If you use Windsurf through a workplace or enterprise account, your employer's account administrators may be able to read the prompts you entered and the AI outputs you received, and may be able to control your account.
This analysis describes what Windsurf's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision states that employer-side administrators have potential access to individual users' Prompts and Outputs, which may include sensitive code, business logic, or personal queries entered during work sessions.
The policy states that enterprise account administrators may access individual users' Prompts and Output Information and control their accounts; employees using Windsurf through an employer-provisioned account should be aware that their activity and entered content may be visible to their employer.
How other platforms handle this
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
When you are asked to provide information, you may decline to do so; but if you choose not to provide information that is necessary to provide some of our Services, you may not be able to use those Services.
You may contact our privacy team with any requests of disclosure, correction, or deletion of your personal information. You may also request suspension of use or suspension of sharing of your personal information with certain third parties.
"administrators of any enterprise or business account may be able to access certain information associated with your account, including your Prompts and Output Information, and be able to control your account and such information.Excerpt from Windsurf's Privacy Policy
REGULATORY LANDSCAPE: This provision engages GDPR Articles 13 and 88 (employee data), which require that employees be informed about employer monitoring of their data; EU member states may have additional national laws governing workplace monitoring.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision states that employer-side administrators have potential access to individual users' Prompts and Outputs, which may include sensitive code, business logic, or personal queries entered during work sessions.
The policy states that enterprise account administrators may access individual users' Prompts and Output Information and control their accounts; employees using Windsurf through an employer-provisioned account should be aware that their activity and entered content may be visible to their employer.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Windsurf.