Windsurf

Windsurf explicitly commits to zero-data retention by default for Teams and Enterprise plans, with clear statements that code data is never trained on in this mode. The Security document states: 'The code data submitted by zero-data retention mode users will never be trained on. Again, zero-data retention mode is on by default for teams and enterprise customers.' For Individual plans, users can opt-in to zero-data retention, and the ToS specifies that Chat User Content used for training is anonymized and users can opt out.

“[Security] 'The code data submitted by zero-data retention mode users will never be trained on. Again, zero-data retention mode is on by default for teams and enterprise customers.'”

The Teams ToS explicitly grants users ownership of all Suggestions (generated outputs) with no vendor rights retained. Section 7.2 states: 'Exafunction agrees that you own all Suggestions. Exafunction does not anticipate obtaining any rights in Suggestions under these Terms. Exafunction hereby assigns to you all of its right, title, and interest in and to any Suggestions.' This is enterprise-friendly with clear IP ownership transfer.

“[Teams ToS] 'Exafunction agrees that you own all Suggestions...Exafunction hereby assigns to you all of its right, title, and interest in and to any Suggestions provided or returned to you by the Service.'”

While Windsurf lists subprocessors with zero-data retention agreements for major inference providers (OpenAI, Anthropic, Google Vertex, xAI, Fireworks), some subprocessors like Bing API explicitly do NOT have zero-data retention agreements and require opt-in. The Security document states: 'We do not have a zero data retention agreement with Bing, so this must be explicitly enabled by Team and Enterprise administrators.' Additionally, some internal tools (Retool, Metabase, Tableau) may see code data if not on zero-data retention. This creates moderate concern due to conditional sharing and lack of universal DPA coverage.

“[Security] 'We do not have a zero data retention agreement with Bing, so this must be explicitly enabled by Team and Enterprise administrators.' [Security] 'Retool (May see code data if not on zero-data retention): We use Retool for dashboards...We may expose logs of data for debugging purposes from users that are not using Zero-data retention mode.'”

Windsurf provides explicit, clear retention policies. For Teams and Enterprise, zero-data retention is the default: code data is never serialized and stored in plaintext at servers or subprocessors. The Security document states: 'Zero-data retention mode is the default for any user on a team or enterprise plan.' For Cloud deployments with optional features, data is 'securely encrypted at rest.' For Hybrid and Self-hosted, data retention occurs only in the customer's private tenant. Account deletion is available from the profile page.

“[Security] 'Zero-data retention mode is the default for any user on a team or enterprise plan and can be enabled by any individual from their profile page.' [Security] 'With zero-data retention mode enabled, code data is not persisted at our servers or by any of our subprocessors.'”

The Teams ToS explicitly assigns all IP ownership of generated Suggestions to the customer with no vendor rights retained. Section 7.2 is unambiguous: 'Exafunction agrees that you own all Suggestions' and 'Exafunction hereby assigns to you all of its right, title, and interest in and to any Suggestions.' The Security document also confirms: 'You own all of the code generated by Windsurf's products, to the extent permitted by law.'

“[Teams ToS] 'Exafunction agrees that you own all Suggestions. Exafunction does not anticipate obtaining any rights in Suggestions under these Terms.' [Security] 'You own all of the code generated by Windsurf's products, to the extent permitted by law.'”

Windsurf demonstrates strong compliance certifications. The Security document explicitly states: 'Windsurf has SOC 2 Type II certification, and conducts annual third-party penetration testing.' Additionally, 'Windsurf also has available FedRAMP High accreditation' and 'HIPAA compliance' with Business Associate Agreement support. The company maintains OWASP ASVS Level 1 compliance with paths to Level 2 and 3. These certifications exceed baseline requirements for enterprise security.

“[Security] 'Windsurf has SOC 2 Type II certification, and conducts annual third-party penetration testing (last completed on February 13, 2025).' [Security] 'Windsurf also has available FedRAMP High accreditation...HIPAA compliance: In most cases...our platform is maintained as HIPAA compliant.'”