The document provides a comprehensive list of subprocessors, identifying for each whether they see code data and under what conditions. Multiple infrastructure and analytics providers including GCP, Crusoe, Modal, Oracle Cloud, and dashboard tools including Retool, Raindrop, Metabase, and Tableau may access code data for individual users not on zero-data retention mode.
This analysis describes what Windsurf's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses the full subprocessor chain and the conditions under which each provider may access code-derived data, enabling enterprise compliance teams to conduct third-party risk assessments and verify alignment with their vendor approval requirements. The disclosure that multiple analytics dashboard tools may expose code logs for users not on zero-data retention mode is operationally significant for individual user data governance.
The updated terms establish a default policy permitting Windsurf to use customer data for model training purposes to improve services. Previously, the company required explicit opt-in before any training use. Under the revised policy, data training occurs automatically for free and paid users unless they affirmatively opt out through the Data Controls settings page. Once disabled, the terms state your data will not be used for training and Zero Data Retention will be enabled with model providers. Enterprise customers operate under a different standard, requiring express prior written consent before any training use occurs.
View change record →The updated document establishes explicit commitments about how Windsurf protects data and manages security. The terms state that all data transmission is encrypted in transit and at rest, that access to production systems is restricted to a small number of employees or contractors based on business roles, and that production systems are monitored via logging, error handling, and monitoring dashboards. The document discloses that Windsurf obtained SOC 2 Type II certification as of March 2024 and that all employees and contractors are required to use multi-factor authentication and receive annual security training. These disclosures describe organizational practices rather than establishing new user-facing rights or obligations.
View change record →Under these terms, individual plan users not in zero-data retention mode may have code snippet logs accessible to multiple internal analytics and dashboard subprocessors including Retool, Raindrop, Metabase, and Tableau for debugging and analytics purposes. Enterprise and Teams plan users operating under zero-data retention defaults are not subject to this subprocessor code data exposure under normal operation.
How other platforms handle this
we may share data between our affiliates for the safety and security of our users and may take necessary actions if we believe you have violated these Terms, including banning you from our Services and/or our affiliates' services...
Protect us, our business, our users, and others, for example to enforce our terms of service, prevent spam or other unwanted communications, and investigate or protect against fraud
disclosure is required by a third-party to complete a transaction initiated by the user
"Depending on your choice of plan (and thus deployment), we may use some or all of the following subcontractors. Google Cloud Platform (GCP) (Stores code data only if Cloud and relevant features are opted-in, sees code data): Usage analytics and logs are primarily hosted on GCP. Crusoe (Sees code data for inference): We manage Crusoe's compute for training some of our custom models, as well as hosting some of our custom models. Modal (Sees code data for inference): We manage Modal's compute for training some of our custom models, as well as hosting some of our custom models.Excerpt from Windsurf's Security & Data Handling
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision discloses the full subprocessor chain and the conditions under which each provider may access code-derived data, enabling enterprise compliance teams to conduct third-party risk assessments and verify alignment with their vendor approval requirements. The disclosure that multiple analytics dashboard tools may expose code logs for users not on zero-data retention mode is operationally significant for individual user data …
Under these terms, individual plan users not in zero-data retention mode may have code snippet logs accessible to multiple internal analytics and dashboard subprocessors including Retool, Raindrop, Metabase, and Tableau for debugging and analytics purposes. Enterprise and Teams plan users operating under zero-data retention defaults are not subject to this subprocessor code data exposure under normal operation.
ConductAtlas has identified this type of provision across 288 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Windsurf.