Notion's AI vendor promised to keep nothing. The chats were kept anyway. Auditors have a rule for promises like that.

Fewer than 1% of Notion workspaces may have had Notion AI chat transcripts exposed in a breach at Fireworks AI, the AI infrastructure company Notion used to analyse those chats. Fireworks updated its incident bulletin on 9 November 2026. The detail that matters is in Notion's own help page: Fireworks had given Notion "a contractual commitment to zero data retention," and yet, Notion writes, "during our investigation we learned that data was retained from the Fireworks endpoints that we used." So what was zero data retention worth here? It was a promise. Nobody had shown it was true, and auditors have a rule about exactly that.

What happened at Fireworks AI, and what did Notion lose?

Fireworks' bulletin, last updated 9 November, describes two incidents. The first, disclosed on 9 October, involved secrets used in evaluation jobs. The second started on 23 October, when a third-party cloud provider that hosted Fireworks' research and development machines had a security incident. On 24 October the attacker used that access to reach Fireworks' development machines and run an unauthorized workload. Fireworks lists what was touched: resource metadata, billing and shipping addresses and payment history, secrets for a limited set of accounts, and "a subset of incomplete model weights and datasets" for certain customers. It ties the activity to a financially motivated group that sells stolen access to AI models.

The Notion notice explains how Notion's data got there. Notion used Fireworks for "classification jobs" behind a feature called Insights, which shows administrators how their members use Notion AI, and as an inference provider for open-weight models. For Insights, Notion sent stored Notion AI requests and responses to Fireworks to run the analysis. Notion's FAQ says a transcript includes "Any input to or output from the model that was written to the chat." Notion has disabled Insights, cut its connection to Fireworks and, as of 3 November, deleted its data there. Its advice to affected owners is blunt: "treat this data as if it were exposed," and rotate any passwords or keys people pasted into Notion AI.

What did "zero data retention" mean here?

Zero data retention, usually shortened to ZDR, is the promise that an AI provider won't store the prompts and answers it processes. Google's autocomplete alone shows how common the promise is: searches pair it with Anthropic, OpenAI, AWS Bedrock and OpenRouter. Fireworks' own documentation says "Fireworks has Zero Data Retention by default" and that it doesn't log or store prompt or generation data for open models "without explicit user opt-in."

The same page lists the edges of that promise. Fireworks logs metadata such as token counts. Users can opt in to logging for some features. Prompt caching can hold some prompt data in memory. And for its Responses API, storing conversations for up to 30 days is the default unless the caller turns it off. I don't know whether any of these explains what happened to Notion's data. Neither company has said, and I'm not going to guess at a cause.

Notion's FAQ adds a second layer. Its ZDR commitment to enterprise customers covers the API requests it sends to model vendors to answer Notion AI questions. It doesn't cover features where Notion itself has to store the chats, like chat history and Insights. For the Insights analysis, Notion relied on a separate contractual ZDR commitment from Fireworks. That's the promise that turned out not to hold.

My first reaction, and why I changed it

My first reaction was that this is simply Fireworks' fault. There was a contract, the contract said nothing would be kept, something was kept. Breach of contract, end of story.

The line that changed my mind is Notion's own next step. It says it is now "doing an audit of critical vendors," inference providers and data processors among them, "to verify that they abide by data minimization practices, including zero data retention policies." Verify is the word. If the plan now is to check that vendors keep their ZDR promises, then before this the promise was being taken on its word. That's my inference from Notion's wording, not something Notion says outright. But it's the useful part of the story, because almost every company buying AI services is in the same position Notion was.

Why auditors don't accept a signed promise on its own

The cross I keep coming back to is from financial auditing, where this problem has a written rule.

At the end of an audit, the auditor asks management to sign a letter. It says, in effect, that the books are complete, that every liability has been disclosed, that nothing has been hidden. It's called a written representation, and the international auditing standard on it is ISA 580.

ISA 580 treats the letter as necessary. Then it says, in paragraph 4 of the Irish version of the standard, that written representations "do not provide sufficient appropriate audit evidence on their own" about the matters they cover.

That sentence is the whole lesson. The signed letter is useful because it puts management on record. It isn't proof, because the person signing it is the person whose work is being checked. So the auditor still has to gather evidence from somewhere else. And the standard goes further: if what management wrote doesn't match the other evidence, the auditor has to perform procedures to resolve it, and if that fails, reconsider how far to trust management at all.

A ZDR clause in a vendor contract is a written representation. It's the vendor saying, on paper, "we keep nothing." The breach showed what happens when that's the only evidence.

What would checking a zero data retention promise look like?

This part is my view, not something either company has published. An auditor's habits translate quite directly. Read the vendor's own exceptions list, because Fireworks' documentation shows a ZDR promise can sit alongside defaults that store data. Check which endpoints and settings your own code actually calls, not which product page your contract names. Ask for evidence that can't come only from the vendor, such as an independent assessment that covers retention, or a contractual right to test it. And treat the gap between the promise and what you can see as the risk you actually carry.

There's a smaller point in the same notice. Notion's email to customers, quoted by The Register, called the exposed chats "unattributable." That's true of what left Notion: the transcripts carried no user or workspace labels. But Notion can still give each affected owner a list of names, emails and how many affected rows belong to each person, because it kept the key on its side. And the text of a chat can name people on its own, as Reddit users pointed out to The Register. I made a similar point about the Gyazo breach and derived data: stripping the label isn't the same as stripping the identity.

Who carries the blame when a supplier fails is an old question too. When a contractor's gateway let attackers into a bank, the law of non-delegable duties gave a fairly clear answer. Notion, to its credit, isn't hiding behind Fireworks: the notice, the review tool and the plan to audit vendors are all its own.

How sure am I?

Everything here is read from published sources, not tested firsthand.

More on Daily Ferment: The Gyazo breach leaked the description of your screenshots, not the screenshots and A contractor's gateway let attackers into a bank. A school swimming lesson shows whose breach it is.

Sources

• Notion Help Center, Notice about the Fireworks AI incident that may impact some Notion workspaces, read 11 November 2026.
• Fireworks AI, October 2026 security incident update, updated 9 November 2026.
• Fireworks AI Docs, Zero Data Retention, read 11 November 2026.
• Connor Jones, Fireworks AI gets burned twice as customer data exposure widens, The Register, 10 November 2026.
• Ravie Lakshmanan, Fireworks AI breach widens to expose customer billing data and incomplete model weights, The Hacker News, 10 November 2026.
• IAASA, ISA (Ireland) 580, Written Representations, paragraph 4.
• FRC, ISA (UK and Ireland) 580, Written Representations, paragraphs 16 to 18.