| Before | After | ||
|---|---|---|---|
| 0 | Security Table of Contents Certifications and Third-Party Assessments Deployment Options Data Flows Agentic Experience Contractors and Subcontractors Attribution and Compliance Client Security Codebase Indexing Zero Data Retention Account Deletion Vulnerability Disclosures Last updated: March 11, 2025 We recognize that we handle important intellectual property for our customers, both individuals and enterprises, so we aim to be overly comprehensive and transparent with how we approach security and privacy throughout our development and deployment. | 0 | 01 Reduce your security debt Security debt grows when known issues are easy to identify but hard to safely fix. |
| 1 | Our prioritization of security & compliance has already instilled confidence in hundreds of thousands of developers and thousands of companies, including some of the world's largest regulated enterprises. | 1 | Devin helps teams turn that backlog into maintained code by taking on remediation work across vulnerabilities, dependency updates, insecure configurations, and repeated patterns across one or many repos. |
| 2 | We plan to continue to maximize the value of our tools under any set of constraints that a customer may have. | 2 | Run on demand or on a schedule, Devin helps security teams reduce backlog pressure while keeping fixes inside engineering's existing review process. |
| 3 | If at any point you identify potential vulnerabilities or have security-related questions, please contact us at security@windsurf.com . | 3 | Customer proof — Itaú ~70% of SonarQube, Fortify, and Veracode vulnerabilities resolved automatically. |
| 4 | Certifications and Third-Party Assessments Windsurf has SOC 2 Type II certification , and conducts annual third-party penetration testing (last completed on February 13, 2025). | 4 | Itaú used Devin to clear a large vulnerability backlog across their scanner findings, reducing remediation burden on their engineering teams at scale. |
| 5 | To receive copies of these documents, please fill out the form on our Trust Center . | 5 | Read the case study → Workflows Clear backlog — Address large backlogs across one or many repos, such as stored credentials, insecure configurations, missing best-practice updates, or outdated security patterns. |
| 6 | Windsurf also has available FedRAMP High accreditation . | 6 | Snyk Vulnerability Burn Down → Routine work — Set Devin to run on a recurring basis to handle routine security maintenance, such as remediating CVEs, performing dependency bumps, or patching SAST/SCA findings. |
| 7 | While this is a requirement for working with federal agencies and government-adjacent enterprises, it is an important vote of confidence for all of our customers, even if they do not use our FedRAMP'd deployment. | 7 | Daily Sentry Error Fixes → Weekly Dependency Update → Risk identification — Run Devin across your repos to find what your scanners miss: logic flaws, insecure patterns, missing auth checks, and chained low-severity CVEs that become critical in context. |
| 8 | This is because FedRAMP requires a number of secure development and company practices that are not requirements for SOC 2 Type II compliance. | 8 | Daily Design Audit → 02 Secure every release Devin helps teams turn blocked PRs and failed checks into review-ready fixes by taking on remediation work across failing tests, insufficient coverage, dependency vulnerabilities, and CI/CD or security check failures. |
| 9 | These include: Code review process that highlights security impact of changes, enforces a requirement for number of reviewers, and other compliant procedures Company MDM in place with posture management and active EDR on all employee devices (S1) Zero trust VPN for access to remote resources OWASP ASVS Level 1 Compliance (includes tooling such as Snyk), with path to Level 2 and Level 3 compliance over time Training relevant developers for disaster recovery and information security contingency planning Both tabletop and functional vulnerability testing HIPAA compliance: In most cases, the data that a customer provides to us is not Personal Health Information (PHI) and does not need special compliance considerations in order to use our platform, even if you are a healthcare organization. | 9 | Triggered from PRs, CI/CD, or on demand, Devin helps teams keep releases moving while keeping fixes inside engineering's existing review and merge process. |
| 10 | This is particularly true for code, which does not carry any PHI itself. | 10 | In the wild — axios supply-chain attack Caught in under an hour, before the attack was publicly known. |
| 11 | That said, our platform is maintained as HIPAA compliant and for significant implementations, we will entertain a Business Associate Agreement (BAA) to confirm HIPAA compliance. | 11 | On March 31, 2026, a malicious version of axios (1.14.1) shipped with a hidden dependency on an impersonator package masquerading as crypto-js. |
| 12 | Deployment Options Unlike most AI tools, Windsurf provides a variety of deployment options to match the security needs of any organization. | 12 | Devin Review flagged it for multiple Cognition customers about 45 minutes after publication — pinpointing the new dependency, the broken-CI publishing pattern, and the impersonator package, and recommending the PR not be merged. |
| 13 | On our cloud tiers (individual plans, teams plans, and Enterprise Cloud plans), any AI requests are processed and routed on servers managed by Windsurf, and depending on the operation, may be executed on servers managed by Windsurf or by one of our subprocessors. | 13 | Read Scott Wu's post → CI/CD Remediation Loop 01 Developer opens PR 02 CI, tests, scanners, and policies run 03 Failure detected 04 Devin investigates, traces root cause, and patches 05 CI reruns 06 Devin iterates until checks pass 07 Human reviewer approves (Devin augmented review) Workflows Investigate and fix failed checks — Add Devin to your CI/CD pipeline so that when a vulnerability is detected, Devin automatically generates a fix and pushes commits directly onto the original PR. |
| 14 | For any teams or enterprise plans, all inputs and outputs to these requests follow zero-data retention policies by default. | 14 | Autofix GitHub CI Failures → Launch readiness documentation — Automatically update developer guides, implementation notes, and launch checklists. |
| 15 | For any individual plan, users can opt-in to zero-data retention mode from their profile page. | 15 | Autoupdate Documentation → AI-assisted review before merge — Use Devin Review as a consistent first-pass reviewer on every PR. |
| 16 | A large fraction of individual users have zero-data retention mode enabled. | 16 | It inspects diffs with codebase context, flags bugs and risky patterns, and with Auto-Fix enabled can push fix commits directly to the branch. |
| 17 | Read more about zero-data retention mode below. | 17 | Enable Devin Review → 03 Accelerate triage and response Triage slows down when every alert, security finding, or incident requires a human to gather context before remediation can begin. |
| 18 | Enterprises can enable functionalities that require data retention (ex. remote codebase indexing, memories, recipes, and web retrieval) or functionalities that require subprocessors where we don't have zero-data retention guarantees (ex. web search and MCP servers on Cascade). | 18 | Devin helps teams turn alerts into action by taking the first pass across security findings, vulnerability reports, and incident follow-up work. |
| 19 | On our Enterprise Hybrid tier, all functionalities that require data retention occur on a CPU-and-storage-only tenant that is managed by the customer. | 19 | Alert Triage Flow Trigger sources (Slack, GitHub, Jira, Linear, SIEM, Cloud security tools, PagerDuty, or webhooks). |
| 20 | This component is provided as a Docker Compose application that can be deployed on an instance (EC2, GCE, Azure VM, on-prem) within the customer's cloud or network. | 20 | Devin helps teams reduce manual investigation time while keeping remediation inside the same PR, CI/CD, and review controls engineers already use. |
| 21 | Any communication between the customer's data-retaining instance and Windsurf's compute layer will only require outbound communication and is handled through a Cloudflare Tunnel Client to establish a persistent, secure tunnel between the two. | 21 | Devin investigates Gathers code context, identifies root cause, proposes or implements the fix. → Review-ready PR Human reviews and approves. |
| 22 | Cloudflare handles client requests and forwards them through this daemon, eliminating the need to open firewall ports and allowing the customer's origin to remain as secure and closed as possible. | 22 | Workflows Findings remediation — Tag Devin in Slack, Jira, Linear, or GitHub to investigate and take a first pass at fixing a security finding. |
| 23 | For both our Cloud and Hybrid tiers for enterprises, we offer multiple underlying deployments for the pieces managed by Windsurf in order to meet requirements of various sectors and countries around data processing and residency: Standard: Servers managed by Windsurf, located in the United States FedRAMP High: Servers managed in an AWS GovCloud through Palantir's FedStart Program Zero trust VPN for access to remote resources EU: Servers managed by Windsurf, located in Frankfurt, Germany On our Enterprise Self-hosted tier, all compute and data retention happens within a GPU-enabled tenant that is managed by the customer. | 23 | Bug Fix via Datadog MCP → Bug Fix via Webhook → Automated alert triage — Trigger Devin from your security scanners or SIEM-style workflows to investigate alerts, identify likely causes, and propose or implement remediation. |
| 24 | The application is provided as a Docker Compose application or via Helm chart (for a Kubernetes deployment), and can be deployed within a customer's private cloud (AWS, GCP, Azure) or on-prem datacenter. | 24 | Auto-Investigate Datadog Alerts → Post-incident follow through — After an incident, have Devin draft the first version of the postmortem, summarize contributing factors, and update relevant runbooks and documentation. |
| 25 | This tier supports connecting to a customer's private trusted LLM-endpoint (ex. | 25 | Autogenerate a Runbook → |
| 26 | AWS Bedrock, Azure OpenAI, Google VertexAI). | — | Removed |
| 27 | No traffic is ever routed past the customer's firewalls except to this trusted endpoint. | — | Removed |
| 28 | Even the installation and updates can be performed without a direct connection by locally downloading the images from Windsurf's container registry, uploading them to a private container registry, and performing deployment from that location. | — | Removed |
| 29 | For full transparency, the Self-hosted tier, while providing maximum security, does not support a large number of Windsurf's cutting-edge products and capabilities, such as the Windsurf Editor or Cascade. | — | Removed |
| 30 | On all Enterprise tiers, Windsurf supports Single Sign-On (SSO) via SAML, such as Microsoft Entra, Okta, Google Workspaces, or another SAML-supporting identity provider. | — | Removed |
| 31 | The most popular Enterprise deployment method is the Hybrid deployment to balance security needs on data retention with the ability to benefit from Windsurf's latest-and-greatest capabilities such as the Windsurf Editor and Cascade. | — | Removed |
| 32 | If you are an organization that has more developers than the self-serve limit (200 developers), please reach out to work with an account specialist to determine the proper deployment approach for your organization. | — | Removed |
| 33 | Data Flows Note that most of the following details around our servers and infrastructure are relevant only to the Cloud and Hybrid deployments. | — | Removed |
| 34 | The following are all causes for requests to be made to our servers: Passive Experience: For Autocomplete, Supercomplete, and tab-to-jump (i.e. passive predictive AI suggestions), a request is made on every keystroke to the Windsurf servers. | — | Removed |
| 35 | Instructive Experience: For Command and Chat (i.e. experiences that require the user to manually write out a prompt for the AI), a request is made on every user instruction. | — | Removed |
| 36 | Agentic Experience: For Cascade (i.e. agentic experience where the AI can take multiple “steps” independently), requests are made on every triggering user instruction, every reasoning step the agent makes, and on most tool calls. | — | Removed |
| 37 | See further information about the Agentic experience below. | — | Removed |
| 38 | Real-time Personalization: Even without a trigger such as a keystroke or user prompt input, requests are made in the background to build context, understand developer intent, or scan for potential next steps. | — | Removed |
| 39 | Ahead-of-time Personalization: To build state on the existing codebases and other data sources, requests are made to perform embedding computations. | — | Removed |
| 40 | Within each of these requests, the client machine sends a combination of context, such as relevant snippets of code, recent actions taken within the editor, the conversation history (if relevant), and user-specified signals (ex. rules, memories, context pinning, etc). | — | Removed |
| 41 | No single request contains entire codebases or large contiguous pieces of code data. | — | Removed |
| 42 | Even for ahead-of-time personalization, any codebase parsing happens on the client machine and individual code snippets are sent to compute the embeddings so that the server is not receiving a single request with the entire codebase. | — | Removed |
| 43 | This data is sent to our infrastructure on GCP, which pulls precomputed information from client-independent sources such as remote indexing and combines all of these to a model runner that may perform inference on our managed infrastructure or route the inputs to the appropriate inference provider. | — | Removed |
| 44 | The result is then returned back to the client machine to be displayed to the user, while usage analytics (no code data, only usage metadata) are logged to BigQuery within our GCP instance. | — | Removed |
| 45 | If on an individual plan without Zero-data retention mode, logs that may contain code snippets and user trajectories could also be stored. | — | Removed |
| 46 | All data is encrypted via TLS between the client machine and our servers. | — | Removed |
| 47 | We currently support only multitenant infrastructure and do not yet have a single-tenant option with our infrastructure. | — | Removed |
| 48 | Agentic Experience Note that the agentic experience is only available on Cloud and Hybrid plans, currently only within the Windsurf Editor, not the IDE extensions. | — | Removed |
| 49 | Since the term “agentic” is relatively overused, we will define what it means for Windsurf's products. | — | Removed |
| 50 | We define “agentic” as a system that is capable of multi-step reasoning and actions through a sequence of interspersed calls to large language models and invoked “tools” (ex. grep, ls, embedding search, web search, edit file, add file, etc). | — | Removed |
| 51 | This is differentiated to the more “assistant” or “copilot” style of AI systems, where there is guaranteed to be a maximum of a single large language model inference call before requiring human intervention to accept a suggestion or continue the conversation. | — | Removed |
| 52 | Windsurf's current agent is named Cascade and can be classified as a “collaborative agent” as opposed to an “autonomous agent.” A collaborative agent operates on a surface that is visible and introspectable by the user, in our case the IDE surface, as opposed to an autonomous agent where the work happens asynchronously, perhaps on a remote machine. | — | Removed |
| 53 | With a collaborative agent, a human is still entirely in the loop. | — | Removed |
| 54 | The default behavior is that the collaborative agent can take multiple steps with safer tools (ex. grep, ls, embedding search, edit file, add file), but that the human has to explicitly approve actions such as terminal commands that could have side effects. | — | Removed |
| 55 | Any state changes such as file edits are not immediately committed to the codebase, and require explicit review and acceptance by the user, maintaining the human-in-the-loop flow. | — | Removed |
| 56 | This approach allows for much more capable AI systems while still maintaining the same levels of observability and human validation as “assistant” or “copilot” AI code assistants that have been widely adopted across companies of every size and industry. | — | Removed |
| 57 | With this understanding, in many ways, the data being sent to the Windsurf servers for agentic experiences is similar to that of the passive and instructive experiences. | — | Removed |
| 58 | Under each turn of the agent, this data is sent to the user-specified third-party inference provider to determine what action the agent should take (see next paragraph). | — | Removed |
| 59 | Once the action is taken, the results become part of the conversation history that is incorporated into the data sent as part of the next request to the Windsurf servers for the next turn of the agent. | — | Removed |
| 60 | This alternating reasoning and tool-based action pattern creates the agentic experience, which ends when the reasoning step determines that no further actions need to be taken at the time. | — | Removed |
| 61 | At periodic intervals, a request is made to summarize and checkpoint earlier parts of the conversation to prevent an unbounded explosion in conversation history and to improve performance. | — | Removed |
| 62 | Depending on the tool being called within the agentic step, a variety of actions could be taken: Some tools such as making code edits or performing an LLM-based search (Riptide) require additional model inferences and similar data is used as in the reasoning step. | — | Removed |
| 63 | Many tools (ex. add file, grep, ls) will run a terminal command automatically using the client's IDE's native terminal. | — | Removed |
| 64 | These are known, safe, constrained terminal commands with minimal, if any, side effects. | — | Removed |
| 65 | Another tool suggests arbitrary terminal commands for the user to accept before being executed, which could include actions such as compilation, binary execution, infrastructure inspection, and more. | — | Removed |
| 66 | These also use the client's IDE's native terminal. | — | Removed |
| 67 | There are various modes for this tool, including an opt-in mode that will auto-run every command, independent of risk (unavailable for any Teams or Enterprise user), as well as controls to whitelist or blacklist various commands. | — | Removed |
| 68 | By default, no suggested terminal command auto-runs for customer infrastructure security reasons. | — | Removed |
| 69 | The web search tool is a Teams and Enterprise opt-in that constructs a search query that is sent to the Bing API to retrieve up-to-date website data. | — | Removed |
| 70 | This query is derived from the user's inputs, past conversation history, and potentially code data. | — | Removed |
| 71 | Contractors and Subcontractors Depending on your choice of plan (and thus deployment), we may use some or all of the following subcontractors. | — | Removed |
| 72 | In some cases we have listed contractors that form a part of our infrastructure but are not subcontractors with respect to our customers. | — | Removed |
| 73 | Google Cloud Platform (GCP) (Stores code data only if Cloud and relevant features are opted-in, sees code data): Usage analytics and logs are primarily hosted on GCP. | — | Removed |
| 74 | These are located in the same region as the compute used for model inference. | — | Removed |
| 75 | We also use GCP to host retained data under Enterprise Cloud plans if the opt-in has been selected for corresponding features (ex. remote indexing, organizational best practices, etc). | — | Removed |
| 76 | This data retention happens in the customer tenant for the Enterprise Hybrid plans and therefore not within our instance of GCP. | — | Removed |
| 77 | Crusoe (Sees code data for inference): We manage Crusoe's compute for training some of our custom models, as well as hosting some of our custom models. | — | Removed |
| 78 | Modal (Sees code data for inference): We manage Modal's compute for training some of our custom models, as well as hosting some of our custom models. | — | Removed |
| 79 | Oracle Cloud (Sees code data for inference): We manage Oracle Cloud's compute for training some of our custom models, as well as hosting some of our custom models. | — | Removed |
| 80 | Our cluster in Frankfurt, Germany runs on Oracle Cloud. | — | Removed |
| 81 | Palantir (Sees code data for inference): We have utilized Palantir's FedStart program to achieve FedRAMP High accreditation, and serve our FedRAMP High customers through FedStart. | — | Removed |
| 82 | AWS (Sees code data for inference): We utilize AWS GovCloud within Palantir's FedStart program to serve our customer models for our FedRAMP High customers. | — | Removed |
| 83 | We also leverage AWS Bedrock to serve some of Anthropic's models. | — | Removed |
| 84 | OpenAI (Sees code data for inference): We have a zero data retention agreement with OpenAI. | — | Removed |
| 85 | Enterprise administrators can disable use of OpenAI models for their organization. | — | Removed |
| 86 | We offer the optionality of using OpenAI's models for various AI requests. | — | Removed |
| 87 | We may leverage OpenAI models independent of user selection for processing other tasks (e.g. for summarization). | — | Removed |
| 88 | Anthropic (Sees code data for inference): We offer the optionality of using Anthropic's models for various AI requests. | — | Removed |
| 89 | We may leverage Anthropic models independent of user selection for processing other tasks (e.g. for summarization). | — | Removed |
| 90 | We have a zero data retention agreement with Anthropic. | — | Removed |
| 91 | Team and Enterprise administrators can disable use of Anthropic models for their organization. | — | Removed |
| 92 | Enterprise customers using our EU cluster will be utilizing Anthropic models served from an AWS Bedrock instance in Zurich, Switzerland. | — | Removed |
| 93 | Enterprise customers using our FedRAMP environment will be utilizing Anthropic models served from an AWS Bedrock instance in an AWS GovCloud region. | — | Removed |
| 94 | Google Cloud Vertex API (Sees code data for inference): We offer the optionality of using Google Cloud Vertex API's models for various AI requests. | — | Removed |
| 95 | We may leverage these models independent of user selection for processing other tasks (e.g. for summarization). | — | Removed |
| 96 | We have a zero data retention agreement with Google Vertex Cloud. | — | Removed |
| 97 | Enterprise administrators can disable use of these models for their organization. xAI (Sees code data for inference): We offer the optionality of using xAI's models for various AI requests. | — | Removed |
| 98 | We have a zero data retention agreement with xAI. | — | Removed |
| 99 | Enterprise administrators can disable use of these models for their organization. | — | Removed |
| 100 | Fireworks (Sees code data for inference): We offer the optionality of using DeepSeek models for various AI requests. | — | Removed |
| 101 | We have a zero data retention agreement with Fireworks. | — | Removed |
| 102 | Enterprise administrators can enable use of these models for their organization. | — | Removed |
| 103 | Bing API (Sees text potentially derived from code data): Used for web search functionality. | — | Removed |
| 104 | The search query that is sent to the Bing API to retrieve website data is derived from the user's inputs, past conversation history, and potentially code data. | — | Removed |
| 105 | We do not have a zero data retention agreement with Bing, so this must be explicitly enabled by Team and Enterprise administrators. | — | Removed |
| 106 | PagerDuty (Sees no code data): We use PagerDuty for alerts and on call. | — | Removed |
| 107 | This has no access to customer data of any form. | — | Removed |
| 108 | Slack (Sees no code data): We use Slack for internal communications. | — | Removed |
| 109 | We may discuss logs of data for debugging purposes from users that are not using Zero-data retention mode. | — | Removed |
| 110 | Google Workspace (Sees no code data): We use Google Workspace for collaboration. | — | Removed |
| 111 | We may discuss logs of data for debugging purposes from users that are not using Zero-data retention mode. | — | Removed |
| 112 | Firebase (Sees no code data): We use Firebase for customer authentication (without SSO). | — | Removed |
| 113 | Firebase may contain some personal data (name, email address). | — | Removed |
| 114 | Okta (Sees no code data): We use Okta for internal identity and access management to maintain security of all internal systems. | — | Removed |
| 115 | Okta does not have access to customer data of any form. | — | Removed |
| 116 | Stripe (Sees no code data): We use Stripe to handle billing. | — | Removed |
| 117 | Stripe may contain your personal data (name, credit card, address), but cannot access code data. | — | Removed |
| 118 | Vercel (Sees no code data): We use Vercel to deploy our website. | — | Removed |
| 119 | The website cannot access code data. | — | Removed |
| 120 | Mintlify (Sees no code data): We use Mintlify to deploy our docs site. | — | Removed |
| 121 | The docs site cannot access code data. | — | Removed |
| 122 | Zendesk (Sees no code data unless provided by user): We use Zendesk for customer support. | — | Removed |
| 123 | Zendesk has no direct access to code data or logs, but may store logs provided by users for debugging purposes. | — | Removed |
| 124 | Retool (May see code data if not on zero-data retention): We use Retool for dashboards to view usage analytics and aggregate statistics. | — | Removed |
| 125 | We may expose logs of data for debugging purposes from users that are not using Zero-data retention mode. | — | Removed |
| 126 | Raindrop (May see code data if not on zero-data retention): We use Raindrop for dashboards to view usage analytics and aggregate statistics. | — | Removed |
| 127 | We may expose logs of data for debugging purposes from users that are not using Zero-data retention mode. | — | Removed |
| 128 | Metabase (May see code data if not on zero-data retention): We use Metabase for dashboards to view usage analytics and aggregate statistics. | — | Removed |
| 129 | We may expose logs of data for debugging purposes from users that are not using Zero-data retention mode. | — | Removed |
| 130 | Tableau (May see code data if not on zero-data retention): We use Tableau for dashboards to view usage analytics and aggregate statistics. | — | Removed |
| 131 | We may expose logs of data for debugging purposes from users that are not using Zero-data retention mode. | — | Removed |
| 132 | Salesforce (Sees no code data): We use Salesforce for enterprise customer account management. | — | Removed |
| 133 | Salesforce may contain personal data (ex. name, email), but cannot access code data. | — | Removed |
| 134 | Hubspot (Sees no code data): We use Hubspot for marketing efforts. | — | Removed |
| 135 | Hubspot may contain personal data (ex. name, email) for marketing campaign purposes, but cannot access code data. | — | Removed |
| 136 | Brevo (Sees no code data): We use Brevo for email campaigns. | — | Removed |
| 137 | Brevo cannot access code data. | — | Removed |
| 138 | Attribution and Compliance You own all of the code generated by Windsurf's products, to the extent permitted by law. | — | Removed |
| 139 | We recognize deeply the contribution of public open-source software to the progress of generative AI and the software industry at large. | — | Removed |
| 140 | Within public code, there are various levels of licensing. | — | Removed |
| 141 | While permissively licensed code can be used in other works, including commercially licensed works, non-permissively licensed code is not as forgiving. | — | Removed |
| 142 | To the best of our ability, we have sanitized any of the public data that we use for training by removing any non-permissively licensed code, or code that is similar to the non-permissively licensed code via Jaccardian edit-distance. | — | Removed |
| 143 | We recognize that for some of our models built on top of third-party large language models, we cannot make representations as to all the data that has been used to train the model overall as we are subject to the practices of the model builders. | — | Removed |
| 144 | We also cannot make representations as to code generated by these models because of their intrinsic nondeterminism. | — | Removed |
| 145 | This is why we have also built state-of-the-art attribution filtering that is run on every generation of autocomplete, command, or chat. | — | Removed |
| 146 | Any generated code that is similar to non-permissively licensed code is intercepted and not shown to the user to minimize any chances of non-permissive code being accepted by an unaware user. | — | Removed |
| 147 | We compute similarity via a line-by-line fuzzy matching algorithm of hashes of the lines of generated code against precomputed hashes of the corpus of existing public code, a more robust detection algorithm than naive multi-line exact string matching. | — | Removed |
| 148 | This is done automatically, for any user on any Windsurf plan. | — | Removed |
| 149 | For enterprises, we are able to complement these technical solutions with industry-leading indemnity clauses to provide piece-of-mind from a compliance perspective. | — | Removed |
| 150 | On our Enterprise Hybrid and Self-hosted deployments, we are able to further compliance by providing attribution logging of any of the generated code, even for matches the permissively licensed matches. | — | Removed |
| 151 | Having a log of such snippets can further an enterprise's comfort with generative AI from a compliance standpoint. | — | Removed |
| 152 | This log is stored entirely within the component of Windsurf that is hosted in the customer's private tenant for these deployment methods, an advantage of these non-Cloud deployment methods. | — | Removed |
| 153 | We also provide audit logs for the Enterprise Hybrid and Self-hosted deployments. | — | Removed |
| 154 | Today, this means that every accepted autocomplete suggestion and every chat conversation is logged to a database so that the enterprise can have a trail of AI generations for potential audit purposes. | — | Removed |
| 155 | Again, these logs are stored entirely within the component of Windsurf that is hosted in the customer's private tenant. | — | Removed |
| 156 | With both attribution and audit logs, there is still zero data retention of code snippets or code-derived data within Windsurf's servers or subprocessors. | — | Removed |
| 157 | Client Security The Windsurf plugins are proprietary extensions into various existing IDE platforms, such as the JetBrains Suite. | — | Removed |
| 158 | To see the full list of IDE platforms supported, please visit our download page . | — | Removed |
| 159 | The Windsurf Editor is a fork of the open-source Visual Studio Code (VS Code) , maintained by Microsoft. | — | Removed |
| 160 | We regularly merge the upstream microsoft/vscode codebase into the Windsurf Editor fork to incorporate general updates and upstream security patches. | — | Removed |
| 161 | On top of this, we will immediately cherry-pick any high-severity security-related patch in the upstream Visual Studio Code codebase and release a new version of the Windsurf Editor immediately. | — | Removed |
| 162 | You can check which version of VS Code that your Windsurf Editor version is based on by clicking “Windsurf > About Windsurf” in the app, and refer to Visual Studio Code's GitHub security page to be aware of any corresponding security advisories. | — | Removed |
| 163 | For both the Windsurf plugins and the Windsurf Editor, we make requests to the following domains as part of our Cloud and Hybrid deployments. | — | Removed |
| 164 | This list is not fully exhaustive; we recommend whitelisting all of *.codeium.com and *.windsurf.com in order to ensure that our products work correctly. server.codeium.com : Used for most API requests. web-backend.codeium.com : Used for requests from windsurf.com (this website). unleash.codeium.com : Used for feature flag gating. inference.codeium.com : Used for certain inference requests. codeiumdata.com , *.codeiumdata.com : Used to host language server and Windsurf downloads. | — | Removed |
| 165 | Codebase Indexing Windsurf allows for a personalized experience by offering indexing of private codebases to be used at inference time to retrieve potentially relevant snippets of code from across the codebases, which are then appended to the original request to further ground the LLM's responses. | — | Removed |
| 166 | There are multiple forms of codebase indexing offered by Windsurf. | — | Removed |
| 167 | In general, codebase indexing is done upon an abstract syntax tree (AST) representation of the codebase, which provides superior performance than file-level indexing or naive chunking, especially with large files seen in enterprise work. | — | Removed |
| 168 | This is because each indexed “entity” is a semantic block of code (ex. function, method, class, etc) as opposed to an entire file which may contain multiple semantic blocks or an arbitrary chunk of code that could contain many parts (or just a subset) or a single semantic block. | — | Removed |
| 169 | This does not change much from a codebase security perspective, but it is important context for how we've architected the system. | — | Removed |
| 170 | The first method is local indexing, where the repository in the editor workspace is preprocessed (up to a fixed, configurable number of files to prevent memory issues). | — | Removed |
| 171 | For this preprocessing, Windsurf's client on the user's machine generates the AST representation of the codebase, chunks the code according to the AST representation, passes these chunks independently to our server to compute the embedding, and then receives and stores the computed embedding with a pointer (file path, line range) to the code snippet within a custom vector store index on the user's machine. | — | Removed |
| 172 | Files and subdirectories specified by .gitignore or .codeiumignore are ignored by the embedding service. | — | Removed |
| 173 | As code changes are made, a background process at regular intervals makes the corresponding changes to the AST and the corresponding embeddings are recomputed and updated so that an accurate representation of the codebase is reflected. | — | Removed |
| 174 | The second is remote indexing. | — | Removed |
| 175 | The benefits of remote indexing are (a) to store an index for a larger codebase, which might be too large for the user's client machine and (b) provide the user context from repositories other than the one currently active in their IDE. | — | Removed |
| 176 | For remote indexing, a read-access token to the repository is provided to Windsurf's embedding service (hosted by Windsurf for Cloud and part of the customer's private deployment for Hybrid and self-hosted), but otherwise the preprocessing is generally equivalent as with a local index, except there is no limit to the number of files as the index is stored on the server side as opposed to client side. | — | Removed |
| 177 | The other difference is that the original code entity is stored with the corresponding embedding vector since the raw code may not be available on the user's machine. | — | Removed |
| 178 | For Cloud deployments, as this does require retention of code snippets and code-derived information, it is required for code-snippet telemetry to be turned on or explicit admin enablement of this capability. | — | Removed |
| 179 | When we do store this information, it is securely encrypted at rest. | — | Removed |
| 180 | The remote index can be updated at a frequency specified by the administrator on the indexing control page. | — | Removed |
| 181 | For Hybrid and Self-hosted deployments, this is not an issue as these indexes are stored in the component of the deployment that lives in the customer's private tenant (the “data plane”). | — | Removed |
| 182 | This is a major advantage for the Hybrid deployment over hosted solutions, both Windsurf's Cloud deployment and pretty much every other major AI code assistant, as it provides maximal personalization and value (as well as future proofs for any other personalization features that require data retention) while not having any code snippets or code-derived information being retained on Windsurf servers or subprocessors. | — | Removed |
| 183 | At inference, we compute an embedding, and then use nearest neighbor search across both the local index and remote index to capture both any local changes to the codebase and any relevant code in other repositories, respectively. | — | Removed |
| 184 | Zero Data Retention Zero-data retention mode is a mode that guarantees that code or code-derived data is never serialized and stored in plaintext at our servers or by our subprocessors. | — | Removed |
| 185 | Zero-data retention mode is the default for any user on a team or enterprise plan and can be enabled by any individual from their profile page. | — | Removed |
| 186 | This automated zero-data retention guarantee is what allows us to be trusted by the largest Fortune 500 organizations with enterprise-wide rollouts, even in highly regulated environments, so we naturally treat it as a critical promise to our users. | — | Removed |
| 187 | With zero-data retention mode enabled, code data is not persisted at our servers or by any of our subprocessors. | — | Removed |
| 188 | The code data is still visible to our servers in memory for the lifetime of the request, and may exist for a slightly longer period (on the order of minutes to hours) for prompt caching. | — | Removed |
| 189 | The code data submitted by zero-data retention mode users will never be trained on. | — | Removed |
| 190 | Again, zero-data retention mode is on by default for teams and enterprise customers. | — | Removed |
| 191 | That said, for cloud implementations only (not hybrid or self-hosted), we may store profile data for authentication and to operate the service for you, and we may store inputs if flagged as potentially violating our Acceptable Use Policy . | — | Removed |
| 192 | Account Deletion You can delete your account at any point from your profile . | — | Removed |
| 193 | Vulnerability Disclosures If you believe you have found a vulnerability in Windsurf, please email us at security@windsurf.com . | — | Removed |
| 194 | We commit to acknowledging legitimate vulnerability reports within 5 business days, and addressing them as soon as we are able to. | — | Removed |
| 195 | Critical incidents will be communicated via email to all users. | — | Removed |
Follow unlimited companies, monitor the clauses that matter across every platform, and get the full institutional analysis on what each change obligates you to do.