Is Windsurf (Codeium) safe to use at work?

GhostAudit does not rate tools. Whether Windsurf (Codeium) is acceptable for your company depends on the plan you hold, the data people put into it and your own policy. This page records what the vendor states, with the wording and the source, so that decision can be made on facts: Free, paid individual and Teams plans: yes by default; opt-out available and Enterprise: only if the customer opts in (training on customer data).

Which attestations does the vendor of Windsurf (Codeium) state?

The vendor's pages state: SOC 2 Type II. This is the vendor's statement, with the page linked; GhostAudit has not audited the vendor, and the scope by product is on the vendor's page.

When were these facts checked, and how do I report an error?

The vendor's pages were read on 12 Nov 2026. Every quotation was checked against the stored text of its source page on that date. To report an inaccuracy, email hello@ghostaudit.ai with the page that shows the current wording.

Does Windsurf (Codeium) train on your data?

Windsurf (Codeium) by Cognition (Windsurf, Devin)Coding assistantsVendor's pages read on 12 Nov 2026

Short answer

It depends on the plan.

The vendor states that inputs are used for training by default on Free, paid individual and Teams plans. The vendor states that an opt-out is available. The vendor states that inputs are not used for training unless the customer opts in on Enterprise. Read on 12 Nov 2026. The plan your company actually holds, and any negotiated terms, decide what applies to you.

Note. windsurf.com/security now redirects to Cognition's security documentation, which describes these terms for Devin and Cognition's services. Confirm with the vendor that they cover the Windsurf editor plan you use.

This page is short: 3 facts have been read and sourced for Windsurf (Codeium) so far. Everything else is listed below as unknown.

A summary of what the vendor publishes, not legal advice, not an assessment of the vendor and not an endorsement. How this page was made.

Per plan

What the vendor states, plan by plan

Plan	Trains on your data	Default retention	Human review of inputs	Single sign-on
Free, paid individual and Teams plansIndividual paid	Yes by default; opt-out available	Unknown	Unknown	Unknown
EnterpriseEnterprise	Only if the customer opts in	Unknown	Unknown	Unknown

“Unknown” means the vendor's page that would answer this was not read, or could not be opened. It does not mean “no”.

Free, paid individual and Teams plans

On Free, paid individual and Teams plans, the vendor states that inputs are used for training by default and that an opt-out is available. Not verified: default retention and human review of inputs.

Trains on customer data

Yes by default; opt-out available

The page states paid plans can opt out in Data Controls, that on Teams only an administrator can, and that opting out enables zero data retention with model providers.

“By default, we may use your data for model training purposes to improve and enhance the Services.”

The vendor states this on docs.devin.ai, read on 12 Nov 2026

Unknown for this plan: Default retention; Zero-retention option; Deletion on request; Human review of inputs; Single sign-on (SSO); SCIM provisioning; Audit logs; Admin console; Data residency options; Customer-managed keys.

Enterprise

On Enterprise, the vendor states that inputs are not used for training unless the customer opts in. Not verified: default retention and human review of inputs.

Trains on customer data: Only if the customer opts in
“If you are an Enterprise customer, we will never train on your data without your express prior written consent.”
The vendor states this on docs.devin.ai, read on 12 Nov 2026

The vendor

Attestations and company facts the vendor states

SOC 2 Type II: Yes
“Cognition has been SOC 2 Type II certified since September 2024.”
The vendor states this on docs.devin.ai, read on 12 Nov 2026

“Yes” means the vendor's page says so, with the page linked. GhostAudit has not audited the vendor. Scope by product is on the vendor's page.

Plainly

What remains unknown

Default retention
Zero-retention option
Deletion on request
Human review of inputs
Single sign-on (SSO)
SCIM provisioning
Audit logs
Admin console
Data residency options
Customer-managed keys
ISO/IEC 27001
ISO/IEC 42001
HIPAA BAA available
FedRAMP
GDPR DPA available
Company headquarters
Data processing location
Model providers used

None of these was guessed, inferred from another vendor or filled from memory. Ask the vendor, using the list below.

Trains by default on the consumer plan. Applies to: Free, paid individual and Teams plans. Employees using personal accounts are on these terms.
No DPA found in this review. The vendor pages read for this card did not include a data processing agreement. Many vendors publish one or provide it on request: ask the vendor.
Enterprise controls not verified. SSO, SCIM and audit logs have not been checked for this tool yet.

Do it yourself

How to check Windsurf (Codeium) in your own company

01Find out which plan each account is on. The vendor's terms differ between Free, paid individual and Teams plans and Enterprise. People who signed up with a personal address are on the personal terms, whatever the company bought.
02Open the account or administrator settings and look for the data-controls or model-training setting the vendor's page describes. Note what it is set to today and who is able to change it.
03Read the vendor's own page, linked under each fact below, and check that the sentence quoted here is still there. Pages change; the date shows when this one was read.
04Compare with your contract or order form. Where a data processing agreement or negotiated terms exist, they take precedence over the public pages.
05Record the plan, the setting and the date in your AI inventory, so that the answer exists the next time a customer or auditor asks.

For procurement

What to ask the vendor

Neutral questions for the points the vendor's public pages left open. Ask for the answer in writing.

01How long are prompts, files and outputs kept by default, and can an administrator shorten that period?
02Is a zero-retention option available on our plan, and what does it exclude (for example abuse monitoring logs)?
03How do we request deletion of our data, and within how many days is it completed, including backups?
04Can your staff or contractors read our inputs? In which cases, and is that access logged?
05Is single sign-on available on our plan, and can sign-in with personal accounts be blocked for our domain?
06Is SCIM provisioning available, so that leavers lose access automatically?
07Are audit logs available to administrators, and can they be exported to our security tooling?
08Is there an administrator console where data controls can be set for every account in our organisation?
09Where is our data processed and stored, and can a region be chosen?
10Do the statements on your public pages apply to our contract as written, or do negotiated terms override them?

FAQ

Questions about Windsurf (Codeium)

Does Windsurf (Codeium) train on your data?: It depends on the plan. The vendor states that inputs are used for training by default on Free, paid individual and Teams plans. The vendor states that an opt-out is available. The vendor states that inputs are not used for training unless the customer opts in on Enterprise. Read on 12 Nov 2026. The plan your company actually holds, and any negotiated terms, decide what applies to you.
Is Windsurf (Codeium) safe to use at work?: GhostAudit does not rate tools. Whether Windsurf (Codeium) is acceptable for your company depends on the plan you hold, the data people put into it and your own policy. This page records what the vendor states, with the wording and the source, so that decision can be made on facts: Free, paid individual and Teams plans: yes by default; opt-out available and Enterprise: only if the customer opts in (training on customer data).
Which attestations does the vendor of Windsurf (Codeium) state?: The vendor's pages state: SOC 2 Type II. This is the vendor's statement, with the page linked; GhostAudit has not audited the vendor, and the scope by product is on the vendor's page.
When were these facts checked, and how do I report an error?: The vendor's pages were read on 12 Nov 2026. Every quotation was checked against the stored text of its source page on that date. To report an inaccuracy, email [email protected] with the page that shows the current wording.

Method

How this page was made, and how to correct it

Every fact above is a statement found on a page Cognition (Windsurf, Devin) itself publishes. The page was fetched and reduced to text, the statement was recorded with its exact wording, and the quotation was checked against the stored text of the page. Quotations are at most 25 words. Search results, blogs and third-party summaries were not used.

These are summaries of statements the vendor publishes, as read on the date shown. They are not legal advice, not an assessment of the vendor and not an endorsement. Vendors change their terms: open the linked source and check your own contract before you rely on a statement.

Found an error, or are you the vendor? Report an inaccuracy with the page that shows the current wording. The page is re-read; the fact, its quotation and its date are corrected, or the fact is set to unknown if the page cannot be opened. The full method.

The vendor's official pages

Privacy policycognition.com
Termscognition.com
Trust centredocs.devin.ai

Windsurf (Codeium) is a product of Cognition (Windsurf, Devin). GhostAudit is not affiliated with, endorsed by or sponsored by Cognition (Windsurf, Devin).

Is Windsurf (Codeium) in use at your company, and on which plan?

GhostAudit shows which AI tools your people use, from Google Workspace or Microsoft 365 and from the browser, and sets each one beside the terms on this page. It records tool names and time, never prompts.

See which AI tools your company uses