Windsurf Security & Data Handling

This document explains how Windsurf collects, uses, and keeps your data when you use the Devin product. By default, your data may be used to train Windsurf's models, but if you are on a paid plan you can turn this off at any time in Data Controls. Code and other output that Devin produces belongs to you and can be used for commercial purposes, though you cannot use it to build a competing product or reverse-engineer Devin.

This document establishes Windsurf's data handling, retention, and usage obligations with respect to its Devin product and associated services. By default, Windsurf may use customer data for model training to improve its services, though paid plan users may opt out at any time via Data Controls, which also triggers Zero Data Retention with Windsurf's model providers; Enterprise customers are fully protected by an absolute prohibition on model training absent express prior written consent. Windsurf retains Feedback Data and User Interaction Data for as long as it unilaterally determines necessary, while data processed through Devin is retained only for the duration of the customer relationship unless the customer specifies otherwise. Output produced by Devin is treated as the customer's intellectual property available for commercial use, subject to a carve-out prohibiting its use to reverse-engineer Devin or build a competing product. Windsurf applies a least-privilege access model to its AWS production environment and limits Devin's Slack data access to information explicitly shared within tagged interactions.

As an ordinary user, your data is used by default for model training to improve Windsurf's services. If you are on a paid plan, you can opt out of this at any time by going to the Data Controls settings page, which will stop your data from being used for training and enable Zero Data Retention with Windsurf's model providers. Windsurf retains Feedback Data and User Interaction Data for as long as it determines necessary, with no fixed maximum period. Devin's output belongs to you for commercial use, but you may not use it to reverse-engineer Devin or create a competing product.