Is Windsurf safe for work?
Low risk · 17Cognition (formerly Codeium) · Coding · facts (medium-confidence)
Windsurf is low-risk for default at-work use (17/100): it trains on your data unless you opt out, and holds SOC 2 Type II.
17
Low risk
Watch out: Cognition holds SOC 2 Type 2 and ISO 27001, but Windsurf's own terms say customer code may be used for training by default; the opt-out with Zero Data Retention is available only on paid tiers, and free-tier users have no documented opt-out. HIPAA and EU residency are unconfirmed.
Data and compliance facts
- Trains on consumer-tier data
- Opt-out
- Trains on business-tier data
- No
- Training opt-out available
- Yes
- SOC 2 Type II
- Yes
- ISO 27001
- Yes
- ISO 42001 (AI management)
- Unverified
- GDPR Data Processing Addendum
- Yes
- HIPAA BAA
- Unverified
- EU data residency
- Unverified
- SSO / SAML
- Yes
- Data retention
- No fixed day-count published; retained for the duration of the customer relationship. Under elected Zero Data Retention, data is deleted upon output generation.
- Safer tier
- Enterprise (SSO plus no-training guarantee); any paid tier can also elect Opt-Out plus Zero Data Retention
Why it scores 17 out of 100
- +17Trains on your data. Training is on by default on the consumer tier; you must find and set the opt-out.