Pro tier users can enable a Zero Data Retention (ZDR) setting that limits Windsurf to using code inputs only to generate suggestions in real-time, without training models or storing data. However, certain features and models labeled 'no ZDR' will still store data even with this setting enabled.
This analysis describes what Windsurf's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The ZDR option provides Pro users with a meaningful data minimization mechanism, but the agreement identifies specific features and model types that override ZDR protections, meaning the protection is not absolute across all service functions.
Interpretive note: The scope of ZDR protections depends on which specific features and model types a user enables; the carve-outs mean the protection level varies by usage pattern rather than being uniform across the service.
Pro users who enable ZDR can limit their User Content to real-time processing only, with encryption in transit and no storage at rest. However, enabling features such as Remote Indexing, Memories, Recipes, Web Retrieval, Trajectory Sharing, Deploys, Reviews, or Knowledge Base, or using models labeled 'no ZDR', will result in data storage regardless of the ZDR election.
How other platforms handle this
If you enable "Privacy Mode" in Cursor's settings: zero data retention will be enabled for our model providers. Cursor may store some code data to provide extra features. None of your code will ever be trained on by us or any third-party.
We retain personal data for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements, to resolve disputes, and to enforce our agreements. The criteria used to determine our retention periods include: the length of ...
We may retain de-identified or aggregated information that can no longer be used to identify you for any period of time, including indefinitely.
Monitoring
Windsurf has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"For Pro Users, you may elect to place limits on the use of User Content such that User Content (i) is transmitted only to generate code, outputs, or other functions generated in response to input User Content ("Suggestions") in real-time and are deleted once Suggestions are generated; (ii) is not used for any other purpose, including the training of language models; and (iii) is encrypted during transit and is not stored at rest. These limits control over the usage rights referenced in Section 10 above. Notwithstanding the foregoing, if you elect to use a model labeled "(no ZDR)", we or the provider may store User Content solely to provide the Service to you, and if you enable features that explicitly require persistent code snippets or other information (e.g. Remote Indexing, Memories, Recipes, Web Retrieval, Trajectory Sharing, Deploys, Reviews, Knowledge Base), and for Devin and Exafunction's Forge product, we may store code snippets and/or other information to provide these Services.— Excerpt from Windsurf's Windsurf Terms of Service
(1) REGULATORY LANDSCAPE: The ZDR option is operationally relevant to GDPR data minimization principles (Article 5(1)(c)) and purpose limitation requirements. For organizations in regulated industries (healthcare, financial services, legal), ZDR may be a prerequisite for deploying Windsurf with sensitive data. The EU AI Act's requirements for high-risk AI system data governance may also engage with the ZDR framework. (2) GOVERNANCE EXPOSURE: Medium. The ZDR option provides a meaningful privacy control for Pro users, but the carve-outs for specific features and 'no ZDR' models create compliance complexity. Organizations that enable ZDR but also use carved-out features may inadvertently assume the data retention terms they intended to avoid. (3) JURISDICTION FLAGS: EU organizations are most likely to require ZDR or equivalent protections to satisfy GDPR data minimization and purpose limitation obligations. Organizations in HIPAA-regulated contexts should evaluate whether ZDR satisfies Business Associate Agreement requirements for any PHI that might be included in code inputs. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise procurement teams evaluating Windsurf should specifically assess which features their developers use and whether those features are compatible with ZDR protections. Vendor assessments should document the carve-outs and confirm that organizational deployment policies restrict use of 'no ZDR' models where data protection is required. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should conduct a feature-by-feature assessment of which Windsurf capabilities are used and whether each is compatible with ZDR. Policy documentation should capture the ZDR election and the applicable carve-outs to support records of processing activities under GDPR Article 30.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The ZDR option provides Pro users with a meaningful data minimization mechanism, but the agreement identifies specific features and model types that override ZDR protections, meaning the protection is not absolute across all service functions.
Pro users who enable ZDR can limit their User Content to real-time processing only, with encryption in transit and no storage at rest. However, enabling features such as Remote Indexing, Memories, Recipes, Web Retrieval, Trajectory Sharing, Deploys, Reviews, or Knowledge Base, or using models labeled 'no ZDR', will result in data storage regardless of the ZDR election.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Windsurf.