🔍 Read the full analysis: How A Fireworks Breach Challenged Notion’s AI Data Retention Promise on ThorstenMeyerAI.com
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Notion says data accessed in the Fireworks AI breach included stored chat transcripts used for its Insights feature, affecting fewer than 1% of Notion workspaces. The company says Fireworks had contractually promised zero data retention, but its investigation found data from the endpoints Notion used had been retained. Notion has revoked exposed API keys and says it is reviewing affected data and its vendors.
Notion says attackers accessed a dataset containing Notion AI chat transcripts in the breach at AI provider Fireworks, and that data had been retained from Fireworks endpoints despite a contractual zero-data-retention commitment. Notion estimates that fewer than 1% of its workspaces were affected and says it revoked exposed Notion API keys found in affected user messages on November 11.
In its updated security advisory and Help Center notice, Notion said a dataset Fireworks provided on November 8 included Notion AI chat transcripts used for the Insights feature. Insights gives workspace administrators information about how teams use AI. Notion said the transcripts for most affected workspaces were “unattributable”: they were not labeled with the author or workspace and did not include tool-call results.
That description does not mean the content was necessarily harmless or anonymous in every practical sense. Notion defines a transcript as input to or output from the model written to the chat, and advises affected customers to review the data because it could contain sensitive information. The company says fewer than 1% of Notion workspaces were affected; it has not given a count of people or workspaces.
Notion said it revoked exposed API keys found in affected user messages on November 11. It advises affected customers to treat the data as exposed, review it under its Security incident review guidance, and rotate passwords, API keys or other credentials that may have been pasted into Notion AI during the incident. Notion says AI Meeting Notes were not affected unless their content was used as an input in a Notion AI chat transcript, and that no other Notion features were affected.
Fireworks breach challenged Notion’s retention promise
Stored Notion AI chat transcripts used for Insights were accessed after data was retained by Fireworks, despite a contractual zero-retention commitment.
What data was involved
Notion says the exposed dataset came from Insights analysis, not general inference.
Inputs and outputs
Transcripts included text users sent to Notion AI and model responses written to chat.
Often unattributable
Most affected transcripts lacked author and workspace labels, but messages could still contain sensitive details.
The retention gap
Notion says the data came from stored requests and responses sent for Insights.
- Fireworks contractually promised zero data retention for Notion’s platform use.
- Notion says live inference and stored data for product features follow different workflows.
- Notion’s investigation found data retained from the Fireworks endpoints it used.
- The notices do not identify which system retained it or for how long.
Response and customer action
Notion says it disconnected from Fireworks, deleted its data there, and halted training runs after notification.
Treat the data as exposed and check for confidential content or credentials.
Change passwords, API keys, or other credentials pasted into Notion AI during the incident.
Notion says it is auditing critical vendors and data processors for data-minimization practices.
What the Retention Failure Means
The incident puts a practical limit on what customers may infer from a zero-data-retention promise. Notion says its commitment for live requests to model vendors covers requests used to generate Notion AI responses, but not stored data needed for features such as chat history and Insights. For Insights, Notion says it sent stored requests and responses for analysis, and Fireworks had separately made a contractual zero-retention commitment for Notion’s platform use.
Notion’s investigation found that data from the Fireworks endpoints it used was retained. That makes the issue more than a question of whether a vendor’s standard inference service is configured for zero retention: customers also need to understand how data is handled in separate workflows that support analytics or other product features. Notion says it is auditing critical vendors and data processors to check their data-minimization practices, including retention policies.
For affected organizations, the immediate concern is the content users entered into AI chats, including any credentials or confidential details. Notion’s description that most transcripts could not be tied directly to a workspace may reduce direct identification in the dataset, but it does not rule out sensitive content within the messages themselves. The company’s recommendation to review affected data reflects that distinction.
Products Worth Considering
Kindle Paperwhite Signature Edition 32GB E-Reader, 7-Inch Display, Seaglass Green
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
Bose TV Speaker (2nd Gen) Compact Soundbar
As an affiliate, we earn on qualifying purchases.
How Notion Used Fireworks
Notion said it used Fireworks for two purposes: classification jobs for Insights and as a general inference provider for open-weight models inside Notion. The company says the exposed data came from the Insights work, rather than from the general inference service. It says the dataset included stored requests and responses from Notion AI use.
Notion’s published timeline says Fireworks notified it on the evening of November 2 that malicious actors had accessed a small amount of data, which Notion initially understood to be synthetic testing data. The next morning, Notion says it disconnected its systems from Fireworks, deleted its data from Fireworks’ system, stopped communications between the services and halted training runs. It later updated its notice as more information emerged. Fireworks’ own bulletin, according to the source material, remained dated November 9.
The two companies’ descriptions leave a specific technical question unresolved. Fireworks’ bulletin said it had not detected an impact to Inference, Training SDK and Nexus, which it describes as zero-retention by default, while also listing datasets among information accessed for certain customers. Notion says data was retained from the endpoints it used. Their public notices do not identify the system that retained Notion’s data or explain how the statements fit together.
““Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.””
— Notion, in its updated Help Center notice
What the Notices Do Not Explain
The public notices do not say which Fireworks system retained the data, how long it was kept, or how many individual users were affected. Notion gives an estimate of fewer than 1% of workspaces but does not provide a precise workspace or person count. It also remains unclear whether other Fireworks customers experienced a similar retention issue.
Notion says most affected transcripts were not labeled with a person or workspace, but the notices do not establish that every transcript was unidentifiable or that its contents could not identify someone. Nor do the published accounts explain how Fireworks’ statement about unaffected zero-retention services relates to Notion’s finding about the endpoints it used. The cause and scope of the retention have not been specified.
Vendor Audit and Customer Reviews
Notion says it is auditing critical vendors and data processors for data-minimization practices, including zero-retention policies. The company has not provided a completion date or published details about any changes that may follow from the audit. Its security advisory remains the main channel for updates on the incident.
Customers who receive a notice from Notion should follow the company’s incident-review guidance, examine affected data for sensitive content and rotate credentials entered into Notion AI during the incident. Notion says a workspace that neither its owner nor administrators have been told is affected has not been identified by the company as part of the affected group. Further information from Notion or Fireworks would be needed to clarify the retained system, duration and possible impact on other customers.
Key Questions
What Notion data was involved in the Fireworks breach?
Notion says the dataset included Notion AI chat transcripts used for its Insights feature, containing written inputs to and outputs from the model. The company says other Notion features were not affected, except that AI Meeting Notes content could be involved if it was used as an input in a Notion AI chat transcript.
How many Notion workspaces were affected?
Notion estimates that fewer than 1% of workspaces were affected. It has not published an exact number of workspaces or users.
Did Fireworks keep the data despite a zero-retention agreement?
Notion says Fireworks had made a contractual zero-data-retention commitment, but Notion’s investigation found that data was retained from the endpoints it used. The companies have not publicly explained which system retained it or how long.
What should affected Notion customers do?
Notion advises affected customers to treat the data as exposed, review it under its Security incident review guidance, and rotate passwords, API keys and other credentials that may have been entered into Notion AI during the incident.
Were all Notion AI features affected?
No. Notion says the exposed data came from work associated with Insights and says no other features were affected. It says AI Meeting Notes were not affected unless their content was used as an input in a Notion AI chat transcript.
Source: ThorstenMeyerAI.com
