This analysis describes what Windsurf's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The clause establishes that log data and code content are accessible to internal teams and third-party analytics vendors for operational debugging and analytical purposes as a standard data handling practice, with the exception contingent on user election of a specific retention setting.
The updated document establishes explicit commitments about how Windsurf protects data and manages security. The terms state that all data transmission is encrypted in transit and at rest, that access to production systems is restricted to a small number of employees or contractors based on business roles, and that production systems are monitored via logging, error handling, and monitoring dashboards. The document discloses that Windsurf obtained SOC 2 Type II certification as of March 2024 and that all employees and contractors are required to use multi-factor authentication and receive annual security training. These disclosures describe organizational practices rather than establishing new user-facing rights or obligations.
View change record →Users whose accounts do not have zero-data retention mode enabled authorize Windsurf to retain and expose their logs and code data to internal dashboarding tools and team members for analytics and debugging purposes. Users who elect zero-data retention mode are excepted from this authorization.
Cross-platform context
See how other platforms handle Internal Analytics Access to Retained User Logs and similar clauses.
Compare across platforms →Monitoring
Windsurf has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Retool (May see code data if not on zero-data retention): We use Retool for dashboards to view usage analytics and aggregate statistics. We may expose logs of data for debugging purposes from users that are not using Zero-data retention mode. Metabase (May see code data if not on zero-data retention): We use Metabase for dashboards to view usage analytics and aggregate statistics. We may expose logs of data for debugging purposes from users that are not using Zero-data retention mode. Tableau (May see code data if not on zero-data retention): We use Tableau for dashboards to view usage analytics and aggregate statistics. We may expose logs of data for debugging purposes from users that are not using Zero-data retention mode. Slack (Sees no code data): We use Slack for internal communications. We may discuss logs of data for debugging purposes from users that are not using Zero-data retention mode.— Excerpt from Windsurf's Windsurf Security & Data Handling
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The clause establishes that log data and code content are accessible to internal teams and third-party analytics vendors for operational debugging and analytical purposes as a standard data handling practice, with the exception contingent on user election of a specific retention setting.
Users whose accounts do not have zero-data retention mode enabled authorize Windsurf to retain and expose their logs and code data to internal dashboarding tools and team members for analytics and debugging purposes. Users who elect zero-data retention mode are excepted from this authorization.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Windsurf.