Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement requires customers to indemnify Cognition against third-party claims arising from Customer Data intellectual property infringement, Authorized User negligence or misconduct, unauthorized use of the Services, use of the Services in combination with unapproved third-party products, or unauthorized modifications to the Services.
This analysis describes what Windsurf's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a broad customer-side indemnification obligation that extends to all Authorized User conduct, including negligence and willful misconduct, and to any use of the Services in combination with non-Cognition-supplied tools or data. The scope of Authorized User conduct covered means the customer assumes indemnification liability for actions taken by any employee, consultant, or agent with platform access.
The updated terms indicate that Windsurf is now operating as the Cognition Platform under Cognition AI, Inc., replacing the prior Exafunction, Inc. structure. The revised terms state that prior terms continue to govern use for 30 days from the posting date (July 1, 2026), and that continued access after that period constitutes acceptance of the updated terms. Users who do not agree with the new terms are instructed to stop using or accessing the Services. The specific substantive changes to user rights, data collection, fees, or service functionality are not detailed in the provided change summary.
View change record →Requires user to defend and indemnify Cognition against broad categories of third-party claims including IP infringement and user negligence, shifting significant legal and financial risk to the user.
View full change record →The agreement requires customers to cover Cognition's losses and legal costs from third-party claims arising from the customer's data, the conduct of any Authorized User, or any use of the platform in combination with unapproved third-party tools. This obligation applies to negligent as well as intentional conduct by Authorized Users.
Cross-platform context
See how other platforms handle Customer Indemnification of Cognition and similar clauses.
Compare across platforms →Monitoring
Windsurf has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Customer shall indemnify, hold harmless, and, at Cognition's option, defend Cognition from and against any losses resulting from any Third-Party Claim (i) that the Customer Data, or any use of the Customer Data in accordance with this Agreement, infringes or misappropriates such third party's intellectual property rights; and (ii) based on Customer's or any Authorized User's (A) negligence or willful misconduct; (B) use of the Services in a manner not authorized by this Agreement; (C) use of the Services in combination with data, software, hardware, equipment, technology or other products or services not supplied or expressly authorized in writing by Cognition; or (D) any adaptation or modification of the Services other than by Cognition.Excerpt from Windsurf's Terms of Service
(1) REGULATORY LANDSCAPE: Broad indemnification clauses are subject to general contract law enforceability principles and, in some jurisdictions, to statutory limitations on indemnification for gross negligence or willful misconduct. The EU Unfair Contract Terms Directive may constrain enforceability of broadly drafted indemnification clauses in consumer contracts. The FTC Act may apply if indemnification terms are not clearly disclosed. (2) GOVERNANCE EXPOSURE: Medium to High. The extension of indemnification obligations to all Authorized User conduct, including negligent acts, creates a significant contingent liability for enterprise customers with large Authorized User populations. The combination-use trigger, covering use with data, software, hardware, or services not supplied or expressly authorized in writing by Cognition, may capture common integration scenarios without the customer's awareness. (3) JURISDICTION FLAGS: Enterprise customers with EU-based Authorized Users should assess whether this indemnification structure is enforceable under local law. California courts have at times limited enforcement of broad indemnification clauses. Customers in regulated industries should assess whether this indemnification conflicts with regulatory requirements governing vendor contract terms. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should assess whether their standard vendor agreements cap or limit upstream indemnification obligations of this scope. The combination-use trigger requires documentation of all third-party tools integrated with the Cognition platform to identify potential indemnification exposure. Cyber and professional liability insurance should be reviewed to confirm coverage for indemnification obligations of this type. (5) COMPLIANCE CONSIDERATIONS: Legal teams should document the scope of Authorized User populations and integration configurations to identify indemnification exposure. Internal acceptable use policies for the platform should be aligned with the agreement's restrictions to minimize unauthorized use triggers. The written authorization requirement for combination use should be operationalized through a vendor approval process.
This provision establishes a broad customer-side indemnification obligation that extends to all Authorized User conduct, including negligence and willful misconduct, and to any use of the Services in combination with non-Cognition-supplied tools or data. The scope of Authorized User conduct covered means the customer assumes indemnification liability for actions taken by any employee, consultant, or agent with platform access.
The agreement requires customers to cover Cognition's losses and legal costs from third-party claims arising from the customer's data, the conduct of any Authorized User, or any use of the platform in combination with unapproved third-party tools. This obligation applies to negligent as well as intentional conduct by Authorized Users.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Windsurf.