Zero Data Retention Doesn’t Mean Your AI Chats Aren’t Stored

A zero data retention promise can cover the requests sent to an AI model and still leave your chat history stored. Fireworks AI, a model provider Notion used, reported a security incident affecting some Notion workspaces, according to Notion’s notice about the incident, checked on 13 November 2026. The same notice says Notion’s zero data retention commitment for enterprise customers applies to requests made to third-party model vendors and is not intended to cover features that store those requests and responses, chat history included.

Fireworks AI’s own documentation, checked on 13 November 2026, lists services where its zero data retention does not apply. The gap follows from what features like chat history do. A model can answer a request and keep nothing. A chat history panel, a saved conversation or an admin report on how staff use AI needs a stored copy of what people typed and what came back. Once that copy exists, the vendor can send it to another company for processing, and whether that path is covered is a separate question from the headline promise. So the check has to run feature by feature, with the four questions below, and a vendor’s general promise of zero data retention does not settle it.

Four questions to answer for every AI feature

Run these on each AI feature your team has switched on, including the ones that came bundled with a tool you bought for something else. Inside one tool, the chat panel and the admin usage report are separate features with separate answers.

1. Does the feature keep what we type?

Look for chat history, saved or shared conversations, a list of recent chats, and any admin view of usage. If you or an admin can open last week’s conversation, a stored copy exists. Notion names two features of this kind in its own product: chat history, and Insights, which “gives administrators information about how their workspace members use AI.” A promise about live requests says nothing about either copy, so every yes here sends you on to questions 2 and 3.

2. Which company processes the stored copies?

Stored copies can leave the vendor. For Insights, Notion says it sent the stored requests and responses from Notion AI use to Fireworks to run the analysis shown to administrators.

To find out who handles yours, start with the vendor’s subprocessor list. Notion’s AI security page, checked on 13 November 2026, says its Subprocessor page always carries the current list of AI providers with access to customer data. A list like that names companies. It may not say which feature sends what to which of them. When it doesn’t, ask the vendor in writing which provider handles each feature that stores data, and record “unknown” until you have the answer. Unknown never counts as covered.

3. Does the retention promise cover that stored path?

Skip the headline and read the sentence that sets the promise’s scope: the plans it applies to, the requests it covers, the features it leaves out. Notion’s zero data retention is a commitment for its enterprise customers. Its AI security page, checked on 13 November 2026, says most models it uses offer zero data retention and a small number do not, and that on Free, Plus and Business plans the AI provider keeps data for 30 days or fewer, then deletes it. Fireworks’ documentation, checked on 13 November 2026, says zero data retention does not apply to its Batch API, which needs dataset storage, or to its Responses API when responses are stored, which is the default.

A promise in writing still leaves open what happened to the data. Notion says Fireworks gave it a contractual commitment to zero data retention for its use of the platform, and that its investigation found data was retained from the Fireworks endpoints Notion used. Fireworks’ security bulletin, last updated 9 November 2026 and checked on 13 November 2026, says Fireworks has detected no impact to three services it describes as zero data retention by default. Neither company has said how those two statements fit together, or which Fireworks service the Insights jobs ran on. That is one incident, and it says nothing about how often such commitments fail. As this case shows, a written commitment records what the vendor has promised without guaranteeing what happens to the data. That is why the rule below asks for one, and why credentials stay out of every AI feature, whatever the commitment says. If the promise names live requests only, treat the stored path as uncovered until the vendor says otherwise in writing.

4. Where is the off switch, and who holds it?

Notion’s AI security page, checked on 13 November 2026, describes an opt-in for models, not for chat history: its models without zero data retention are off by default, and the workspace owner must opt in to use them. In Notion’s case that opt-in sits with the workspace owner, while the people pasting customer details into a chat may be someone else, so tell the people typing which features keep their words. Turning a feature off should stop new copies being made. Ask the vendor separately what happens to copies already stored, and don’t assume they are gone.

Customer, staff and account details go only into features that store nothing, or whose stored path is covered in writing and handled by a provider you can name. A feature with an uncovered or unknown stored path can stay on, but use it only for work you would accept seeing exposed, such as drafting public copy, until its stored path meets both conditions.

A feature inventory to fill in

Give each AI feature one row. The rows and counts below are illustrative, not from a client: a company with five AI features switched on across four tools it already pays for.

Three of the five features keep what people type, and none of those three has a promise that covers its stored copies in writing. For the two features that store nothing, there is no stored path for a promise to cover. In this example, customer details stay out of the wiki chat, the usage report and the call summaries until their stored copies are covered in writing and handled by a provider you can name, and two people, the workspace owner and the CRM admin, decide whether those three stay on.

Copy the table and replace the rows with your own features.

What never goes into an AI chat box

Passwords, API keys, logins and any other credentials stay out of every AI feature, whatever the four answers say. Notion’s advice to affected customers was to rotate any passwords, API keys or other credentials that anyone on the team had pasted into Notion AI. A pasted credential keeps working until someone changes it, and you may have no way to pull back a copy another company holds. When someone needs AI help with a configuration file or a script, have them swap each secret for a placeholder before pasting.

When a vendor discloses an incident

Work in this order.

1. Read the vendor’s notice for whether you are affected and what was included. Notion’s notice, as read on 13 November 2026, says Fireworks reported an incident affecting fewer than 1% of Notion workspaces, and that if neither you nor your workspace owner has heard from Notion, it has not identified your workspace as affected and no action is needed right now. It also says what an affected transcript holds: any input to or output from the model that was written to the chat.
2. If you are affected, rotate anything pasted. Ask the team which credentials went into the feature and change them. Notion says that for most affected workspaces it added no metadata tying a transcript back to a workspace, user or company, and its advice is still plain: “We recommend that you treat this data as if it were exposed.” Follow the vendor’s advice over your own guess about whether a transcript can be traced to you.
3. Decide whether the feature stays on by running the four questions again. A feature whose stored path the promise does not cover, and which held customer, staff or account details, is the first to switch off. For its part, Notion’s notice, as read on 13 November 2026, says it has disabled Insights while it investigates.