🔍 Read the full analysis: What Notion’s Fireworks Disclosure Says About AI Chat Retention on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Notion updated its security notice to say a dataset accessed in the Fireworks AI breach included Notion AI chat transcripts used for its Insights feature. The company says fewer than 1% of workspaces were affected and that it revoked exposed Notion API keys found in affected messages on November 11. It has not identified which Fireworks system retained the data or for how long.
According to Notion’s updated advisory, the transcripts were part of data sent to Fireworks for Insights classification jobs, which help workspace administrators understand how teams use AI. Notion says the November 8 dataset provided by Fireworks included chat transcripts from affected workspaces. For most of those workspaces, it says, the transcripts were unattributable: they were not labeled with the author or workspace and did not contain tool-call results.
That description does not mean the transcript content was harmless or anonymous in every practical sense. Notion defines a transcript as any input to or output from the model written in the chat. It advises affected customers to review the material because prompts or responses may contain sensitive information. Notion says AI Meeting Notes, including audio, transcripts and summaries, were not affected unless used as an input in a Notion AI chat transcript. It says no other Notion features were affected.
Notion says it learned during its investigation that data had been retained from the Fireworks endpoints it used, despite Fireworks’ contractual commitment to zero data retention. On November 11, Notion said it had revoked exposed Notion API keys found in affected user messages. For users notified by Notion, the company recommends treating the relevant data as exposed, reviewing it through its Security incident review guidance, and rotating passwords, API keys and other credentials that may have been entered in chats.
Notion’s Fireworks Disclosure What AI Chat Retention Means
Notion says a dataset accessed in the Fireworks breach included chat transcripts used for Insights. The disclosure raises questions about vendor retention and what customers shared in AI chats.
What the dataset included
The affected transcripts came from Insights classification jobs.
AI chat content
Transcripts included chat inputs or outputs sent for analysis.
Not all Notion AI use
Notion says the exposed transcripts came from Insights, not all AI activity.
Other features
AI Meeting Notes were not affected unless used as chat input; no other Notion features were affected.
What zero retention covered
Notion distinguishes requests used to generate answers from stored data used for Insights.
- API requests sent to providers to generate responses
- Features requiring stored data, including chat history and Insights
- Fireworks nevertheless had a contractual zero-data-retention commitment for Notion’s platform use
What customers should review
Unattributable transcripts can still contain sensitive details.
Notified customers should inspect affected inputs and outputs using Notion’s incident guidance.
Change passwords, API keys, and other credentials that may have been entered in chats.
Organizations can check whether their security teams received direct communication from Notion.
What remains unclear
The public information does not resolve how or where retention occurred.
- Which Fireworks system retained the data
- How long it remained there, or why retention occurred
- Whether other Fireworks customers were affected
- How many users may be represented in affected workspaces
What the Retention Disclosure Changes
The disclosure raises a direct question for organizations using hosted AI services: whether a zero-retention promise covers every data flow tied to a product, or only particular requests. Notion says its own ZDR commitments apply to API requests sent to third-party model providers to generate responses. It says they do not cover features that require data to be stored, naming chat history and Insights.
For Insights, Notion says it sent stored requests and responses from Notion AI use to Fireworks for analysis, and that Fireworks had made a contractual ZDR commitment for Notion’s use of its platform. Notion’s account indicates that the data was nevertheless retained. The published information does not establish whether the retention resulted from a technical fault, a configuration issue or another cause.
That distinction matters to customers assessing what they shared with AI tools and how vendor commitments are applied. It also has practical consequences: even transcripts not labeled with a person or workspace may contain identifying details, confidential business information or credentials typed into a conversation. Notion’s advice to review affected material reflects that content can be sensitive without attribution labels.
Popular right now
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, and IPX4 Water Resistance
Dyson V12 Detect Slim Absolute Cordless Stick Vacuum
iRobot Roomba 105 Combo Robot Vacuum & Mop with AutoEmpty Dock
As an affiliate, we earn on qualifying purchases.
How Notion Used Fireworks
Notion says Fireworks supported two uses: classification work for Insights and inference for open-weight models inside Notion’s product. The company says the exposed transcripts came from the Insights use, rather than from all Notion AI activity. Its notice distinguishes stored requests and responses used for analysis from live requests to vendors to generate an answer.
In its timeline, Notion says Fireworks notified it on November 2 that a small set of data had been accessed by malicious actors. Notion initially understood the data to be synthetic testing data. On November 3, it says it disconnected its systems from Fireworks, deleted data from the Fireworks system, halted training runs and stopped communications between the systems. It later received information that expanded the scope of what may have been accessed.
Fireworks’ own bulletin, according to the source material, still showed a last-updated date of November 9. Fireworks said it had not detected an impact to Inference, Training SDK and Nexus, which it described as zero-data-retention by default, and listed datasets among the data accessed for certain customers. Notion’s subsequent notice added details about its own transcripts and the retention issue. The statements do not identify the specific Fireworks system involved.
““Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.””
— Notion, in its updated security advisory
Open Questions About Fireworks Retention
Notion has not publicly identified which Fireworks system retained its data, how long the data remained there, or how many individual users may be represented in affected workspace data. The available notice also does not explain why the retention occurred despite the contractual commitment.
It is also unclear whether the same retention issue affected other Fireworks customers. Fireworks’ statement that it detected no impact to certain services does not resolve the question for Notion: the companies have not publicly reconciled the service-level statements with Notion’s account that data from its endpoints was retained. Notion says fewer than 1% of its workspaces were affected, but the source material gives no exact count of workspaces or users.
Notion says workspaces it has not contacted have not been identified as affected. That is a statement about the company’s current identification, not a guarantee that every possible consequence is known. The scope and duration of retention, as well as the full set of accessed data, remain subject to further information.
Vendor Audit and Customer Review
Notion says it is auditing critical vendors, including inference providers and data processors, to check their data-minimization practices and adherence to zero-retention policies. The company has not announced a completion date or published audit findings. Further updates from Notion or Fireworks may clarify what system held the data and how the retention happened.
Customers who received a notice from Notion should follow the company’s incident-review guidance, inspect relevant AI chat inputs and outputs, and rotate any credentials that may have been pasted into chats during the incident. Organizations can also check whether their security teams have received a direct communication from Notion. The company’s current guidance says it has not identified a workspace as affected if neither the workspace owner nor the user has heard from it.
Key Questions
What Notion data was included in the Fireworks breach dataset?
Notion says the dataset included Notion AI chat transcripts used for its Insights feature. It says that, for most affected workspaces, the transcripts lacked labels identifying the author or workspace and did not include tool-call results.
How many Notion workspaces were affected?
Notion says fewer than 1% of workspaces were affected. It has not published an exact workspace or user count in the source material.
Did Notion say Fireworks kept the data despite a zero-retention commitment?
Yes. Notion says Fireworks had given it a contractual commitment to zero data retention, but that its investigation found data had been retained from the Fireworks endpoints Notion used.
What should an affected workspace do?
Notion advises affected customers to treat the relevant data as exposed, review it using the company’s Security incident review guidance, and rotate credentials such as passwords or API keys that may have been entered into Notion AI chats.
Were AI Meeting Notes affected?
Notion says AI Meeting Notes, including audio, transcripts and summaries, were not affected unless they were used as input in a Notion AI chat transcript. It says no other Notion features were affected.
Source: ThorstenMeyerAI.com
