Bing API Subprocessor Without Zero-Data Retention Agreement

What it is

The Bing API receives query data derived from user inputs, conversation history, and potentially code data as part of web search functionality. Unlike other inference providers, Windsurf does not have a zero-data retention agreement with Bing, and this integration must be explicitly enabled by Team or Enterprise administrators.

Why it matters (compliance & governance perspective)

This provision identifies a specific subprocessor relationship where code-derived data is transmitted to a third party without the zero-data retention agreement that applies to other inference providers. Enterprise compliance teams should assess the Bing API data flow against their data classification policies and third-party risk frameworks before enabling this feature.

Consumer impact (what this means for users)

Under this clause, enabling the Bing API web search feature results in transmission of code-derived query data to Microsoft's Bing API without a zero-data retention guarantee, distinguishing this integration from other inference providers disclosed in the policy. The integration is disabled by default and requires explicit administrator enablement on Teams and Enterprise plans.

Institutional analysis (Compliance & governance intelligence)

1. REGULATORY LANDSCAPE: This provision engages GDPR data transfer and third-party processor obligations, particularly where EU-resident users' code-derived data is transmitted to Bing API infrastructure that may not offer equivalent data protection guarantees. The relevant enforcement authorities are national data protection supervisory authorities under GDPR. CCPA obligations regarding disclosure of data sharing with third parties are also relevant for California-based users. The absence of a zero-data retention agreement may require evaluation under GDPR Article 28 processor requirements. 2. GOVERNANCE EXPOSURE: Medium. The explicit disclosure that no zero-data retention agreement exists with Bing distinguishes this subprocessor from others in the list. Organizations processing sensitive or proprietary code should assess whether enabling this feature is consistent with their data classification and third-party risk policies before administrator enablement. 3. JURISDICTION FLAGS: EU/EEA users face heightened exposure given GDPR requirements for adequate data processing agreements with subprocessors. Organizations subject to sector-specific data handling requirements (financial services, healthcare, defense) should evaluate whether enabling Bing API web search is permissible under their applicable frameworks. 4. CONTRACT AND VENDOR IMPLICATIONS: The document does not specify whether Bing API processes data under Microsoft's standard API terms or a negotiated agreement, which may be relevant to procurement teams conducting vendor assessments. The absence of a zero-data retention agreement should be flagged in third-party risk registers for organizations that enable this feature. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should ensure that administrator enablement of the Bing API web search feature is documented and approved through the organization's third-party risk review process. For EU deployments, a data transfer impact assessment may be warranted given the absence of a zero-data retention agreement. Organizations should maintain a record of which features have been enabled and the corresponding subprocessor data flows.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Individual User Zero-Data Retention Opt-In medium
• Model Use Independent of User Selection medium
• Code Ownership and Attribution Filtering medium
• Subprocessor Code Data Access Disclosure medium
• Real-Time and Ahead-of-Time Personalization Data Collection low
• Account Deletion and Zero-Data Retention medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.