Most mental models of "AI in a tool" are either too vague ("it uses ChatGPT") or too technical to be useful. Here is the version that actually helps you understand what Notion AI can and cannot do, and why.
Step one: your pages become vectors (the embedding layer)
When Notion AI is enabled on your workspace, Notion starts processing your pages in the background. Each page is broken into chunks of text, and each chunk is converted into a mathematical representation called an embedding: a list of numbers that captures the meaning of that text, not its exact words.
These embeddings are stored in a dedicated vector database, separate from the Notion database that stores your pages as structured content. Think of it as a parallel index built for semantic search, not keyword matching.
Why this matters: when you ask a question in plain language, the system doesn't search for pages containing those exact words. It searches for pages whose meaning is close to the meaning of your question. "What's our pricing for large contracts?" can surface a page titled "Enterprise rates" even if it contains neither the word "pricing" nor "large contracts."
Step two: your question becomes an answer (the generation layer)
When you submit a question, here is what happens:
- Your question is converted into an embedding using the same model that processed your pages.
- The system runs a semantic similarity search in the vector database and retrieves the top candidate pages.
- Those pages are filtered by your permissions: only content you are allowed to read is included.
- The retrieved content is assembled into a context window, along with your original question.
- This combined prompt is sent to a large language model (LLM), the part that does the actual language generation.
- The LLM produces a response grounded in the retrieved content.
- Notion displays the answer, with links to the source pages when available.
The LLM used by Notion is a third-party model (Notion uses multiple providers, including Anthropic and others). Notion does not train or own the LLM: it uses it as a generation engine on top of its own search and permission infrastructure.
Who is actually "thinking"
The architecture above means there are two distinct systems involved. The first is Notion's own infrastructure: the embedding model, the vector database, the permission filtering, the connector integrations. Notion builds and controls all of this.
The second is the LLM: a third-party model that receives a prompt (your question plus the retrieved content) and generates a response. This is where the language understanding and synthesis happens, and it's also where data leaves Notion's own servers temporarily during processing.
This distinction matters for data questions. When someone asks "does our data stay with Notion," the honest answer is: your pages stay with Notion permanently. Your query and the retrieved content pass through a third-party LLM during inference and are subject to that provider's data retention policy, which Notion negotiates and discloses.
Permissions are respected, not bypassed
One of the questions teams ask most often is: can Notion AI surface content someone isn't supposed to see? The answer is no, by design.
Step 3 in the generation process above is a permission filter. The semantic search returns candidate pages from the full workspace vector database, but before any content is passed to the LLM, Notion filters it against the requesting user's permissions. Only pages that user is allowed to read are included in the context window.
A member with access to three teamspaces can only get answers grounded in content from those three teamspaces. A guest with access to two specific pages can only get answers from those two pages. Notion AI does not grant access to content a user couldn't read through normal navigation.
Data segregation between workspaces
The vector database is scoped to your workspace. Notion AI for your workspace only searches your workspace's content. It cannot cross into another organization's data, even if the same LLM provider is used by both.
The embeddings are logically isolated by workspace, and the permission filtering described above adds a second layer of isolation within a workspace. A multi-company Notion deployment (rare, but it exists) still benefits from full workspace-level data segregation.
Your content, your ownership
Notion's terms are explicit: the content in your workspace belongs to you. Notion does not use your workspace content to train the underlying LLMs, and neither do its providers by default under the agreements Notion has in place. The default data retention window with LLM providers is 30 days for workspaces not on Enterprise. On Enterprise, zero data retention is the default.
The embeddings stored in Notion's vector database are also your data. They are deleted within 60 days of a page or workspace being deleted. If a workspace is deleted and restored within 30 days, embeddings are restored too.