When web search is enabled, Windsurf sends queries to Bing that may include content derived from your code or conversation. Unlike other AI providers, Windsurf has no data retention agreement with Bing, so Bing may retain this data.
This analysis describes what Windsurf's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The document explicitly states that no zero-data retention agreement exists with Bing, meaning data derived from user code and conversation history sent via web search queries may be retained by Microsoft's Bing service, with no contractual guarantee of deletion.
The updated document establishes explicit commitments about how Windsurf protects data and manages security. The terms state that all data transmission is encrypted in transit and at rest, that access to production systems is restricted to a small number of employees or contractors based on business roles, and that production systems are monitored via logging, error handling, and monitoring dashboards. The document discloses that Windsurf obtained SOC 2 Type II certification as of March 2024 and that all employees and contractors are required to use multi-factor authentication and receive annual security training. These disclosures describe organizational practices rather than establishing new user-facing rights or obligations.
View change record →This provision discloses that web search queries sent to Bing, which may include content derived from code and conversation history, are not covered by a zero-data retention agreement, distinguishing Bing from other listed inference providers. Enterprise administrators must explicitly enable this feature, but once enabled, Bing's data practices are governed by Microsoft's own terms rather than Windsurf's retention commitments.
How other platforms handle this
We retain personal information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. The specific retention periods depend on the type of information and the purposes for which it is processed.
We keep information for as long as we need it to provide our products, comply with legal obligations, or for other legitimate purposes, such as to maintain safety, security, and integrity.
After your account is deleted, we keep data about interactions you've had on our service to prevent abuse, ban evaders and others in an effort to protect and ensure the safety and security of our service and our members.
Monitoring
Windsurf has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Bing API (Sees text potentially derived from code data): Used for web search functionality. The search query that is sent to the Bing API to retrieve website data is derived from the user's inputs, past conversation history, and potentially code data. We do not have a zero data retention agreement with Bing, so this must be explicitly enabled by Team and Enterprise administrators.— Excerpt from Windsurf's Windsurf Security & Data Handling
(1) REGULATORY LANDSCAPE: This provision implicates GDPR data processor obligations, specifically the requirement that subprocessors provide sufficient guarantees regarding data protection. The absence of a zero-data retention agreement with Bing may require evaluation under GDPR Article 28 regarding processor contracts. It also engages CCPA provisions regarding disclosure of third-party data recipients. Relevant enforcement authorities are EU supervisory authorities and the California Privacy Protection Agency. (2) GOVERNANCE EXPOSURE: Medium. The document explicitly calls out the absence of a zero-data retention agreement with Bing, distinguishing it from other providers. This creates a discrete compliance consideration for any team or enterprise that enables web search functionality, as code-derived data sent to Bing may be retained under Microsoft's own terms and policies. (3) JURISDICTION FLAGS: EU/EEA organizations enabling web search should evaluate whether Bing's data handling satisfies GDPR subprocessor requirements, particularly regarding international data transfers and retention periods. Organizations in regulated industries such as healthcare or finance should assess whether code-derived data sent to Bing could implicate sector-specific data protection obligations. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams should confirm that enabling web search for team or enterprise plans triggers a review of Microsoft's Bing API data terms and whether those terms are compatible with the organization's data processing agreements and regulatory obligations. The absence of a zero-data retention agreement should be flagged as a vendor assessment trigger. Administrator decisions to enable this feature should be documented. (5) COMPLIANCE CONSIDERATIONS: Organizations should implement internal governance controls requiring documented review before enabling Bing web search functionality. Data processing agreements should be amended to reflect the distinct treatment of Bing as a subprocessor without zero-data retention guarantees. Legal teams should assess whether Microsoft's Bing API terms provide sufficient contractual protections to satisfy applicable regulatory requirements.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The document explicitly states that no zero-data retention agreement exists with Bing, meaning data derived from user code and conversation history sent via web search queries may be retained by Microsoft's Bing service, with no contractual guarantee of deletion.
This provision discloses that web search queries sent to Bing, which may include content derived from code and conversation history, are not covered by a zero-data retention agreement, distinguishing Bing from other listed inference providers. Enterprise administrators must explicitly enable this feature, but once enabled, Bing's data practices are governed by Microsoft's own terms rather than Windsurf's retention commitments.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Windsurf.