Security and your data: how MatterOS handles confidential information

Where does your data live?

When you duplicate MatterOS, everything you enter is stored in your Notion workspace under your agreement with Notion Labs, Inc. MatterOS has no servers, accounts or database of its own; the maker's only data about you is the order information from checkout described in the privacy policy.

• Privacy policy

What does Notion provide?

These are Notion's own statements; the reports are available through its Trust Center.

• Notion Trust Center
• Notion: Security practices

What should you configure?

1. 1

   Use a firm workspace

   Keep practice data out of personal workspaces.

2. 2

   Turn on two-step verification

   Or require it through your identity provider.

3. 3

   Restrict sharing

   Limit who can publish to the web and invite guests; review public pages.

4. 4

   Share pages, not databases

   Give clients dedicated client-safe pages with view or comment access.

5. 5

   Review connections and AI

   Check what each connection can read.

• Is Notion secure enough for lawyers?

What MatterOS does not claim

MatterOS does not claim its own security certifications, because it hosts nothing. It does not replace your obligations under professional-conduct and data-protection rules, and it is not an endorsement of Notion for any particular class of data. Decide what belongs in Notion and what must stay elsewhere.

Frequently asked questions

Is MatterOS secure?

MatterOS runs in your Notion workspace, so security is Notion's platform plus your configuration.

Does the maker see my client data?

No. Your data is in your own Notion workspace.

Is Notion SOC 2 compliant?

Notion states it undergoes annual SOC 2 Type II audits; see its Trust Center for the reports.

Can I use MatterOS with privileged information?

That depends on your rules and client terms. Review Notion's security documentation and your obligations first.

Does MatterOS support two-factor authentication?

Sign-in is handled by Notion, which offers two-step verification; see the two-factor page.