Notion SOC 2 status and provider evidence

and security, and processes data only under our instructions.Subprocessor List→Privacy-by-DesignNotion embeds privacy by design across the data lifecycle, with controls aligned to GDPR and CCPA and independently attested to against ISO 27701 and ISO 27018.CCPANotion complies with California privacy laws, including CCPA and CPRA, which grant rights such as data access, deletion, and opt-out of data sale.GDPRNotion is aligned with the General

tion, and opt-out of data sale.GDPRNotion is aligned with the General Data Protection Regulation (GDPR), ensuring transparency, accountability, and user control over personal data.HIPAA and HITECHBusinesses subject to HIPAA can leverage Notion's Enterprise-grade HIPAA security features, with a Business Associate Agreement (BAA) available to Enterprise customers.HIPAA configuration→Contact us about security issues: [email protected]→Contact u

management (MDM) system allowing for remote wipe and block capabilities.ComplianceAudit and ComplianceNotion undergoes multiple, annual, industry standard audits including SOC 2, ISO 27001, ISMAP, BSI C5, and more! All audit reports are available on the Notion Trust Center.Visit the Notion Trust Center→Annual Penetration TestingAnnual, external, third-party performed penetration tests against the Notion Web, Mobile, Desktop and Calendar applica

device management (MDM) system allowing for remote wipe and block capabilities.ComplianceAudit and ComplianceNotion undergoes multiple, annual, industry standard audits including SOC 2, ISO 27001, ISMAP, BSI C5, and more! All audit reports are available on the Notion Trust Center.Visit the Notion Trust Center→Annual Penetration TestingAnnual, external, third-party performed penetration tests against the Notion Web, Mobile, Desktop and Calen