Remove Sensitive Data Before Using Notion AI

Scrub PII Before Using Notion AI

Notion AI processes workspace content on Notion's servers. When you invoke an AI feature such as summarization, Q&A, or writing assistance, Notion sends the selected pages, blocks, or your explicit prompt to its AI provider for processing. Any PII, credentials, or internal data embedded in those pages travels off your Notion workspace to external AI infrastructure.¹

Teams that use Notion to store HR data, product roadmaps with internal hostnames, or customer-facing records need a scrubbing step before using Notion AI features on those pages. Removing sensitive fields before pasting them into AI-assisted blocks or prompts ensures that Notion's AI pipeline sees only tokenized placeholders.

How Notion AI accesses your workspace content

Notion AI uses context from the current page and your explicit prompt to generate responses. For team wikis and databases, this means that invoking Notion AI on a page containing employee records, customer contracts, or infrastructure runbooks sends that page's content to Notion's AI provider. Consequently, a team that documents internal IP addresses and SSH credentials in a Notion runbook risks exposing those values every time an AI feature is triggered on that page. Pre-scrubbing the source content before it enters Notion removes this risk.

This passive context sharing is the primary difference between Notion AI and paste-based AI tools. With ChatGPT or Claude, you choose what to paste. Notion AI reads surrounding page content automatically, which means sensitive data you did not intend to share can enter the AI context without an explicit copy-paste action.² Before you type any AI prompt on a page that contains PII, check the surrounding content for identifiers. If the page contains sensitive data, scrub it at the source before invoking AI features.

Sensitive data patterns in Notion content

Notion pages typically contain a mix of text, inline code, and database fields. The scrubber handles all text content and detects personal identifiers (email addresses, phone numbers, SSNs, IBANs), infrastructure data (IPv4 and IPv6 addresses, internal domain names), credentials (API keys in multiple formats, database connection strings, JWT tokens), and payment data (credit card numbers). Building on this, it processes multi-line input, making it suitable for pasting entire database exports or documentation pages for rapid scrubbing before content is entered into Notion.

You can use the scrubber to audit your existing Notion content before enabling AI features. Copy the text of your most sensitive pages (employee databases, client records, infrastructure documentation) and paste them into the scrubber. The variables file shows you exactly which identifiers exist in each page, giving you a PII inventory for your Notion workspace. Use this inventory to decide which pages need scrubbing before you enable AI features on them, and which pages are safe to use with AI without modification.

Enterprise Notion and AI data handling

Notion Enterprise offers AI controls that allow admins to disable AI features organization-wide.³ Yet teams with AI enabled, which is the default for most paid plans, need a workflow to use those features safely on sensitive content. Furthermore, the AI provider receives the content for processing; Notion's own data retention policy does not govern what the AI provider does with submitted data under their enterprise agreements. A pre-scrub workflow makes Notion AI safe for HR teams, legal, and IT without requiring org-level feature disablement.

Enterprise admins face a trade-off: disabling AI features organization-wide protects sensitive data but removes a productivity tool that teams rely on for non-sensitive work. A more practical approach is to enable AI features but restrict them to pages that have been scrubbed or verified as PII-free. Create a team convention where pages containing sensitive data are tagged or placed in a specific database, and train your team to check for that tag before invoking AI. This lets teams benefit from Notion AI on general knowledge-base pages while maintaining a hard boundary around sensitive content.

Notion AI context scope: pages, linked databases, and block context

Notion AI's context includes more than just your typed question. When you invoke AI on a page, Notion sends the surrounding page content, any linked database views visible on that page, and the blocks you have selected as context for the AI request. Invoking "Ask AI" in a page that embeds a filtered customer database view sends the visible database records as part of the request context, even if you typed a question unrelated to those records.⁴

For pages that embed database views containing PII columns, either filter the database view to exclude sensitive columns before invoking AI, or scrub the data before it enters the Notion page. Creating a separate scrubbed-content page for AI analysis, copied from the original source, gives you a stable workspace for AI tasks without exposing the source records directly. This approach separates the original PII-containing database from the AI-assisted workflow layer.

Inline AI commands and surrounding block context

Inline AI commands (typing "/" and selecting an AI option within a block) read the surrounding page content for context. A simple "Improve writing" command on a paragraph in a page that also contains an HR table with SSNs and IBANs sends that surrounding context to Notion's AI provider. Invoke inline AI commands only on pages that contain exclusively non-sensitive content, or scrub the page before any inline AI command if the surrounding block still holds an HR table or other sensitive data.

Meeting notes and recurring PII exposure in team wikis

Team meeting notes in Notion frequently follow templates that include attendee email addresses, action-item owner names, and client names as structured fields. These notes accumulate in shared databases and are queried via Notion AI for project summaries, sprint retrospectives, and historical reference. Each AI query on a meeting notes database sends the records in the query scope to Notion's AI provider as context.

Replace individual email addresses with role names in meeting note templates to reduce PII density at the source. Instead of logging "[email protected] assigned to fix the auth bug," use "Auth lead assigned to fix the auth bug." This structural change reduces the amount of PII in meeting notes without losing the operational information teams need, and it makes Notion AI features safe to use on the notes database without a scrubbing step at query time.

Client names and external company references in Notion projects

Project pages that reference client company names, client contacts, and contract details create a PII exposure when Notion AI is used for project analysis. Client company names combined with project status and financial context constitute business-sensitive information that your organization may restrict from third-party AI providers under NDA or client agreement terms. Scrub client identifiers before invoking AI on project pages to satisfy these obligations regardless of Notion's AI provider arrangements.

Notion guest access and AI processing scope

Notion workspaces with guest access allow external collaborators to view and edit pages in your workspace. When AI features are enabled at the workspace level, guests with editor access can invoke Notion AI on pages they can access. If those pages contain internal employee data or client records, guests can trigger AI processing of that sensitive content through Notion's AI pipeline without additional authorization.

Review guest permissions for workspaces where Notion AI is enabled and where sensitive data exists in the same page space as guest-accessible content. Restrict sensitive databases to full members rather than guests, or create guest-specific pages that contain only the non-sensitive context that external collaborators need. Separating the permission scope of sensitive content from the permission scope of guest-accessible content prevents guests from inadvertently triggering AI processing on data they should not be able to submit externally.

Notion AI provider chain and DPA coverage

Notion AI is powered by third-party AI providers, including OpenAI.⁵ When you invoke Notion AI, the content Notion sends to its AI providers is covered by Notion's data processing agreements with those providers, not by your own DPA with the AI provider directly. Review Notion's AI data handling documentation for your plan tier to understand which providers receive your content and under which retention terms. Scrubbing before submission ensures that the content transmitted through this provider chain contains no identifiable values, regardless of the specifics of Notion's backend arrangements.

Scrubbing before you invoke Notion AI means the content reaching OpenAI through that provider chain already carries no identifiable values. CapyToolkit runs the scrubber in your browser, so the sensitive text never leaves your device during processing, and the variables file remains under your own control rather than inside Notion's infrastructure.

When to use this

Use this before invoking any Notion AI feature on a page, database view, or document that contains HR records, internal infrastructure details, customer identifiers, or credentials.

Examples

Restart procedure: SSH to 10.20.1.15, run sudo systemctl restart app. DB at postgres://ops:[email protected]/prod.

Restart procedure: SSH to [IP_1], run sudo systemctl restart app. DB at [DBURL_1].

Name: Alice Brown, Email: [email protected], Phone: (415) 555-0192, Salary: $112,000

Name: Alice Brown, Email: [EMAIL_1], Phone: [PHONE_1], Salary: $112,000