Windsurf Security & Data Handling

This document is Windsurf's security and privacy disclosure page (last updated March 11, 2025), governing how the company handles customer data, infrastructure, subprocessors, and compliance posture across its AI-assisted software development platform. The document states that teams and enterprise plans default to zero-data retention with subprocessors, that individual plan users must opt in to zero-data retention from their profile page, and that without opt-in, logs containing code snippets and user trajectories may be stored and discussed internally via tools such as Slack, Google Workspace, Retool, Metabase, and Tableau. The document discloses an extensive list of subprocessors, including OpenAI, Anthropic, Google Vertex, xAI, Fireworks, Crusoe, Modal, Oracle Cloud, AWS, and Bing API, noting that Bing does not carry a zero-data retention agreement and requires explicit administrator enablement; the document also states that Windsurf may leverage AI models independent of user selection for tasks such as summarization, which may create exposure for users who have not explicitly authorized a specific provider. The document engages GDPR through its EU deployment option in Frankfurt and its data residency disclosures, CCPA through its California-applicable data handling practices, HIPAA through its maintained compliance posture and Business Associate Agreement availability, and FedRAMP High through its Palantir FedStart accreditation; SOC 2 Type II certification and annual third-party penetration testing are also disclosed. Compliance teams should evaluate whether individual user consent mechanisms for zero-data retention opt-in satisfy applicable regulatory standards, and whether the use of AI models independent of user selection is adequately disclosed under applicable privacy law.