How Sotion protects your Notion content
Every week, someone asks us a version of the same smart question: "If my Notion page has to be published to the web, how is my Sotion site actually private?" Here's the honest, plain-English answer — with a short technical section at the end for those who want it.
The short version
Your Sotion site sits behind a locked front door. Visitors who haven't signed in receive a sign-in screen and nothing else — no content ever reaches their browser.
The published Notion page behind your site lives at an unlisted address that is practically impossible to guess, isn't listed anywhere, and (with Notion's default settings) is invisible to search engines.
Sotion actively hides that address: nothing on your site — not the links, not the underlying page data — reveals where your Notion content lives.
Sotion never holds the keys to your workspace. It can only ever see the pages you've explicitly published. That's a deliberate design choice, and it's why publishing is required.
Why does my page have to be published in the first place?
Publishing to the web is the mechanism Notion provides for showing pages to people outside your workspace. It's the plumbing that Sotion — and every tool like it — builds on.
But "published" doesn't mean "findable." A published Notion page lives at an address containing a random 32-character code. There's no public directory of published pages, and search engines don't list them unless you ask Notion to allow it. The only way to open that page is to be handed the exact link. If you've ever used "anyone with the link" sharing in Google Drive, it's the same model: the link itself is the secret.
There's also a deeper reason we build on publishing, and it's about your safety — more on that below.
What's actually protecting my content?
Three layers, working together.
1. A locked front door. Your Sotion site is where people actually visit, and you decide who gets in: a shared password, individual member logins, paid access through Stripe, or different rules for different pages. Until someone signs in, our servers send their browser a sign-in screen and nothing more. A search engine crawling a protected Sotion site sees exactly what a stranger sees: a login box.
2. An unlisted original. The published Notion page's address is one random code out of roughly 340 undecillion possibilities. Trying a billion guesses every second for the age of the universe wouldn't find it. Combined with search indexing staying off, the address is effectively invisible unless someone is given it.
3. Active concealment. This is where Sotion goes further than the sign-in box. Every page identifier on your site is replaced with a scrambled stand-in before it ever leaves our servers — in the address bar, in every link, and in the page data your visitors' browsers receive. The scrambled identifiers are meaningless outside your Sotion site, and every reference to your Notion workspace's address is rewritten to your own domain. Even a technically curious member inspecting your site's source code won't find their way back to the original Notion page.
Could my content be maliciously discovered?
Let's walk through the realistic scenarios:
Guessing the address? No — see the numbers above.
Finding it on Google? Not if search engine indexing is off in Notion's publish settings (it's off by default — worth verifying on each page you publish).
Scanning or crawling Notion? There's no index of published pages to scan, and pages aren't discoverable from a workspace's address alone.
Extracting it from your Sotion site? No — that's exactly what the scrambled identifiers prevent.
A person sharing the link. This is the one that matters. Anyone who is given the exact Notion address can open that page directly, bypassing your site's sign-in. Links leak through people, not computers.
So the golden rule is simple: only ever circulate your Sotion URL, and treat the underlying Notion link like a password. And if you ever suspect a link has leaked, unpublishing in Notion takes the page offline everywhere, immediately.
What happened to connecting private pages?
Long-time users may remember that the first version of Sotion could connect private Notion pages. It worked by asking for your Notion session cookie (token_v2) — effectively a copy of your Notion login.
We removed it, on purpose.
A session cookie doesn't unlock one page; it unlocks everything your account can see — every teamspace, every private page, your whole workspace. Holding thousands of those on our servers meant that a single bug or breach could have exposed customers' entire workspaces. No feature is worth that.
Today's model is the opposite: Sotion holds no credentials to your workspace at all. You publish exactly the pages that belong on your site, and those pages are all Sotion can ever reach. The requirement to publish isn't a limitation of the security model — it is the security model. The safest key is the one we never hold.
Your controls, in one checklist
In Notion:
Share → Publish → keep Search engine indexing off (the default) and Duplicate as template off.
On the Share tab, keep General access restricted — don't use "Anyone on the web with link."
Publishing a page publishes everything nested inside it. Keep site content in its own tree, and keep sensitive material (HR, finance, personal records) in pages that are never published.
In Sotion:
Pick the access control that fits: shared password, individual members, groups, or paid access.
Remove a member and they're locked out within a couple of minutes — everywhere.
Nuclear option: unpublish in Notion, and the content is offline on both your site and the Notion address instantly.
For the technically curious
A brief sketch of how this works under the hood, without giving away the blueprints:
Access control runs at the edge. Every request is checked on Cloudflare's global network before any content is fetched or served. Unauthenticated requests to a protected site terminate at the sign-in page — content never enters the response.
Sessions are signed and short-lived. Member sessions use signed, expiring credentials, and revocations (removing a member, changing access rules) propagate globally within minutes.
Identifier obfuscation. All Notion page identifiers are transformed into opaque, site-specific identifiers before reaching the browser — in URLs, links, and API payloads. The mapping back to the originals exists only server-side.
Least privilege by design. Sotion stores no workspace credentials and has read-only reach, scoped to explicitly published pages. There is no code path from Sotion to your private Notion content.
And one honest note: no system deserves blind trust, including ours. The published Notion address remains a bearer secret — anyone holding it can use it. That's why we layer concealment, access control, and fast revocation on top of it, and why our rule of thumb is: Sotion is the right home for anything you'd comfortably email your whole team. Truly sensitive data belongs in private, unpublished Notion pages — and nothing we build will ever ask you to hand over the keys to those.
Questions we didn't cover? Email us at [email protected] — this post exists because people asked.