So Fireworks is ZDR by default, yet Notion configured (asked) Fireworks to retain data? Otherwise, how is there anything to leak?

On the main fireworks breach page, they also say some customer weights of models and datasets to train them were leaked.

This is a strong reminder that a company's security is only as strong as its third-party integrations. Even when customer data is handled by trusted platforms, external AI vendors can introduce additional risks. Businesses need to carefully evaluate vendor security, limit the data shared with external services, and maintain transparency when incidents happen. As AI adoption grows, third-party risk management should become a core part of every company's security strategy.

the whole incident response post feels like a huge cop-out. “abundance of caution”, the vendor is one of the biggest, so ofc it’s not our fault for choosing them… etc.

Forcing us to the Enterprise plan to see which members are affected huh? Classy move Notion.