Windsurf may send your data to AI model providers such as OpenAI, Anthropic, or Google Vertex even if you have not selected those providers, for internal tasks like summarizing your conversation.
This analysis describes what Windsurf's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The document states that data may be routed to third-party AI inference providers regardless of which model the user has explicitly chosen, which means users may not have full visibility into which providers receive their code or conversation data.
Interpretive note: The scope of 'other tasks' beyond the cited summarization example is not exhaustively defined in the document, creating ambiguity about the full range of circumstances under which independent provider routing may occur.
The updated document establishes explicit commitments about how Windsurf protects data and manages security. The terms state that all data transmission is encrypted in transit and at rest, that access to production systems is restricted to a small number of employees or contractors based on business roles, and that production systems are monitored via logging, error handling, and monitoring dashboards. The document discloses that Windsurf obtained SOC 2 Type II certification as of March 2024 and that all employees and contractors are required to use multi-factor authentication and receive annual security training. These disclosures describe organizational practices rather than establishing new user-facing rights or obligations.
View change record →This provision authorizes Windsurf to route code and conversation data to AI model providers including OpenAI, Anthropic, and Google Vertex for tasks such as summarization, independent of the user's own model selection. Users who have preferences about which providers receive their data should be aware that model selection controls may not fully restrict provider access.
How other platforms handle this
We use information to enhance the quality, reliability, and/or accuracy of our AI Features by creating, developing, training, testing, improving, and maintaining AI and ML models run by Strava or our service providers. We use aggregated, de-identified data for this purpose. We also use personal info...
Depending on where you are located, you may have certain rights regarding your personal information, including the right to access, correct, delete, or restrict processing of your personal information, the right to data portability, and the right to object to or withdraw consent for certain processi...
Depending on your location, you may have certain rights regarding your personal data, including the right to access, correct, delete, or port your data. EU and UK users may also have the right to object to or restrict certain processing. California residents may have the right to know, delete, corre...
Monitoring
Windsurf has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We may leverage OpenAI models independent of user selection for processing other tasks (e.g. for summarization). We may leverage Anthropic models independent of user selection for processing other tasks (e.g. for summarization). We may leverage these models independent of user selection for processing other tasks (e.g. for summarization).— Excerpt from Windsurf's Windsurf Security & Data Handling
(1) REGULATORY LANDSCAPE: This provision implicates GDPR transparency and data subject information requirements, specifically the obligation to identify third-party recipients of personal data. It also engages CCPA disclosure requirements regarding the categories of third parties with whom personal information is shared. Relevant enforcement authorities include EU supervisory authorities and the California Privacy Protection Agency. Where data processed by these providers includes personal data, the legal basis for that processing and the adequacy of transfer mechanisms (for non-EU providers) may require evaluation. (2) GOVERNANCE EXPOSURE: Medium. The provision authorizes data routing to multiple AI inference providers for purposes beyond the user's explicit model selection. While the document notes zero-data retention agreements with OpenAI, Anthropic, Google Vertex, xAI, and Fireworks, the scope of what constitutes 'other tasks' beyond summarization is not exhaustively defined, creating potential ambiguity in data flow documentation. (3) JURISDICTION FLAGS: EU/EEA users face heightened exposure where data is routed to US-based providers without explicit user direction, as this may implicate GDPR Chapter V international transfer requirements. Enterprise customers using the EU cluster should confirm that the Anthropic models served from AWS Bedrock in Zurich are covered under appropriate transfer mechanisms. California residents may have rights to know about all third-party recipients of their personal information. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise data processing agreements should account for the possibility of data routing to providers beyond those explicitly selected by users or administrators. Procurement teams should verify that zero-data retention agreements with all applicable providers are current and that the scope of 'independent' model use is addressed in contractual terms. Administrator controls to disable specific providers should be documented and verified during vendor assessment. (5) COMPLIANCE CONSIDERATIONS: Legal teams should assess whether the current disclosure of independent model use constitutes adequate transparency under GDPR and CCPA. Data flow maps should be updated to reflect all potential provider pathways, including those triggered by internal tasks. Where administrator controls exist to disable specific providers, these controls should be tested and documented as part of the compliance record.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The document states that data may be routed to third-party AI inference providers regardless of which model the user has explicitly chosen, which means users may not have full visibility into which providers receive their code or conversation data.
This provision authorizes Windsurf to route code and conversation data to AI model providers including OpenAI, Anthropic, and Google Vertex for tasks such as summarization, independent of the user's own model selection. Users who have preferences about which providers receive their data should be aware that model selection controls may not fully restrict provider access.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Windsurf.