Comment by peterldowns

And for anyone who hasn't gone through the certification process before, SOC 2 Type I means that they were able to demonstrate a set of controls and evidence that their implementation passes those controls — just once. Type 2 is continuously evaluated. Notion being SOC 2 Type 2 and Notion Email only being Type 1 is a red flag that they're doing something weird or not re-using policies and infrastructure.