Windsurf may send your data to AI model providers such as OpenAI, Anthropic, or Google Vertex even if you have not selected those providers, for internal tasks like summarizing your conversation.
This analysis describes what Windsurf's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The document states that data may be routed to third-party AI inference providers regardless of which model the user has explicitly chosen, which means users may not have full visibility into which providers receive their code or conversation data.
Interpretive note: The scope of 'other tasks' beyond the cited summarization example is not exhaustively defined in the document, creating ambiguity about the full range of circumstances under which independent provider routing may occur.
This provision authorizes Windsurf to route code and conversation data to AI model providers including OpenAI, Anthropic, and Google Vertex for tasks such as summarization, independent of the user's own model selection. Users who have preferences about which providers receive their data should be aware that model selection controls may not fully restrict provider access.
How other platforms handle this
We may use the content you provide to us, including prompts and generated images, to train and improve our AI models and services.
When you use AI features of the Services, you acknowledge that your inputs may be processed by third-party AI providers. ClickUp may use anonymized and aggregated data derived from your use of the Services to improve and train AI models and features.
Users under 18 years old interact with an age-appropriate model specifically designed to reduce the likelihood of exposure to sensitive or suggestive content. Our under-18 model has additional and more conservative classifiers than the model for our adult users so we can enforce our content policies...
Monitoring
Windsurf has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"We may leverage OpenAI models independent of user selection for processing other tasks (e.g. for summarization). We may leverage Anthropic models independent of user selection for processing other tasks (e.g. for summarization). We may leverage these models independent of user selection for processing other tasks (e.g. for summarization).— Excerpt from Windsurf's Windsurf Security & Data Handling
(1) REGULATORY LANDSCAPE: This provision implicates GDPR transparency and data subject information requirements, specifically the obligation to identify third-party recipients of personal data. It also engages CCPA disclosure requirements regarding the categories of third parties with whom personal information is shared. Relevant enforcement authorities include EU supervisory authorities and the California Privacy Protection Agency. Where data processed by these providers includes personal data, the legal basis for that processing and the adequacy of transfer mechanisms (for non-EU providers) may require evaluation. (2) GOVERNANCE EXPOSURE: Medium. The provision authorizes data routing to multiple AI inference providers for purposes beyond the user's explicit model selection. While the document notes zero-data retention agreements with OpenAI, Anthropic, Google Vertex, xAI, and Fireworks, the scope of what constitutes 'other tasks' beyond summarization is not exhaustively defined, creating potential ambiguity in data flow documentation. (3) JURISDICTION FLAGS: EU/EEA users face heightened exposure where data is routed to US-based providers without explicit user direction, as this may implicate GDPR Chapter V international transfer requirements. Enterprise customers using the EU cluster should confirm that the Anthropic models served from AWS Bedrock in Zurich are covered under appropriate transfer mechanisms. California residents may have rights to know about all third-party recipients of their personal information. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise data processing agreements should account for the possibility of data routing to providers beyond those explicitly selected by users or administrators. Procurement teams should verify that zero-data retention agreements with all applicable providers are current and that the scope of 'independent' model use is addressed in contractual terms. Administrator controls to disable specific providers should be documented and verified during vendor assessment. (5) COMPLIANCE CONSIDERATIONS: Legal teams should assess whether the current disclosure of independent model use constitutes adequate transparency under GDPR and CCPA. Data flow maps should be updated to reflect all potential provider pathways, including those triggered by internal tasks. Where administrator controls exist to disable specific providers, these controls should be tested and documented as part of the compliance record.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
How 10 AI platforms describe the use of user data for model training, improvement, and development, based on archived governance provisions.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The document states that data may be routed to third-party AI inference providers regardless of which model the user has explicitly chosen, which means users may not have full visibility into which providers receive their code or conversation data.
This provision authorizes Windsurf to route code and conversation data to AI model providers including OpenAI, Anthropic, and Google Vertex for tasks such as summarization, independent of the user's own model selection. Users who have preferences about which providers receive their data should be aware that model selection controls may not fully restrict provider access.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Windsurf.