Read the full analysis: Fireworks Breach Raises AI Data Retention Questions For Notion on ThorstenMeyerAI.com
TL;DR
Notion says a dataset accessed by attackers in the Fireworks AI breach contained Notion AI chat transcripts used for its Insights feature. The company says fewer than 1% of Notion workspaces are affected and that it revoked exposed API keys found in affected messages on November 11; details about the retained data and the breach remain unclear.
Notion says attackers accessed a dataset containing Notion AI chat transcripts used for its Insights feature after data was retained by Fireworks AI, despite a contractual zero-data-retention commitment. Notion says fewer than 1% of its workspaces are affected and that on November 11 it revoked exposed Notion API keys found in affected user messages.
Notion’s updated security notice says the dataset Fireworks provided to it on November 8 included Notion AI chat transcripts used for Insights, a feature that gives workspace administrators information about team AI usage. Notion says most affected workspaces’ transcripts were “unattributable”: they were not labeled with the person who wrote them or the workspace they came from, and did not include tool-call results. That does not mean the text was necessarily harmless. Notion defines a transcript as model input or output written to the chat and advises affected customers to examine the exposed data because it may contain sensitive information.
Notion says it used Fireworks both to run classification jobs for Insights and to provide inference for open-weight models in its product. The company attributes the exposed data to the Insights-related use. It says AI Meeting Notes, including audio, transcripts and summaries, were not affected unless that material was used as input in a Notion AI chat transcript. Notion says no other Notion features were affected.
In its notice, Notion says it learned during its investigation that data had been retained from the Fireworks endpoints it used, despite Fireworks’ contractual commitment to zero data retention for Notion’s use of the platform. Notion says it disconnected its systems from Fireworks on November 3, deleted data in the Fireworks system and stopped communications with the provider. It also says it halted training runs. On November 11, it revoked exposed Notion API keys found in affected user messages.
Fireworks breach raises Notion data questions
Notion says attackers accessed a Fireworks dataset containing AI chat transcripts used for Insights. The incident raises questions about what data vendors retain and what customers should review.
What the dataset contained
Notion says the accessed dataset included chat text used for its Insights feature.
AI chat transcripts
Inputs or outputs written in chat may contain sensitive information.
Attribution was limited
Most affected transcripts lacked person and workspace labels, but that does not mean their content was harmless.
Insights-related data
Notion says AI Meeting Notes and other features were not affected unless meeting material was used in an AI chat transcript.
What remains unclear
Public notices leave key details about retention and the exposed records unresolved.
Which Fireworks system retained the dataHow long it was kept or whyHow many people or transcripts were involved
Fireworks had a contractual zero-retention commitmentThe exposed dataset related to InsightsIt is auditing critical vendors’ data-minimization practices
What affected customers can do
Treat notified records as exposed and check what was entered into Notion AI.
Assess the specific transcripts for sensitive information or credentials.
Change passwords, API keys, or other credentials pasted into Notion AI during the incident.
Notion says affected customers were contacted and advises following its incident guidance.
What Exposed Chat Text Could Contain
The disclosure matters because chat transcripts can include information people entered into an AI assistant, not just technical metadata. Notion says transcript content could contain sensitive information in user inputs or model outputs, and advises affected customers to assess the specific data rather than assume that the lack of names or workspace labels makes it safe.
The incident also puts a practical limit on how customers should interpret a vendor’s zero-retention promise. Notion’s notice distinguishes live requests sent to model vendors from stored requests and responses retained to provide features such as chat history and Insights. In this case, Notion says Fireworks had made a contractual zero-retention commitment, but data was nevertheless retained. For organizations using AI tools, the disclosure highlights the need to understand what information is sent for analysis, what a retention commitment covers, and how providers verify that commitment.
For customers whose workspaces are affected, the immediate concern is whether a transcript included credentials or other sensitive material. Notion recommends reviewing the affected data and rotating passwords, API keys or other credentials pasted into Notion AI during the incident. The company says it contacted affected customers; it has not identified workspaces as affected when neither the workspace owner nor the customer has received notice.
How Insights Used Fireworks Data
Notion’s notice describes two separate Fireworks roles: running classification jobs for Insights and serving as an inference provider for open-weight models in Notion. Notion says the exposed dataset relates to Insights, where stored requests and responses from Notion AI use were sent for analysis. Its explanation says zero-data-retention commitments cover API requests sent to vendors to generate responses, but are not intended to cover data that must be retained for functions such as chat history and Insights.
Notion’s published timeline says Fireworks notified it on November 2 that a small set of data had been accessed by malicious actors. Notion initially understood the material to be synthetic testing data. On November 3, it says it disconnected from Fireworks, deleted data in the Fireworks system and halted training runs. The company updated its security advisory and help page on November 10 and 11 to include the chat-transcript information. Fireworks’ own incident bulletin, according to the supplied reporting, was last updated November 9.
Fireworks has said its investigation did not detect an impact to Inference, Training SDK and Nexus, which it describes as zero-data-retention by default. Its bulletin also lists datasets among data accessed for certain customers. The published statements do not identify which Fireworks system retained Notion’s data or explain how that retention relates to Fireworks’ description of those services.
“Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.”
— Notion, in its updated security notice
Retention Details Still Unreported
The public notices do not say which Fireworks system retained the data, how long it was kept, or why it was retained despite the commitment described by Notion. They also do not give the number of affected people or the number of transcripts involved; Notion’s figure is expressed as fewer than 1% of workspaces.
It is also unclear whether the same retention issue affected other Fireworks customers. Fireworks says it detected no impact to several services that it describes as zero-data-retention by default, while also listing datasets among information accessed for certain customers. The statements available do not establish which service or storage process was involved in Notion’s case, so the relationship between them remains unresolved.
Notion says most affected transcripts could not be tied to an individual or workspace based on their labels, but that does not establish that all transcript contents lacked identifying or sensitive details. The company has not publicly itemized the specific contents of the affected data. It advises customers to assess their own affected records.
Customer Reviews and Vendor Audit
Notion says it is auditing critical vendors, including inference providers and data processors, to check their data-minimization practices and adherence to zero-retention policies. It has not provided a public completion date for that audit. The company may also provide affected customers with information needed to review their data; its notice advises those customers to treat the material as exposed.
Workspace owners who receive a notice from Notion should review the affected data under the company’s security incident guidance and rotate passwords, API keys or other credentials that were pasted into Notion AI during the incident. Notion says it revoked exposed Notion API keys it found in affected messages on November 11. Customers should distinguish that step from rotating other secrets that may appear in chat content.
Further clarity depends on additional information from Notion and Fireworks about the system involved, retention period, scope and whether the issue extended to other customers. Fireworks’ published bulletin was still dated November 9 in the supplied material, so any later update could change what is known about the breach.
Key Questions
What Notion data was involved?
Notion says the dataset accessed by attackers included Notion AI chat transcripts used for Insights. It says most affected transcripts lacked labels identifying the user or workspace, but transcript content could still include information entered into or returned by the model.
How many Notion workspaces are affected?
Notion says fewer than 1% of workspaces are affected. The notice does not provide a specific number of workspaces or people.
Were AI Meeting Notes affected?
Notion says AI Meeting Notes, including audio, transcripts and summaries, were not affected unless they were used as input in a Notion AI chat transcript. It says no other Notion features were affected.
What should affected customers do?
Notion advises affected customers to treat the data as exposed, review it under its security incident guidance, and rotate passwords, API keys or other credentials pasted into Notion AI during the incident. Notion says it revoked exposed Notion API keys found in affected messages on November 11.
What is still unknown about the Fireworks retention issue?
The companies’ published statements do not identify the Fireworks system that retained Notion’s data, how long it was retained, or whether other Fireworks customers experienced the same issue. The number of affected transcripts and people has also not been disclosed.
Source: ThorstenMeyerAI.com