Windsurf Security & Data Handling

This document is Windsurf's security and privacy disclosure page (last updated March 11, 2025), governing data flows, subprocessor relationships, deployment architectures, and compliance posture for an AI-powered code assistant platform serving individual developers and enterprise customers. The document states that for individual cloud plans without zero-data retention mode enabled, logs that may contain code snippets and user trajectories could be stored, while teams and enterprise plans apply zero-data retention by default; the policy discloses that OpenAI, Anthropic, Google Cloud Vertex, xAI, and Fireworks each receive code data for inference with zero-data retention agreements in place, while Bing API receives text potentially derived from code data without a zero-data retention agreement. The document identifies a notable operational distinction for individual users: zero-data retention is opt-in rather than default, meaning code snippets and usage trajectories may be retained and accessible to internal analytics tools including Retool, Raindrop, Metabase, and Tableau unless the user actively enables the mode; the document also discloses that OpenAI and Anthropic models may be leveraged independent of user model selection for background tasks such as summarization. The document references SOC 2 Type II certification, FedRAMP High accreditation, and HIPAA compliance posture with optional Business Associate Agreements, engaging frameworks relevant to federal procurement, healthcare data handling, and enterprise data residency requirements. Compliance teams should note that the Bing API integration for web search lacks a zero-data retention agreement and requires explicit Team or Enterprise administrator enablement, and that individual user data protections are materially weaker than enterprise defaults absent active opt-in to zero-data retention mode.