# A private workspace instead of Notion, for client matters

General information, not legal advice. By Josef Long, October 17, 2026.

Notion is a flexible workspace, and plenty of firms use it for wikis, checklists and project tracking. The question for a law firm is narrower: should the notes, calls and documents that belong to a client matter live in a cloud workspace at all?

## What Notion says about security

- Where data lives: customer data is hosted on Amazon Web Services infrastructure, not on a firm's own machines.
- Encryption: Notion says data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. https://www.notion.com/help/security-and-privacy
- AI and training: Notion's Trust Center says customer data is not used to train or influence its AI models, and describes zero data retention at its AI providers for Enterprise workspaces and a maximum 30-day retention on other plans. https://trust.notion.com/

These are reasonable practices for a general business tool. They also show the trade: the vendor hosts the data, and the firm relies on the vendor's controls and contract. Check the current wording, because vendors change their terms.

## What a law firm should ask of any workspace

1. Who can read client content, including the vendor's staff and AI providers?
2. Can we hold the keys?
3. Can we wall a matter, so walls bind people, search and AI?
4. Does the AI see more than the user can?
5. What happens to our data if we leave, or the vendor changes?
6. Do clients need to consent? See ABA Formal Opinion 512 (July 29, 2024).

## How a private workspace for client matters is different

| Question | A cloud workspace such as Notion | A private workspace (VaultScribe design) |
|---|---|---|
| Where pages live | On the vendor's cloud infrastructure. | On the firm's own machines or its own server. |
| Who holds the keys | The vendor, under its security controls. | The firm. |
| Matter walls | Page and workspace permissions. | Walls enforced by policy and by encryption, binding people, search and agents. |
| Meetings and calls | Notes added by hand or by a connected tool. | Every meeting is a page, captured on your own computer with no bot in the call. |
| AI | Runs through the vendor's AI providers. | Runs locally by default. Cloud models are off until an administrator allows them. |
| Legal workflows | General-purpose, built by each firm. | Time entries, deadlines, template-based drafting, privilege labels, retention and legal holds. |

## What you would still have

VaultScribe is designed with pages, slash commands, mentions, backlinks, comments, version history and live co-editing, and every AI edit to a page is saved as its own labeled version that you can revert. It adds matters with walls, people pages, templates in your format, and an agent that answers across everything you may see.

## When Notion is still the right tool

For work that has nothing to do with a client matter, a general tool like Notion may remain a good choice. Notion can be connected to VaultScribe as a source, and importing a whole Notion workspace is planned and not yet available.

## Questions

**Is Notion secure enough for a law firm?** It depends on your obligations, the plan and contract, and whether client consent is needed.

**What is a private workspace for client matters?** Pages, meetings, documents and an AI agent on the firm's own machines or server, under keys the firm holds, with walls between matters.

**Can VaultScribe replace Notion for everything?** No. It is built around client matters.

**Can I use VaultScribe today?** No. It is a design preview and is accepting founding design partners: hello@vaultscribe.app

Notion is a trademark of its owner. VaultScribe is not affiliated with or endorsed by Notion Labs.