{
  "metadata": {
    "vendor": "Notion",
    "package": "Rapid Screen",
    "language": "en",
    "prepared_at": "2026-06-30",
    "status": "final"
  },
  "use_case": {
    "company_stage": "25 -> 60 people",
    "primary_use": "Internal knowledge base and process documentation",
    "budget_target": "EUR 300-1,000/month",
    "must_haves": [
      "SSO / identity control",
      "DPA/privacy handoff",
      "Export / portability",
      "Admin and permission model",
      "Clear pilot-vs-rollout decision"
    ],
    "excluded_from_rapid": [
      "full legal advice",
      "full security assessment",
      "market scan",
      "alternatives matrix",
      "contract redlining"
    ]
  },
  "decision": {
    "verdict": "Conditional Go",
    "pilot": "Yes",
    "full_rollout": "Stop for now",
    "one_sentence": "Notion can be cleared for a limited knowledge-base and process-documentation pilot. A full rollout is not currently approval-ready until quote, export test, permission test, subprocessor/data-class handoff and AI policy are closed.",
    "top_reasons": [
      "The use case is narrow enough: internal knowledge base and process documentation, not an uncontrolled company-wide rollout.",
      "Notion likely covers the functional pilot need; SSO and permissions must be tested in the real workspace.",
      "Export is documented. That is enough for a pilot, not enough for rollout approval."
    ],
    "top_blockers": [
      "60-user TCO can break the budget corridor.",
      "Audit Log, SCIM, data residency and other controls are plan-dependent and can force Enterprise pricing.",
      "Export quality and rebuild effort remain practically untested.",
      "The subprocessor list includes hosting, AI, analytics, support and Notion-entity processing across multiple locations. This must be mapped before sensitive data is imported."
    ],
    "minimum_conditions": [
      "Business/Enterprise quote for 25 and 60 users is available.",
      "SSO and permission model were tested in the pilot.",
      "Export/restore test was run with realistic pages and databases.",
      "AI features are disabled or approved under policy.",
      "DPA, subprocessors, locations and data classes were handed to legal/privacy."
    ]
  },
  "evidence_counts": {
    "sources": 10,
    "claims": 29,
    "risks": 8
  },
  "sources": [
    {
      "Source ID": "N-RS-01",
      "Vendor": "Notion",
      "Source type": "Pricing",
      "Title": "Notion Pricing",
      "URL": "https://www.notion.com/pricing",
      "Accessed": "2026-06-30",
      "Source quality": "Primary source",
      "Key evidence": "Plan logic, Business price anchor, Enterprise custom pricing, plan-dependent controls",
      "Rapid use": "TCO, plan fit, budget and control gates",
      "Limitations": "Public pricing is only a price anchor; quote may differ by region, term, billing, add-ons and discount."
    },
    {
      "Source ID": "N-RS-02",
      "Vendor": "Notion",
      "Source type": "Legal/Privacy",
      "Title": "Notion's List of Subprocessors",
      "URL": "https://notion.notion.site/Notion-s-List-of-Subprocessors-268fa5bcfa0f46b6bc29436b21676734",
      "Accessed": "2026-06-30",
      "Source quality": "Primary source",
      "Key evidence": "Subprocessors with purpose and location, including AWS, AI/LLM providers, analytics, support and Notion entities",
      "Rapid use": "Subprocessor, location and data-class handoff",
      "Limitations": "The list is broad and dynamic; preserve access date before customer delivery."
    },
    {
      "Source ID": "N-RS-03",
      "Vendor": "Notion",
      "Source type": "Help Center",
      "Title": "Security & privacy",
      "URL": "https://www.notion.com/help/security-and-privacy",
      "Accessed": "2026-06-30",
      "Source quality": "Primary source",
      "Key evidence": "Encryption, SOC/ISO references, access and security controls",
      "Rapid use": "Security and privacy claim support",
      "Limitations": "Feature availability remains partly plan-dependent."
    },
    {
      "Source ID": "N-RS-04",
      "Vendor": "Notion",
      "Source type": "Help Center",
      "Title": "GDPR at Notion",
      "URL": "https://www.notion.com/help/gdpr-at-notion",
      "Accessed": "2026-06-30",
      "Source quality": "Primary source",
      "Key evidence": "DPA path, GDPR processing context and privacy handoff",
      "Rapid use": "DPA and legal/privacy handoff",
      "Limitations": "Does not replace legal/privacy review for concrete data classes."
    },
    {
      "Source ID": "N-RS-05",
      "Vendor": "Notion",
      "Source type": "Help Center",
      "Title": "SAML SSO configuration",
      "URL": "https://www.notion.com/help/saml-sso-configuration",
      "Accessed": "2026-06-30",
      "Source quality": "Primary source",
      "Key evidence": "SAML SSO availability and setup conditions",
      "Rapid use": "Identity-control gate for pilot and rollout",
      "Limitations": "Exact plan and workspace configuration must be confirmed."
    },
    {
      "Source ID": "N-RS-06",
      "Vendor": "Notion",
      "Source type": "Help Center",
      "Title": "Provision users and groups with SCIM",
      "URL": "https://www.notion.com/help/provision-users-and-groups-with-scim",
      "Accessed": "2026-06-30",
      "Source quality": "Primary source",
      "Key evidence": "SCIM provisioning scope and plan dependency",
      "Rapid use": "Lifecycle and offboarding gate",
      "Limitations": "Enterprise dependency can materially change TCO."
    },
    {
      "Source ID": "N-RS-07",
      "Vendor": "Notion",
      "Source type": "Help Center",
      "Title": "Audit log",
      "URL": "https://www.notion.com/help/audit-log",
      "Accessed": "2026-06-30",
      "Source quality": "Primary source",
      "Key evidence": "Audit-log plan dependency, retention and covered events",
      "Rapid use": "Auditability gate for full rollout",
      "Limitations": "Rapid does not test audit-log completeness in a real workspace."
    },
    {
      "Source ID": "N-RS-08",
      "Vendor": "Notion",
      "Source type": "Help Center",
      "Title": "Export your content",
      "URL": "https://www.notion.com/help/export-your-content",
      "Accessed": "2026-06-30",
      "Source quality": "Primary source",
      "Key evidence": "Export formats, workspace export behavior and practical limitations",
      "Rapid use": "Portability and exit-risk gate",
      "Limitations": "Documented export does not prove acceptable migration fidelity."
    },
    {
      "Source ID": "N-RS-09",
      "Vendor": "Notion",
      "Source type": "Help Center",
      "Title": "Data residency for Notion",
      "URL": "https://www.notion.com/help/data-residency",
      "Accessed": "2026-06-30",
      "Source quality": "Primary source",
      "Key evidence": "Data-residency availability, regional scope and exclusions",
      "Rapid use": "EU/data-residency condition if required",
      "Limitations": "Enterprise availability and scope limits must be confirmed."
    },
    {
      "Source ID": "N-RS-10",
      "Vendor": "Notion",
      "Source type": "Help Center",
      "Title": "Notion AI security & privacy practices",
      "URL": "https://www.notion.com/help/notion-ai-security-practices",
      "Accessed": "2026-06-30",
      "Source quality": "Primary source",
      "Key evidence": "AI provider/subprocessor model, training statement, retention and Enterprise ZDR",
      "Rapid use": "AI policy guardrail if Notion AI is active or bundled",
      "Limitations": "If AI is out of scope, this remains a policy risk rather than the core blocker."
    }
  ],
  "claims": [
    {
      "Claim ID": "NR-CL-01",
      "Decision field": "Cost / TCO",
      "Vendor/Scope": "Notion Business",
      "Claim": "Business is the relevant public price anchor if SAML SSO and stronger admin controls are must-haves.",
      "Source IDs": "N-RS-01|N-RS-05",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "High",
      "Evidence status": "Verified from primary source",
      "Decision impact": "Business can fit the pilot but may not fit full rollout controls.",
      "Verification need": "Confirm target plan, billing, term, currency, taxes and quote."
    },
    {
      "Claim ID": "NR-CL-02",
      "Decision field": "Cost / TCO",
      "Vendor/Scope": "Notion Business",
      "Claim": "At 60 members, public Business pricing can pressure the EUR 300-1,000/month budget range.",
      "Source IDs": "N-RS-01",
      "Confidence": "Medium-High",
      "Impact": "High",
      "Likelihood": "High",
      "Evidence status": "Model assumption",
      "Decision impact": "Budget can break at full rollout even if the pilot looks affordable.",
      "Verification need": "Replace public price anchor with formal quote for 25 and 60 users."
    },
    {
      "Claim ID": "NR-CL-03",
      "Decision field": "Cost / TCO",
      "Vendor/Scope": "Notion Enterprise",
      "Claim": "Enterprise-only controls can move the decision out of the Rapid budget logic.",
      "Source IDs": "N-RS-01",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "Medium-High",
      "Evidence status": "Plan confirmation needed",
      "Decision impact": "If audit, SCIM or data residency are mandatory, Business may be insufficient.",
      "Verification need": "Request Enterprise quote if an Enterprise-only control is mandatory."
    },
    {
      "Claim ID": "NR-CL-04",
      "Decision field": "Cost / TCO",
      "Vendor/Scope": "Notion",
      "Claim": "Notion AI and AI/add-on behavior must be assessed separately from the base workspace price.",
      "Source IDs": "N-RS-01|N-RS-10",
      "Confidence": "Medium",
      "Impact": "Medium-High",
      "Likelihood": "Medium",
      "Evidence status": "Vendor confirmation open",
      "Decision impact": "AI use can create unplanned cost and policy risk.",
      "Verification need": "Confirm whether AI is enabled, disabled, limited or billed separately."
    },
    {
      "Claim ID": "NR-CL-05",
      "Decision field": "Identity control",
      "Vendor/Scope": "Notion Business/Enterprise",
      "Claim": "SAML SSO is plausible for the use case, but the target plan and setup must be confirmed.",
      "Source IDs": "N-RS-01|N-RS-05",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "High",
      "Evidence status": "Verified from primary source",
      "Decision impact": "Supports pilot only if SSO is actually included and configured.",
      "Verification need": "Test SAML against the customer's IdP."
    },
    {
      "Claim ID": "NR-CL-06",
      "Decision field": "Identity control",
      "Vendor/Scope": "Guests",
      "Claim": "Guest and external collaboration are not automatically solved by SAML.",
      "Source IDs": "N-RS-05",
      "Confidence": "Medium-High",
      "Impact": "Medium-High",
      "Likelihood": "Medium",
      "Evidence status": "Workspace validation needed",
      "Decision impact": "External sharing can remain a governance gap.",
      "Verification need": "Inventory guest access, external collaborators and sharing policy."
    },
    {
      "Claim ID": "NR-CL-07",
      "Decision field": "Identity lifecycle",
      "Vendor/Scope": "Notion Enterprise",
      "Claim": "SCIM appears Enterprise-dependent and should not be assumed for Business.",
      "Source IDs": "N-RS-01|N-RS-06",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "High",
      "Evidence status": "Verified from primary source",
      "Decision impact": "If automated lifecycle/offboarding is mandatory, Business can be insufficient.",
      "Verification need": "Classify SCIM as must-have or nice-to-have."
    },
    {
      "Claim ID": "NR-CL-08",
      "Decision field": "Identity lifecycle",
      "Vendor/Scope": "Guests",
      "Claim": "Offboarding must include guests, page owners, teamspaces and integrations, not only employee SSO.",
      "Source IDs": "N-RS-06",
      "Confidence": "High",
      "Impact": "Medium-High",
      "Likelihood": "Medium",
      "Evidence status": "Workspace validation needed",
      "Decision impact": "A pilot is acceptable only with a controlled owner model.",
      "Verification need": "Run a pilot offboarding test with one user and one guest."
    },
    {
      "Claim ID": "NR-CL-09",
      "Decision field": "Auditability",
      "Vendor/Scope": "Notion Enterprise",
      "Claim": "Audit Log is Enterprise-dependent and not a Business assumption.",
      "Source IDs": "N-RS-01|N-RS-07",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "High",
      "Evidence status": "Verified from primary source",
      "Decision impact": "If audit logs are mandatory, the decision shifts toward Enterprise quote or No-Go for Business full rollout.",
      "Verification need": "Clarify whether audit log is mandatory for this knowledge-base use case."
    },
    {
      "Claim ID": "NR-CL-10",
      "Decision field": "Auditability",
      "Vendor/Scope": "Notion Enterprise",
      "Claim": "Audit-log coverage starts after upgrade/activation; historical events may be unavailable.",
      "Source IDs": "N-RS-07",
      "Confidence": "High",
      "Impact": "Medium-High",
      "Likelihood": "Medium",
      "Evidence status": "Verified from primary source",
      "Decision impact": "Late activation can weaken audit evidence.",
      "Verification need": "Activate audit logging before meaningful pilot data is imported."
    },
    {
      "Claim ID": "NR-CL-11",
      "Decision field": "Auditability",
      "Vendor/Scope": "Notion Enterprise",
      "Claim": "Audit-log retention must be tested against the concrete requirement, not treated as a generic trust signal.",
      "Source IDs": "N-RS-07",
      "Confidence": "Medium-High",
      "Impact": "Medium-High",
      "Likelihood": "Medium",
      "Evidence status": "Requirement match needed",
      "Decision impact": "Retention may be too short for internal review or security requirements.",
      "Verification need": "Match retention requirement against Notion retention."
    },
    {
      "Claim ID": "NR-CL-12",
      "Decision field": "Security / Trust",
      "Vendor/Scope": "Notion",
      "Claim": "Security and privacy sources provide positive trust signals, including encryption and compliance references.",
      "Source IDs": "N-RS-03",
      "Confidence": "High",
      "Impact": "Medium-High",
      "Likelihood": "High",
      "Evidence status": "Verified from primary source",
      "Decision impact": "Supports vendor credibility for the pilot, but does not replace approval.",
      "Verification need": "Collect SOC/ISO artifacts if procurement/security asks for them."
    },
    {
      "Claim ID": "NR-CL-13",
      "Decision field": "Security / Trust",
      "Vendor/Scope": "Notion",
      "Claim": "Trust/security materials are not enough for sensitive or regulated knowledge-base data without customer-specific review.",
      "Source IDs": "N-RS-03|N-RS-04",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "High",
      "Evidence status": "Decision inference",
      "Decision impact": "Pilot starts only with limited data classes.",
      "Verification need": "Define prohibited data classes for the pilot."
    },
    {
      "Claim ID": "NR-CL-14",
      "Decision field": "DPA / Privacy",
      "Vendor/Scope": "Notion",
      "Claim": "DPA materials are available as input for legal and privacy review; final privacy/legal approval remains outside Rapid scope.",
      "Source IDs": "N-RS-04",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "High",
      "Evidence status": "Legal/privacy review",
      "Decision impact": "Does not block a limited-data pilot, but blocks full rollout without responsible approval.",
      "Verification need": "Send DPA and source register to DPO, legal or privacy owner."
    },
    {
      "Claim ID": "NR-CL-15",
      "Decision field": "DPA / Privacy",
      "Vendor/Scope": "Notion",
      "Claim": "The subprocessor list contains concrete location signals: AWS with USA/EU/Korea/Japan, AI/LLM providers partly Global, analytics/streaming including USA/Germany/Korea/Japan, and support/Notion entity locations outside Germany.",
      "Source IDs": "N-RS-02|N-RS-04|N-RS-09|N-RS-10",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "High",
      "Evidence status": "Legal/privacy handoff",
      "Decision impact": "Full rollout is not approval-ready without data-class and subprocessor handoff.",
      "Verification need": "Map subprocessor list against data classes, AI scope, EU-residency requirement and legal/privacy review."
    },
    {
      "Claim ID": "NR-CL-16",
      "Decision field": "Data residency",
      "Vendor/Scope": "Notion Enterprise",
      "Claim": "Data residency is not a Business default assumption; it is plan- and scope-dependent.",
      "Source IDs": "N-RS-01|N-RS-09",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "Medium",
      "Evidence status": "Verified from primary source",
      "Decision impact": "If EU data residency is mandatory, Business pilot may be insufficient.",
      "Verification need": "Clarify whether EU residency is required and available in the target plan."
    },
    {
      "Claim ID": "NR-CL-17",
      "Decision field": "Data residency",
      "Vendor/Scope": "EU region",
      "Claim": "EU data residency reduces one risk class but does not remove DPA, subprocessor, transfer or exclusion review.",
      "Source IDs": "N-RS-09|N-RS-04",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "Medium",
      "Evidence status": "Decision inference",
      "Decision impact": "Prevents false comfort from the phrase EU region.",
      "Verification need": "Review residency scope, exclusions, backups and third processors."
    },
    {
      "Claim ID": "NR-CL-18",
      "Decision field": "Data residency",
      "Vendor/Scope": "Notion",
      "Claim": "Individual Notion products or data types can be excluded from residency commitments and may need separate treatment.",
      "Source IDs": "N-RS-09",
      "Confidence": "Medium-High",
      "Impact": "Medium-High",
      "Likelihood": "Medium",
      "Evidence status": "Scope review needed",
      "Decision impact": "Calendar, Mail, beta or AI scope can change approval.",
      "Verification need": "Clarify which Notion products are actually included in rollout."
    },
    {
      "Claim ID": "NR-CL-19",
      "Decision field": "Export / Portability",
      "Vendor/Scope": "Notion",
      "Claim": "Notion documents export options for pages, databases and workspace content.",
      "Source IDs": "N-RS-08",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "High",
      "Evidence status": "Verified from primary source",
      "Decision impact": "Export exists as a starting point; pilot is not an immediate lock-in No-Go.",
      "Verification need": "Run a real export test with representative content."
    },
    {
      "Claim ID": "NR-CL-20",
      "Decision field": "Export / Portability",
      "Vendor/Scope": "Business/Enterprise",
      "Claim": "Workspace-wide PDF export is plan-dependent and must not be assumed for every plan.",
      "Source IDs": "N-RS-08|N-RS-01",
      "Confidence": "Medium-High",
      "Impact": "Medium",
      "Likelihood": "Medium",
      "Evidence status": "Plan review needed",
      "Decision impact": "Export capability can become a plan-fit issue.",
      "Verification need": "Confirm export formats in the target plan."
    },
    {
      "Claim ID": "NR-CL-21",
      "Decision field": "Export / Portability",
      "Vendor/Scope": "Notion",
      "Claim": "Exported content may not be sufficient to rebuild workspace structure and operating logic cleanly.",
      "Source IDs": "N-RS-08",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "High",
      "Evidence status": "Verified limitation",
      "Decision impact": "Full rollout is not approval-ready until practical restore/migration quality is tested.",
      "Verification need": "Run export/review test with nested pages, databases, files and comments."
    },
    {
      "Claim ID": "NR-CL-22",
      "Decision field": "Export / Portability",
      "Vendor/Scope": "Notion",
      "Claim": "Workspace export can take time and create operational friction in larger workspaces.",
      "Source IDs": "N-RS-08",
      "Confidence": "Medium",
      "Impact": "Medium",
      "Likelihood": "Medium",
      "Evidence status": "Verified limitation",
      "Decision impact": "Exit effort grows with adoption.",
      "Verification need": "Measure export time during pilot."
    },
    {
      "Claim ID": "NR-CL-23",
      "Decision field": "Export / Portability",
      "Vendor/Scope": "Notion databases",
      "Claim": "Database export can depend on views; database-heavy process documentation needs fidelity testing.",
      "Source IDs": "N-RS-08",
      "Confidence": "Medium-High",
      "Impact": "High",
      "Likelihood": "Medium-High",
      "Evidence status": "Verified limitation",
      "Decision impact": "Process documentation can become harder to migrate when databases are used.",
      "Verification need": "Test representative databases and relations."
    },
    {
      "Claim ID": "NR-CL-24",
      "Decision field": "Export / Portability",
      "Vendor/Scope": "Windows users",
      "Claim": "Long nested paths can create practical export/opening problems in Windows environments.",
      "Source IDs": "N-RS-08",
      "Confidence": "Medium",
      "Impact": "Medium",
      "Likelihood": "Medium",
      "Evidence status": "Verified limitation",
      "Decision impact": "Deep page trees should be controlled during pilot.",
      "Verification need": "Test exported ZIP on Windows."
    },
    {
      "Claim ID": "NR-CL-25",
      "Decision field": "Admin / Governance",
      "Vendor/Scope": "Notion",
      "Claim": "Private teamspaces and granular permissions support a controlled pilot, but permission design must be explicit.",
      "Source IDs": "N-RS-01|N-RS-03|N-RS-05",
      "Confidence": "Medium-High",
      "Impact": "High",
      "Likelihood": "High",
      "Evidence status": "Workspace validation needed",
      "Decision impact": "Governance strength depends on setup, not only feature availability.",
      "Verification need": "Build pilot permission map and sharing rules."
    },
    {
      "Claim ID": "NR-CL-26",
      "Decision field": "Admin / Governance",
      "Vendor/Scope": "Notion",
      "Claim": "Domain management, SIEM/DLP and advanced admin controls appear Enterprise-adjacent and may sit outside the Rapid budget.",
      "Source IDs": "N-RS-01|N-RS-03",
      "Confidence": "Medium-High",
      "Impact": "High",
      "Likelihood": "Medium",
      "Evidence status": "Plan review needed",
      "Decision impact": "Security may reject Business if these controls are mandatory.",
      "Verification need": "Ask IT/security: must-have or nice-to-have?"
    },
    {
      "Claim ID": "NR-CL-27",
      "Decision field": "AI policy",
      "Vendor/Scope": "Notion AI",
      "Claim": "Notion AI creates separate provider, retention and subprocessor questions.",
      "Source IDs": "N-RS-10",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "Medium-High",
      "Evidence status": "Verified from primary source",
      "Decision impact": "Pilot must define whether AI is enabled, disabled or limited.",
      "Verification need": "Set AI policy before importing real company knowledge."
    },
    {
      "Claim ID": "NR-CL-28",
      "Decision field": "AI policy",
      "Vendor/Scope": "Notion AI",
      "Claim": "Notion AI materials are positive on training-use limits, but retention depends on plan and provider setup.",
      "Source IDs": "N-RS-10|N-RS-01",
      "Confidence": "Medium-High",
      "Impact": "High",
      "Likelihood": "Medium",
      "Evidence status": "Plan confirmation needed",
      "Decision impact": "Enterprise ZDR may be required under a strict AI posture.",
      "Verification need": "Confirm AI retention and model-provider settings in writing."
    },
    {
      "Claim ID": "NR-CL-29",
      "Decision field": "Rapid decision",
      "Vendor/Scope": "Notion",
      "Claim": "Rapid evidence supports a limited pilot under conditions, but not an approval-ready full rollout.",
      "Source IDs": "N-RS-01|N-RS-02|N-RS-04|N-RS-05|N-RS-07|N-RS-08|N-RS-09|N-RS-10",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "High",
      "Evidence status": "Decision synthesis",
      "Decision impact": "Decision: Conditional Go for pilot. Stop full rollout.",
      "Verification need": "Close quote, export, permissions, DPA/subprocessor and AI gates."
    }
  ],
  "top_claims": [
    {
      "Claim ID": "NR-CL-02",
      "Decision field": "Cost / TCO",
      "Vendor/Scope": "Notion Business",
      "Claim": "At 60 members, public Business pricing can pressure the EUR 300-1,000/month budget range.",
      "Source IDs": "N-RS-01",
      "Confidence": "Medium-High",
      "Impact": "High",
      "Likelihood": "High",
      "Evidence status": "Model assumption",
      "Decision impact": "Budget can break at full rollout even if the pilot looks affordable.",
      "Verification need": "Replace public price anchor with formal quote for 25 and 60 users."
    },
    {
      "Claim ID": "NR-CL-07",
      "Decision field": "Identity lifecycle",
      "Vendor/Scope": "Notion Enterprise",
      "Claim": "SCIM appears Enterprise-dependent and should not be assumed for Business.",
      "Source IDs": "N-RS-01|N-RS-06",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "High",
      "Evidence status": "Verified from primary source",
      "Decision impact": "If automated lifecycle/offboarding is mandatory, Business can be insufficient.",
      "Verification need": "Classify SCIM as must-have or nice-to-have."
    },
    {
      "Claim ID": "NR-CL-09",
      "Decision field": "Auditability",
      "Vendor/Scope": "Notion Enterprise",
      "Claim": "Audit Log is Enterprise-dependent and not a Business assumption.",
      "Source IDs": "N-RS-01|N-RS-07",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "High",
      "Evidence status": "Verified from primary source",
      "Decision impact": "If audit logs are mandatory, the decision shifts toward Enterprise quote or No-Go for Business full rollout.",
      "Verification need": "Clarify whether audit log is mandatory for this knowledge-base use case."
    },
    {
      "Claim ID": "NR-CL-15",
      "Decision field": "DPA / Privacy",
      "Vendor/Scope": "Notion",
      "Claim": "The subprocessor list contains concrete location signals: AWS with USA/EU/Korea/Japan, AI/LLM providers partly Global, analytics/streaming including USA/Germany/Korea/Japan, and support/Notion entity locations outside Germany.",
      "Source IDs": "N-RS-02|N-RS-04|N-RS-09|N-RS-10",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "High",
      "Evidence status": "Legal/privacy handoff",
      "Decision impact": "Full rollout is not approval-ready without data-class and subprocessor handoff.",
      "Verification need": "Map subprocessor list against data classes, AI scope, EU-residency requirement and legal/privacy review."
    },
    {
      "Claim ID": "NR-CL-21",
      "Decision field": "Export / Portability",
      "Vendor/Scope": "Notion",
      "Claim": "Exported content may not be sufficient to rebuild workspace structure and operating logic cleanly.",
      "Source IDs": "N-RS-08",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "High",
      "Evidence status": "Verified limitation",
      "Decision impact": "Full rollout is not approval-ready until practical restore/migration quality is tested.",
      "Verification need": "Run export/review test with nested pages, databases, files and comments."
    },
    {
      "Claim ID": "NR-CL-27",
      "Decision field": "AI policy",
      "Vendor/Scope": "Notion AI",
      "Claim": "Notion AI creates separate provider, retention and subprocessor questions.",
      "Source IDs": "N-RS-10",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "Medium-High",
      "Evidence status": "Verified from primary source",
      "Decision impact": "Pilot must define whether AI is enabled, disabled or limited.",
      "Verification need": "Set AI policy before importing real company knowledge."
    },
    {
      "Claim ID": "NR-CL-29",
      "Decision field": "Rapid decision",
      "Vendor/Scope": "Notion",
      "Claim": "Rapid evidence supports a limited pilot under conditions, but not an approval-ready full rollout.",
      "Source IDs": "N-RS-01|N-RS-02|N-RS-04|N-RS-05|N-RS-07|N-RS-08|N-RS-09|N-RS-10",
      "Confidence": "High",
      "Impact": "High",
      "Likelihood": "High",
      "Evidence status": "Decision synthesis",
      "Decision impact": "Decision: Conditional Go for pilot. Stop full rollout.",
      "Verification need": "Close quote, export, permissions, DPA/subprocessor and AI gates."
    }
  ],
  "risks": [
    {
      "Risk ID": "NR-R-01",
      "Risk area": "TCO / Budget",
      "Exposure": "Business can exceed the EUR 300-1,000/month target range at 60 users; Enterprise controls sit in custom pricing.",
      "Claim basis": "NR-CL-01|NR-CL-02|NR-CL-03",
      "Impact": "High",
      "Likelihood": "High",
      "Decision effect": "Pilot can fit; full-rollout budget is not approval-ready.",
      "Verification need": "Formal quote for 25 and 60 users including billing, term, currency, taxes, AI and add-ons."
    },
    {
      "Risk ID": "NR-R-02",
      "Risk area": "Plan-fit controls",
      "Exposure": "Audit Log, SCIM, data residency, SIEM/DLP and other admin controls are plan-dependent.",
      "Claim basis": "NR-CL-07|NR-CL-09|NR-CL-16|NR-CL-26",
      "Impact": "High",
      "Likelihood": "High",
      "Decision effect": "Business can be insufficient if IT/security classifies these controls as mandatory.",
      "Verification need": "Classify mandatory vs optional controls; request Enterprise quote if needed."
    },
    {
      "Risk ID": "NR-R-03",
      "Risk area": "Export / Portability",
      "Exposure": "Export is documented, but restore/migration fidelity is not practically proven.",
      "Claim basis": "NR-CL-19|NR-CL-21|NR-CL-22|NR-CL-23|NR-CL-24",
      "Impact": "High",
      "Likelihood": "High",
      "Decision effect": "Full rollout should wait until an export test is passed.",
      "Verification need": "Pilot export with pages, databases, attachments, comments and Windows ZIP test."
    },
    {
      "Risk ID": "NR-R-04",
      "Risk area": "Permissions / External access",
      "Exposure": "SSO does not automatically solve guest access and external collaboration.",
      "Claim basis": "NR-CL-05|NR-CL-06|NR-CL-08|NR-CL-25",
      "Impact": "Medium-High",
      "Likelihood": "Medium",
      "Decision effect": "Uncontrolled sharing can create data-leakage and offboarding risk.",
      "Verification need": "Guest inventory, sharing policy, owner model and offboarding checklist."
    },
    {
      "Risk ID": "NR-R-05",
      "Risk area": "DPA / Subprocessors / Transfers",
      "Exposure": "DPA, subprocessors, transfers and data classes must be handed to legal/privacy before broad use.",
      "Claim basis": "NR-CL-14|NR-CL-15|NR-CL-17|NR-CL-18",
      "Impact": "High",
      "Likelihood": "High",
      "Decision effect": "Pilot can start with restricted data; full rollout needs responsible approval.",
      "Verification need": "Route DPA, subprocessors and data-residency scope to responsible owners."
    },
    {
      "Risk ID": "NR-R-06",
      "Risk area": "AI policy",
      "Exposure": "Notion AI can change privacy, retention, subprocessor and data-use profile if enabled or informally used.",
      "Claim basis": "NR-CL-04|NR-CL-27|NR-CL-28",
      "Impact": "High",
      "Likelihood": "Medium-High",
      "Decision effect": "Pilot must explicitly define AI use; do not import sensitive company data before approval.",
      "Verification need": "Confirm AI availability, disable/limit settings, retention, training statement and ZDR need."
    },
    {
      "Risk ID": "NR-R-07",
      "Risk area": "Knowledge-base lock-in",
      "Exposure": "Adoption can create process lock-in even when export is technically available.",
      "Claim basis": "NR-CL-21|NR-CL-23|NR-CL-29",
      "Impact": "Medium-High",
      "Likelihood": "High",
      "Decision effect": "A small pilot is safer than immediate company-wide migration.",
      "Verification need": "Limit pilot, define owners, run exit test and set documentation rules."
    },
    {
      "Risk ID": "NR-R-08",
      "Risk area": "False confidence from vendor pages",
      "Exposure": "Security/trust pages are useful signals but not customer-specific approval.",
      "Claim basis": "NR-CL-12|NR-CL-13|NR-CL-14",
      "Impact": "Medium-High",
      "Likelihood": "High",
      "Decision effect": "Rapid must not be presented as legal/security sign-off.",
      "Verification need": "Use the brief as a handoff map for IT, security and privacy."
    }
  ],
  "subprocessors": [
    {
      "Category": "Infrastructure",
      "Subprocessor": "AWS",
      "Purpose": "Hosting and storage systems",
      "Location": "USA, European Union, Korea, Japan",
      "Rapid implication": "Core hosting/storage path. Data classes and residency must not stay open before full rollout."
    },
    {
      "Category": "Platform",
      "Subprocessor": "Anthropic",
      "Purpose": "AI agents / large language models / embeddings",
      "Location": "Global",
      "Rapid implication": "AI use requires explicit policy and approval."
    },
    {
      "Category": "Platform",
      "Subprocessor": "Confluent",
      "Purpose": "Managed Kafka streaming for audit-log data and analytics",
      "Location": "USA, Germany, Korea, Japan",
      "Rapid implication": "Audit and analytics processing create location signals beyond the main application."
    },
    {
      "Category": "Platform",
      "Subprocessor": "Cloudflare",
      "Purpose": "Content distribution, security, abuse prevention and DNS",
      "Location": "Global",
      "Rapid implication": "Global edge/security processing must be disclosed to security/privacy owners."
    },
    {
      "Category": "Platform",
      "Subprocessor": "DeepL",
      "Purpose": "Translation services",
      "Location": "USA",
      "Rapid implication": "Translation features should be disabled or tightly scoped if sensitive content is possible."
    },
    {
      "Category": "Platform",
      "Subprocessor": "Fireworks",
      "Purpose": "Large language models and embeddings",
      "Location": "Global",
      "Rapid implication": "AI/embedding path. Confirm whether this path is active for customer scope."
    },
    {
      "Category": "Platform",
      "Subprocessor": "OpenAI",
      "Purpose": "Large language models, embeddings and abuse prevention",
      "Location": "Global",
      "Rapid implication": "AI processing must be approved. Do not import sensitive knowledge before AI scope is closed."
    },
    {
      "Category": "Platform",
      "Subprocessor": "Splunk",
      "Purpose": "Security and application logging",
      "Location": "USA",
      "Rapid implication": "Security/application logs may trigger US processing."
    },
    {
      "Category": "Platform",
      "Subprocessor": "Turbopuffer",
      "Purpose": "Vector database for storing embeddings",
      "Location": "USA, Germany, Korea, Japan",
      "Rapid implication": "Embedding storage is relevant if AI/search features are in scope."
    },
    {
      "Category": "Platform",
      "Subprocessor": "Twilio",
      "Purpose": "Multi-factor authentication",
      "Location": "USA",
      "Rapid implication": "Identity/security support processing; usually acceptable but still visible as a processor."
    },
    {
      "Category": "Platform",
      "Subprocessor": "Exa",
      "Purpose": "Web search results",
      "Location": "USA",
      "Rapid implication": "Web search creates a separate processing path."
    },
    {
      "Category": "Platform",
      "Subprocessor": "Google LLC",
      "Purpose": "Large language models and embeddings",
      "Location": "Global",
      "Rapid implication": "AI/model-provider path. Confirm whether Google model processing is in scope."
    },
    {
      "Category": "Platform",
      "Subprocessor": "Cerebras Systems Inc.",
      "Purpose": "Large language models and embeddings",
      "Location": "USA",
      "Rapid implication": "AI/model-provider path. Confirm whether used."
    },
    {
      "Category": "Platform",
      "Subprocessor": "StarTree Inc.",
      "Purpose": "Storage platform for in-product analytics",
      "Location": "USA, Germany, Korea, Japan",
      "Rapid implication": "Analytics storage expands the location footprint."
    },
    {
      "Category": "Platform",
      "Subprocessor": "Baseten Labs Inc.",
      "Purpose": "Large language models and embeddings",
      "Location": "Global",
      "Rapid implication": "AI/model-provider path. Confirm whether used."
    },
    {
      "Category": "Platform",
      "Subprocessor": "Parallel Web Systems",
      "Purpose": "Web search results and large language models / embeddings",
      "Location": "USA",
      "Rapid implication": "Search/AI feature path. Confirm whether enabled."
    },
    {
      "Category": "Platform",
      "Subprocessor": "Mathpix Inc.",
      "Purpose": "PDF file conversion",
      "Location": "USA, Germany, Singapore",
      "Rapid implication": "PDF conversion can touch imported documents; data-class rule required."
    },
    {
      "Category": "Platform",
      "Subprocessor": "Vercel Inc.",
      "Purpose": "Compute services for code execution and AI agent actions",
      "Location": "USA",
      "Rapid implication": "Agent/action features require explicit approval."
    },
    {
      "Category": "Platform",
      "Subprocessor": "Anysource Inc. dba Runlayer",
      "Purpose": "Security for MCP connections",
      "Location": "USA",
      "Rapid implication": "MCP/connector security path; relevant if integrations or agents are used."
    },
    {
      "Category": "Platform",
      "Subprocessor": "X.AI LLC",
      "Purpose": "Large language models and embeddings",
      "Location": "USA, Belgium",
      "Rapid implication": "AI/model-provider path. Confirm whether used."
    },
    {
      "Category": "Customer and Support Services",
      "Subprocessor": "Teleperformance",
      "Purpose": "Support services",
      "Location": "Greece",
      "Rapid implication": "Support access belongs in the privacy/security handoff."
    },
    {
      "Category": "Business Operations",
      "Subprocessor": "Amplitude",
      "Purpose": "Event logging for analytics",
      "Location": "USA",
      "Rapid implication": "Analytics processing; not a core blocker but must be disclosed."
    },
    {
      "Category": "Business Operations",
      "Subprocessor": "Customer.io",
      "Purpose": "Transactional, broadcast and marketing messaging",
      "Location": "USA",
      "Rapid implication": "Messaging processing; relevant for knowledge-base pilot if notifications/marketing are used."
    },
    {
      "Category": "Business Operations",
      "Subprocessor": "Fivetran",
      "Purpose": "Data pipeline to a data warehouse",
      "Location": "USA, Germany, Korea, Japan",
      "Rapid implication": "Disclose data-pipeline processing if customer data flows into analytics/warehouse."
    },
    {
      "Category": "Business Operations",
      "Subprocessor": "Mailgun Technologies Inc.",
      "Purpose": "Transactional, broadcast and marketing messaging",
      "Location": "USA",
      "Rapid implication": "Transactional messaging processing; include in privacy handoff."
    },
    {
      "Category": "Notion Entity",
      "Subprocessor": "Notion Labs Ireland Limited",
      "Purpose": "Support services",
      "Location": "Ireland",
      "Rapid implication": "Support entity inside the EU/EEA context."
    },
    {
      "Category": "Notion Entity",
      "Subprocessor": "Brain Capital Labs PVT Ltd.",
      "Purpose": "Support services",
      "Location": "India",
      "Rapid implication": "Support location outside the EU; include in transfer review."
    },
    {
      "Category": "Notion Entity",
      "Subprocessor": "Notion Labs Japan G.K.",
      "Purpose": "Support services",
      "Location": "Japan",
      "Rapid implication": "Support location outside the EU; include in transfer review."
    },
    {
      "Category": "Notion Entity",
      "Subprocessor": "Notion International Inc.",
      "Purpose": "Support services",
      "Location": "United States",
      "Rapid implication": "US support entity; include in transfer review."
    },
    {
      "Category": "Notion Entity",
      "Subprocessor": "Notion Labs Australia Pty Ltd",
      "Purpose": "Support services",
      "Location": "Australia",
      "Rapid implication": "Support location outside the EU; include in transfer review."
    },
    {
      "Category": "Notion Entity",
      "Subprocessor": "Notion Labs United Kingdom Private Limited",
      "Purpose": "Support services",
      "Location": "United Kingdom",
      "Rapid implication": "UK support entity; include in transfer review."
    },
    {
      "Category": "Notion Entity",
      "Subprocessor": "Notion Labs Korea Ltd",
      "Purpose": "Support services",
      "Location": "South Korea",
      "Rapid implication": "Support location outside the EU; include in transfer review."
    },
    {
      "Category": "Notion Calendar",
      "Subprocessor": "AWS",
      "Purpose": "Hosting and storage systems",
      "Location": "USA",
      "Rapid implication": "Calendar has a separate hosting-location signal."
    },
    {
      "Category": "Notion Calendar",
      "Subprocessor": "Cloudflare",
      "Purpose": "Content distribution, security, abuse prevention and DNS",
      "Location": "Global",
      "Rapid implication": "Calendar edge/security processing."
    },
    {
      "Category": "Notion Calendar",
      "Subprocessor": "Amplitude",
      "Purpose": "Event logging for analytics",
      "Location": "USA",
      "Rapid implication": "Calendar analytics processing."
    },
    {
      "Category": "Notion Calendar",
      "Subprocessor": "Customer.io",
      "Purpose": "Transactional, broadcast and marketing messaging",
      "Location": "USA",
      "Rapid implication": "Calendar messaging processing."
    },
    {
      "Category": "Notion Calendar",
      "Subprocessor": "Mailgun Technologies Inc.",
      "Purpose": "Transactional messaging",
      "Location": "USA",
      "Rapid implication": "Calendar transactional messaging."
    }
  ],
  "verification_queue_markdown": "# Notion Rapid Verification Queue\n\nStatus: 2026-06-30\n\n## Before pilot\n\n1. Quote / plan fit: written price assumption for 25 and 60 users, term, billing, currency, taxes, AI/add-ons.\n2. Control classification: classify SSO, Audit Log, SCIM, data residency, SIEM/DLP and DLP as mandatory or optional.\n3. DPA handoff: route DPA, subprocessors, transfers and data classes to legal/privacy.\n4. AI policy: decide whether Notion AI is off, limited or allowed during the pilot.\n5. Data classes: define prohibited pilot data, e.g. special categories, HR, customer-confidential data and security secrets.\n\n## During the two-week pilot\n\n1. SSO proof: test SAML with real IdP configuration.\n2. Permission proof: test teamspaces, private pages, sharing, guests and offboarding.\n3. Export proof: export workspace with pages, databases, attachments, comments and nested structures.\n4. Restore/fidelity review: assess exported material for readability, structure loss and rebuild effort.\n5. Database proof: separately export database views, relations, filters and process documentation.\n\n## Before full rollout\n\n1. Decide whether Business is enough or Enterprise is required because of Audit Log, SCIM, data residency, SIEM/DLP or ZDR.\n2. Recalculate 60-user TCO with a real quote instead of public pricing.\n3. Confirm AI retention and subprocessor conditions in writing.\n4. Legal/privacy confirms the DPA handoff.\n5. Full-rollout decision only after passed export and permission test.\n",
  "scope_rule": "Rapid Screen is triage: one vendor, top sources, top risks, short decision note and evidence sheet. It is not legal advice, technical security testing, market scan or contract redlining."
}