When web search is enabled, Windsurf sends queries to Bing that may include content derived from your code or conversation. Unlike other AI providers, Windsurf has no data retention agreement with Bing, so Bing may retain this data.
This analysis describes what Windsurf's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The document explicitly states that no zero-data retention agreement exists with Bing, meaning data derived from user code and conversation history sent via web search queries may be retained by Microsoft's Bing service, with no contractual guarantee of deletion.
This provision discloses that web search queries sent to Bing, which may include content derived from code and conversation history, are not covered by a zero-data retention agreement, distinguishing Bing from other listed inference providers. Enterprise administrators must explicitly enable this feature, but once enabled, Bing's data practices are governed by Microsoft's own terms rather than Windsurf's retention commitments.
How other platforms handle this
We retain personal data for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements, to resolve disputes, and to enforce our agreements. The criteria used to determine our retention periods include: the length of ...
We may retain de-identified or aggregated information that can no longer be used to identify you for any period of time, including indefinitely.
We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements, or as otherwise permitted or required by applicable law.
Monitoring
Windsurf has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"Bing API (Sees text potentially derived from code data): Used for web search functionality. The search query that is sent to the Bing API to retrieve website data is derived from the user's inputs, past conversation history, and potentially code data. We do not have a zero data retention agreement with Bing, so this must be explicitly enabled by Team and Enterprise administrators.— Excerpt from Windsurf's Windsurf Security & Data Handling
(1) REGULATORY LANDSCAPE: This provision implicates GDPR data processor obligations, specifically the requirement that subprocessors provide sufficient guarantees regarding data protection. The absence of a zero-data retention agreement with Bing may require evaluation under GDPR Article 28 regarding processor contracts. It also engages CCPA provisions regarding disclosure of third-party data recipients. Relevant enforcement authorities are EU supervisory authorities and the California Privacy Protection Agency. (2) GOVERNANCE EXPOSURE: Medium. The document explicitly calls out the absence of a zero-data retention agreement with Bing, distinguishing it from other providers. This creates a discrete compliance consideration for any team or enterprise that enables web search functionality, as code-derived data sent to Bing may be retained under Microsoft's own terms and policies. (3) JURISDICTION FLAGS: EU/EEA organizations enabling web search should evaluate whether Bing's data handling satisfies GDPR subprocessor requirements, particularly regarding international data transfers and retention periods. Organizations in regulated industries such as healthcare or finance should assess whether code-derived data sent to Bing could implicate sector-specific data protection obligations. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams should confirm that enabling web search for team or enterprise plans triggers a review of Microsoft's Bing API data terms and whether those terms are compatible with the organization's data processing agreements and regulatory obligations. The absence of a zero-data retention agreement should be flagged as a vendor assessment trigger. Administrator decisions to enable this feature should be documented. (5) COMPLIANCE CONSIDERATIONS: Organizations should implement internal governance controls requiring documented review before enabling Bing web search functionality. Data processing agreements should be amended to reflect the distinct treatment of Bing as a subprocessor without zero-data retention guarantees. Legal teams should assess whether Microsoft's Bing API terms provide sufficient contractual protections to satisfy applicable regulatory requirements.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The document explicitly states that no zero-data retention agreement exists with Bing, meaning data derived from user code and conversation history sent via web search queries may be retained by Microsoft's Bing service, with no contractual guarantee of deletion.
This provision discloses that web search queries sent to Bing, which may include content derived from code and conversation history, are not covered by a zero-data retention agreement, distinguishing Bing from other listed inference providers. Enterprise administrators must explicitly enable this feature, but once enabled, Bing's data practices are governed by Microsoft's own terms rather than Windsurf's retention commitments.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Windsurf.