Not legal advice · Summaries of vendors' public pages, which change often. Verify with the vendor and your contract before relying on anything here.
AI Terms Tracker
Get weekly changes

Does Windsurf (Teams / Enterprise) train on your data?

Cognition · Coding · Last verified

Trains by default

Trains on business data unless you opt out.

Short answer: Yes, opt-out

Cognition (Windsurf/Devin): "By default, we may use your data for model training"; paid plans can opt out (Teams: admin only). Enterprise: never without written consent.

Source: windsurf.com/security

Why this matters: Data used for training can't be pulled back out of a trained model, so opting out only protects what comes after. Why training matters →

3/7 assurances found·5 of 9 fields confirmed from vendor pages

Below: retention, SOC 2, ISO 27001/42001, DPA, BAA, data residency and zero-retention for Windsurf (Teams / Enterprise), each linked to Cognition's own page.

Summary of Cognition's public pages as of Oct 17, 2026. Not legal advice: terms vary by plan and contract and can change. Confirm with Cognition before relying on it.

Trains on your data by default

Yes, opt-out

Cognition (Windsurf/Devin): "By default, we may use your data for model training"; paid plans can opt out (Teams: admin only). Enterprise: never without written consent.

Source:

Data retention

Duration of customer relationship

Data retained for the duration of the relationship unless otherwise specified; feedback data as long as needed.

Source:

SOC 2 Type II

Yes

SOC 2 Type II since September 2024.

Source:

ISO/IEC 27001

Unknown

Not stated on the Cognition pages we checked.

Pages checked:

ISO/IEC 42001

Unknown

Not stated on the Cognition pages we checked.

Pages checked:

DPA available

Yes

Data Processing Addendum linked in legal footer.

Source:

BAA / HIPAA

Unknown

Not stated on the Cognition pages we checked.

Pages checked:

Data residency options

Unknown

Not stated on the Cognition pages we checked.

Pages checked:

Zero-retention option

Yes

Opting out enables Zero Data Retention with model providers.

Source:

Vendor pages we monitor for this tool

We save a fingerprint (SHA-256 of the page's visible text) on every check so we can spot when a vendor edits its terms.

PageCheckedFingerprint
https://windsurf.com/securityOct 17, 20265e4a48b6bff7…
https://windsurf.com/privacy-policyOct 17, 2026e441e571e1f8…

Compare with

See all Coding tools · Why AI training on your data matters · How we source and verify this