Notion
Connect Notion to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Notion to collect compliance as code evidence with automated compliance tests, switched on per workspace.
| Category | Compliance As Code |
| Connect with | API token, MCP server |
| What a connection produces | Automated compliance tests |
| Notion's guide | developers.notion.com |
Connect with an API token
-
In Notion:
- As a Notion Workspace Owner, go to https://app.notion.com/developers/connections.
- In the Build section of the sidebar, choose Internal connections.
- Click Create a new connection, enter a connection name, and select the workspace where it will be installed.
- Open the Configuration tab and copy the API token. Paste it into Access token.
- On the Configuration tab, set the connection's capabilities so it can read user information, and leave update content and insert content off so the connection is read-only.
- Optional, only if Safeguard should read pages: open the connection, click Content access, then Edit access to pick pages and databases (or, on a page, open ••• › Connections › + Add connection).
Only a Workspace Owner can create an internal connection. Notion now calls integrations connections; the token stays available on the Configuration tab. Listing users needs the user-information capability; page access is not needed for user lists.
Source: developers.notion.com, checked 2026-10-07.
The permissions Safeguard needs:
Read user information including email addresses. -
On Compliance › Connectors, open Notion, click Connect, choose API token and fill in:
Field What to enter Access token Required. Stored encrypted and never shown again. -
Click Connect with token.
Connect with the MCP server
Choose MCP server: the address https://mcp.notion.com/sse is filled in. Sign in to Notion when asked. It lets Griffin AI search Notion; the compliance evidence comes from the API token connection.
Frameworks
Safeguard's automated tests read Notion and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3 | 2 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5 | 2 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4) | 2 |
| PCI DSS | Automated tests | 7.2.4, 8.2.5 | 2 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-05 | 2 |
These tests are switched on per workspace by the Safeguard team.
Related
- Compliance As Code connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks