Notion sub-processors
Notion publishes the list below on its own site. We check that page daily and record what moves, so this page shows the current list and what changed before it.
Compiled automatically from Notion's own published page, linked above. This is a convenience copy, not an official statement by Notion, and automated reading can lag behind or misinterpret a page. Confirm against the source before relying on it.
Current sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| AWS | Hosting and storage systems provider. | USA, European Union, Korea, Japan |
| Anthropic | Service provider for AI agents, hosting large language models and embeddings, and for abuse prevention. | Global |
| Anysource Inc., dba Runlayer | Security for MCP connections. | USA |
| Baseten Labs, Inc. | Service provider for hosting large language models and embeddings. | Global |
| Cerebras Systems Inc. | Service provider for hosting large language models and embeddings. | USA |
| Cloudflare | Content distribution and processing, security, abuse prevention and DNS services. | Global |
| Confluent | Kafka managed streaming storage platform used for in-product audit log data and analytics. | USA, Germany, Korea, Japan |
| DeepL | Translation services. | USA |
| Exa | Service provider for providing web search results. | USA |
| Fireworks | Service provider for hosting large language models and embeddings. | Global |
| Google LLC | Service provider for hosting large language models and embeddings and for abuse prevention. | Global |
| Mathpix, Inc. | PDF file conversion. | USA, Germany, Singapore |
| OpenAI | Service provider for hosting large language models and embeddings and for abuse prevention. | Global |
| Parallel Web Systems | Service provider for providing web search results and for hosting large language models and embeddings. | USA |
| Splunk | Security and application logging. | USA |
| StarTree, Inc. | Storage platform used for in-product analytics. | USA, Germany, Korea, Japan |
| Turbopuffer | Vector database for storing embeddings. | USA, Germany, Korea, Japan |
| Twilio | Multi-factor Authentication. | USA |
| Vercel Inc. | Compute services that enable code execution and AI agent actions. | USA |
| X.AI LLC | Service provider for hosting large language models and embeddings. | USA, UK |
| Teleperformance | Support services. | Greece |
| Amplitude | Event logging for analytics. | USA |
| Customer | Transactional, broadcast, and marketing messaging. | USA |
| Fivetran | Data pipeline for connecting systems to our data warehouse. | USA, Germany, Korea, Japan |
| Mailgun | Transactional, broadcast, and marketing messaging. | USA |
| Brain Capital Labs PVT Ltd. | Support services. | India |
| Notion International Inc. | Support services. | USA |
| Notion Labs Australia Pty Ltd | Support services. | Australia |
| Notion Labs, Ireland Limited | Support services. | Ireland |
| Notion Labs Japan, G.K. | Support services. | Japan |
| Notion Labs Korea Ltd | Support services. | South Korea |
| Notion Labs United Kingdom, Private Limited | Support services. | UK |
Change history
Added: Google LLC
Removed: Google Cloud
The purpose of the sub-processor Anthropic and Google Cloud has been expanded to include "abuse prevention." Additionally, Google Cloud's name has been updated to "Google LLC." A new definition for "What is a Subprocessor?" has been added, and the ordering of security reports and penetration tests has been changed, with some new reports added (e.g., Notion Web, App and Mobile Penetration Retesting Report, Notion Calendar Penetration Retesting Report).
The descriptions of various sub-processors have been slightly reworded by adding a period at the end of each description. A new internal link 'Notion Security & Trust' has been added to the header of the page.
Removed periods from the end of several sub-processor descriptions.
The 'Notion Security & Trust' link was added to the 'Featured' and 'Other' sections. This is a navigation or informational update rather than a change in sub-processor practices.
LLM analysis failed — manual review required.
The periods at the end of several sub-processor descriptions have been removed.
Removed previous updates regarding SOC 2, SOC 3, HIPAA, C5 reports, and Security Pentest Retesting Reports.
Added: AWS, Amplitude, Anthropic, Anysource Inc., dba Runlayer, Baseten Labs, Inc., Brain Capital Labs PVT Ltd., Cerebras Systems Inc., Cloudflare, Confluent, Customer, DeepL, Exa, Fireworks, Fivetran, Google Cloud, Mailgun, Mathpix, Inc., Notion International Inc., Notion Labs Australia Pty Ltd, Notion Labs Japan, G.K., Notion Labs Korea Ltd, Notion Labs United Kingdom, Private Limited, Notion Labs, Ireland Limited, OpenAI, Parallel Web Systems, Splunk, StarTree, Inc., Teleperformance, Turbopuffer, Twilio, Vercel Inc., X.AI LLC
Notion has added new subprocessors for AI services, including Anthropic, Anysource Inc., dba Runlayer, Baseten Labs, Inc., and Cerebras Systems Inc. The privacy policy now includes detailed sections on AI governance, data retention, encryption, and access control specific to AI capabilities. There are new policies that state customer data is not used for AI training, and for Enterprise workspaces, LLM providers use zero data retention after processing, while non-Enterprise workspaces have a maximum 30-day retention.
Why this matters if you use Notion
Under GDPR Article 28(2), your own customers are usually entitled to notice before you add or replace a sub-processor — and Notion's sub-processors are part of that chain. The notice period in a typical DPA is 10 to 30 days, and it starts when the vendor updates their page, not when you notice.
Monitor Notion on your own trust page — free3 vendors free, permanently. No card.