Removing a user ID does not remove an API key or a customer name from a chat. Notion says fewer than 1% of its workspaces may have been affected by the Fireworks AI incident. Its November 9 advisory, reviewed here on November 10, requires careful reading of the distinction between transcript labels and transcript contents. This is a documentary review, not an independent incident investigation.
Notification dates are not attack dates
| Date in 2026 | Notion’s account |
|---|---|
| November 2, evening | Fireworks notified Notion of access to a small dataset, initially assessed as synthetic testing data |
| By November 3, morning | Notion says it disconnected, deleted data in Fireworks’ system, and stopped communication |
| November 6 | Fireworks notified Notion of possible customer-data access |
| November 8 | Fireworks confirmed the additional dataset |
| November 9 | Advisory first published and marked updated |
These dates describe notifications and response, not the timing of the underlying intrusion. Additional exposure was identified after the connection had been severed. Disconnecting a provider does not settle what happened to previously retained data.
Analytics is another data destination
Notion says it used Fireworks for classification in Insights, which helps customers understand AI usage, and for serving open-weight models. The additional dataset included Notion AI transcripts used for Insights. Notion disabled Insights during the investigation and stopped serving open-weight models through Fireworks.
The engineering implication is to map the paths that analyze conversations as well as the paths that produce answers. An inference policy alone does not establish the retention conditions of a downstream analytics dataset. That is our interpretation of the disclosed data flow, not a claim about undisclosed Notion controls.
Missing labels do not sanitize the body
According to the advisory, transcripts for the vast majority of impacted workspaces lacked author or workspace labels and did not contain tool-call results. Notion says no other features were affected. Do not broaden this into a claim that every record was anonymous or that its text contained nothing sensitive.
Passwords, API keys, or identifying details pasted into a conversation can remain inside the transcript. Notion recommends that affected customers treat the data as exposed and rotate credentials they may have pasted during the relevant period. It also says customers who have not been contacted have not currently been identified as affected; the investigation remains ongoing and further affected customers will be contacted.
Review the lifecycle of every copy
For a product team, record where inference requests, conversation history, usage-classification datasets, and evaluation data are copied. Check each destination’s purpose, retention period, access permissions, deletion authority, and notification obligations. Retain evidence that deletion requests completed. These are editorial recommendations, not findings about the vendor’s internal controls.
Affected customers should first review the data made available through the official notification process and handle any exposed secrets. Product teams should then examine whether the same text can be copied again into analytics systems. The advisory supports action on disclosed exposure; it does not support inventing a complete root cause or a final incident scope.