If you use Windsurf with your work email address, your employer's account administrators can access everything you have typed into the AI assistant, including all your code prompts and AI-generated responses.
Consumer impact (what this means for users)
Using Windsurf with a work email means your employer's administrators can access all your AI prompts and generated outputs, including any sensitive, personal, or confidential information you may have typed into the tool.
What you can do
⚠️ These actions may provide transparency or partial mitigation but may not fully address the underlying issue. Effectiveness varies by jurisdiction and individual circumstances.
Close Your Account
If you wish to separate your account from your employer's enterprise account or close your account entirely, contact privacy@windsurf.com. Use a personal email address and request account separation or deletion, specifying your concern about employer access.
Cross-platform context
See how other platforms handle Employer/Enterprise Administrator Access to Prompts and Outputs and similar clauses.
Enterprise users have no expectation of private conversations with the AI tool — their employer can read all their prompts and outputs, which could include sensitive personal communications, whistleblower concerns, or confidential ideas.
View original clause language
Your employer or related organization - If you create an account using an email address belonging or relating to your employer or another organization, we may share the fact that you have an account and certain Registration Information (such as your email address) with your employer or organization to, for example, enable you to be added to their business or enterprise account. In addition, administrators of any enterprise or business account may be able to access certain information associated with your account, including your Prompts and Output Information, and be able to control your account and such information.
(1) REGULATORY FRAMEWORK: This provision implicates GDPR Article 88 (processing in employment context), national employment privacy laws in EU member states (e.g., German Betriebsverfassungsgesetz works council consultation requirements, French Labour Code L.2323-47), and Article 13 transparency obligations to employee-users. In the US, the Electronic Communications Privacy Act (ECPA, 18 U.S.C. §2510) and state wiretapping laws may apply depending on monitoring disclosures. California Labor Code §980 and Illinois workplace monitoring laws are also relevant. The FTC Act Section 5 applies if employees are not adequately informed.
(2)
🔒
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Applicable agencies
FTC
The FTC has jurisdiction over unfair or deceptive practices if employees are not adequately informed that their employer can access their AI prompts through Windsurf enterprise accounts.
State attorneys general in California, Illinois, and New York have jurisdiction over workplace privacy and employee monitoring disclosure requirements under state law.