service windsurfvendor Cognitioncategory Coding tools
Depends (Caution)The windsurf.com security page now carries Cognition's Devin-wide terms: default may train; paid plans can opt out; Enterprise is not trained on without written consent. No Windsurf-specific wording was found.
The windsurf.com security page now carries Cognition's Devin-wide terms: default may train; paid plans can opt out; Enterprise is not trained on without written consent. No Windsurf-specific wording was found.
By default, we may use your data for model training purposes to improve and enhance the Services. If you’re on a paid plan, you can opt out at any time on the Data Controls settings page.
The Windsurf MSA (Exafunction) data-use guidelines say customer data is deleted once output is generated and not stored at rest. Exceptions on cloud plans: features that need persistence (indexing, memories etc.), AUP-flagged input, and profile data. Retention for self-serve users on the consumer terms was not confirmed.
is deleted once Output is generated
Against the 21 tools that state a period (grey dots):
After opting out of training, ZDR is enabled with model providers.
After you opt out, your data will not be used for training and Zero Data Retention will be enabled with our model providers.
Teams/Enterprise admins can unlock Anthropic and OpenAI models that require retention for trust-and-safety checks; those providers keep data up to 30 days and do not train on it. Otherwise ZDR applies after training opt-out.
Unlocks additional Anthropic models that require data retention for trust and safety verification. Anthropic stores this data for up to 30 days and does not train on it.
The core cluster is in the US. A Frankfurt cluster for European enterprise customers keeps processing and retention in the EU (announced in the Wave 10 blog post). A FedRAMP deployment runs on AWS GovCloud. No Asia or Singapore region found.
A datacenter in Frankfurt for our European enterprise customers that guarantees that all data processing and data retention stays within EU borders.
Cognition-level attestation.
Cognition has been SOC 2 Type II certified since September 2024.
The Windsurf MSA tells customers not to share protected health information. No BAA offer found.
You agree not to share with us or otherwise process any protected health information.
The self-hosted deployment is in maintenance mode: current customers are supported until the end of their term, but no new customers are taken. A Hybrid deployment keeps persisted data in a customer-controlled instance.
we are no longer investing in feature development or bringing on new customers to the self-hosted platform.
Spotted something wrong or out of date? Corrections are welcome; see how to send one. How statuses are assigned.