Notion violated their own security policy and exposed user data as a result (www.quinnbatten.com)

Notion has faced significant backlash following a data breach that compromised sensitive user information from enterprise accounts, reportedly due to a violation of its own security policies. The breach stemmed from Notion's use of the Fireworks AI provider, which, contrary to promises of zero data retention (ZDR), stored user data that was ultimately exposed in the hack. The issue arose from Notion's "Insights" feature, which used Fireworks' Batch Inference API—a service not compatible with ZDR. Customers believed their data was secure, but the incident revealed that Notion had inadvertently opted them into a feature that retained data contrary to their established policies. This incident is a critical wake-up call for the AI/ML community, emphasizing the importance of adherence to security protocols, especially when handling sensitive information. Notion's failure to implement a clear opt-in mechanism for enterprise users has raised concerns about transparency and user consent in AI applications. Moreover, the incident highlights the risks associated with third-party AI integrations, underlining the necessity for robust compliance and risk management strategies to protect user data in an ecosystem increasingly reliant on AI technologies.