---
title: "Security and your data: how MatterOS handles confidential information"
url: https://thematteros.com/security
updated: 2026-10-17
author: Raghav Handa
---

# Security and your data: how MatterOS handles confidential information

MatterOS is a Notion template, so your matters, clients and documents live in your own Notion workspace and the maker never sees them. Security is therefore Notion's platform security plus how you configure sharing and access. Notion reports SOC 2 Type II audits, ISO 27001 certification and encryption in transit and at rest; review them and your professional rules before storing client data.

## Key takeaways

- The maker never sees your data; it lives in your Notion workspace.
- Notion publishes security attestations in its Trust Center; verify them yourself.
- Most risk is configuration: public pages, loose guest access and weak sign-in.
- Check your own rules and client terms; some data may need a specific system.

## Where does your data live?

When you duplicate MatterOS, everything you enter is stored in your Notion workspace under your agreement with Notion Labs, Inc. MatterOS has no servers, accounts or database of its own; the maker's only data about you is the order information from checkout described in the privacy policy.

- Privacy policy: https://thematteros.com/legal/privacy


## What does Notion provide?

| Control | What Notion states |
| --- | --- |
| Independent audits | Annual SOC 2 Type II audits |
| Certification | ISO 27001, with related ISO certifications listed in its help centre |
| Encryption | TLS 1.2+ in transit; AES-256 at rest |
| Sign-in | Two-step verification for password accounts; SAML SSO on supported plans, with the second factor set at the identity provider |
| Health data | A Business Associate Agreement for Enterprise customers |

These are Notion's own statements; the reports are available through its Trust Center.

- Notion Trust Center: https://trust.notion.com/
- Notion: Security practices: https://www.notion.com/help/security-and-privacy


## What should you configure?

1. Use a firm workspace: Keep practice data out of personal workspaces.
2. Turn on two-step verification: Or require it through your identity provider.
3. Restrict sharing: Limit who can publish to the web and invite guests; review public pages.
4. Share pages, not databases: Give clients dedicated client-safe pages with view or comment access.
5. Review connections and AI: Check what each connection can read.

- Is Notion secure enough for lawyers?: https://thematteros.com/resources/legal-ai-ethics-guide


## What MatterOS does not claim

MatterOS does not claim its own security certifications, because it hosts nothing. It does not replace your obligations under professional-conduct and data-protection rules, and it is not an endorsement of Notion for any particular class of data. Decide what belongs in Notion and what must stay elsewhere.


## FAQ

### Is MatterOS secure?

MatterOS runs in your Notion workspace, so security is Notion's platform plus your configuration.

### Does the maker see my client data?

No. Your data is in your own Notion workspace.

### Is Notion SOC 2 compliant?

Notion states it undergoes annual SOC 2 Type II audits; see its Trust Center for the reports.

### Can I use MatterOS with privileged information?

That depends on your rules and client terms. Review Notion's security documentation and your obligations first.

### Does MatterOS support two-factor authentication?

Sign-in is handled by Notion, which offers two-step verification; see the two-factor page.

## Sources

- [Notion Trust Center](https://trust.notion.com/)
- [Notion: Two-step verification](https://www.notion.com/help/two-step-verification)
- [Notion: Security practices](https://www.notion.com/help/security-and-privacy)