISO 27001 certifications.
• Audit logs, SSO, SCIM provisioning.
• Data residency options.
• The aforementioned (disputed) AWS KMS key management.

These are real controls. For many organizations, they are sufficient. SOC 2 Type II means an independent auditor has verified that Notion's security practices meet the trust services criteria over a sustained period. DLP integrations let you catch sensitive data before it leaks. Audit logs let you see who accessed what.

None of these are a substitute for E2EE. They are organizational and procedural controls, not cryptographic ones. They depend on Notion implementing and maintaining them correctly. E2EE, by contrast, makes correctness a mathematical property rather than an operational one: the service provider cannot access plaintext even if their internal controls fail, because they never held the keys.

Does the Absence of E2EE Matter for Your Use Case?

It depends on what you're storing.

If your Notion workspace contains project plans, meeting notes, product specs, and marketing copy, the combination of AES-256 at rest, TLS in transit, SOC 2 certification, and DLP integrations is probably adequate. Most SaaS tools your company uses (your CRM, your ticketing system, your email provider) operate under the same model: encrypted at rest, encrypted in transit, provider holds the keys.

If your workspace contains material covered by attorney-client privilege, patient health information under HIPAA, financial data subject to regulatory examination, or trade secrets whose exposure would be existential, the absence of E2EE is a gap you should evaluate deliberately. Several independent reviewers have converged on the recommendation that sensitive personal data (health, financial, legal) should be kept in systems with stronger cryptographic guarantees, not in Notion.

The Notion AI layer sharpens this. Before AI features, your data sat in Notion's database and was served to authenticated users. Now, subsets of your data are routinely shipped to frontier AI providers for inference. On non-Enterprise plans, those providers can retain it for up to 30 days. The blast radius of a key compromise or a subprocessor incident is wider than it was two years ago.

Why Is E2EE Hard for Collaboration Tools?

There is a real engineering reason Notion doesn't offer E2EE, and it's worth understanding rather than just criticizing.

End-to-end encryption requires that the server never sees plaintext. But Notion's core value proposition depends on server-side operations over your content: real-time collaboration (the server merges edits from multiple users), full-text search (the server indexes your content), AI features (the server sends your content to a model for inference), permissions (the server decides which users can see which pages), and link previews, embeds, and integrations (the server fetches and renders external content in context).

You can do some of these client-side, in theory. Signal does E2EE messaging with server-side delivery but client-side decryption. But Signal doesn't need to let you search across 10,000 messages server-side, or let five people edit the same message simultaneously, or run an AI model over your message history to generate a summary. Every one of those features requires the server to read the content.

This is not an excuse. It is a constraint. Building a collaboration tool with true E2EE requires rethinking every feature that touches content, and most vendors have decided the tradeoff isn't worth it. That's a product decision, not a security one. It means choosing collaboration convenience over cryptographic privacy.

A note from building encrypted systems

We've spent real time debugging encrypted-at-rest systems, and there's a thing you learn quickly: you debug through the application, never through the column. When data is encrypted at rest, you can't just query the database directly and eyeball the values. You have to go through the application layer, which has the decryption logic. This sounds obvious, but it changes how you build everything: logging, monitoring, error handling, migration scripts. Every tool that used to peek at raw data now has to go through the front door.

That experience is part of why we take the encryption-model question seriously for our own product. With Selina, files and transfers (SelinaSend) are zero-knowledge encrypted. Memory is not end-to-end encrypted; it's encrypted at rest, but a slice of each request reaches a frontier provider at inference. We state that limit plainly because we've seen what happens when vendors blur the line.

What Should You Do If You Need Stronger Guarantees?

A few concrete options, depending on your situation:

Segment your data. Use Notion for collaboration content that doesn't require cryptographic privacy. Keep regulated data, trade secrets, and legally privileged material in systems built for stronger guarantees (encrypted vaults, E2EE document stores, or on-prem systems with customer-managed keys that you've verified independently).

Disable Notion AI for sensitive workspaces. If you're on an Enterprise plan, you can control AI feature access at the workspace level. Turning off AI for a workspace eliminates the subprocessor data-flow path for that content. This reduces the surface area but doesn't change the underlying key-custody model.

Audit the AI agent surface. With over a million custom agents built on the platform and the new External Agents API letting third-party agents into your workspace, you should know exactly which agents have access to which pages. The admin controls for agent-creation permissions and spending caps are a start, but you also need to review which data sources each agent is configured to read.

Ask Notion directly about CMEK. Given the contradiction between Notion's Trust Center claims and independent analysis about whether customer-managed encryption keys are actually available, don't rely on published documentation. Get it in writing from your account team, with specifics about implementation timeline, key-rotation procedures, and what happens to AI inference when the CMK is revoked.

Read the subprocessor list. Notion publishes its security practices, including information about subprocessors. Know who is handling your data at inference time. The retention policies differ by plan, and the specific subprocessors may change.

Where Does This Leave Notion for Enterprise Use?

Notion is a collaboration tool. It is a good one. It is not a privacy vault. Those are different products solving different problems, and conflating them leads to bad security decisions in both directions: either rejecting Notion for work it's perfectly fine for, or trusting it with data it was never designed to protect at the level you need.

The expansion into AI agents, Workers, and developer APIs makes the workspace more powerful and more exposed simultaneously. Multiple independent analyses land in the same place: Notion's security is adequate for general business collaboration and inadequate for data requiring true cryptographic privacy from the platform operator.

If your compliance framework requires that the SaaS vendor cannot access plaintext content under any circumstances, Notion does not meet that requirement. No amount of DLP tooling, SOC 2 certifications, or governance controls changes the underlying key-custody model. The vendor holds the keys. That's the architecture.

For everything else, Notion's security posture (AES-256 at rest, TLS 1.2+ in transit, SOC 2 Type II, ISO 27001, DLP integrations, audit logs, and Enterprise-tier zero-data-retention with AI providers) is in line with or above the industry standard for SaaS collaboration tools. Just don't call it end-to-end encrypted, because it isn't.

If you want an AI assistant where files and transfers are zero-knowledge encrypted, start a free 7-day trial of Selina, no card required.

Michael C.

Founder & Principal Engineer, Selina Labs

Michael builds Selina, a privacy-first AI that remembers you across conversations. He ships security-sensitive AI in production — real attacks, real fixes, measured in minutes and dollars — and writes about privacy, security, and LLMs from that seat. Top Rated Plus and expert-verified on Upwork.

• www.upwork.com
• x.com
• medium.com
• selinalabs.io