You should note that before sending a Corda transaction to a non-validating notary service, each Corda transaction is filtered as
it is StateRef || it is TimeWindow || it == notaryParty
This means that the non-validating notary service will be able to view the following:
All inputs that are in the form of StateRef
Identity of the notary of the transaction
As transactions are in the form of Merkle trees, remaining components are filtered out. And once the notary signature is applied, the content of the transaction can never be altered.