AI Vendor Directory · Coding assistants
Does Windsurf train on your data?
Depends — varies by plan or setting. Vendor-stated default: configurable (Cognition paid/Teams default allows training until opted out; Enterprise: no without written consent). Cognition's current data practices page states: 'By default, we may use your data for model training purposes to improve and enhance the Services.' Paid-plan users can opt out — 'After you opt out, your data will not be used for training and Zero Data Retention will be enabled with our model providers.' On Teams plans 'only an administrator can exercise the opt-out.' For Enterprise, Cognition states it 'will never train on your data without your express prior written consent.' Caveat: this page is written around Devin; how it maps to legacy Windsurf plan terms is not clearly documented on a public page — confirm the training/ZDR position in your order form or via trust.cognition.ai (detailed docs are NDA-gated).
By the Shieldra Compliance Team · Last updated 2026-07-29
What is Windsurf (now Devin Desktop, by Cognition)?
The Windsurf AI editor (formerly Codeium) was acquired by Cognition and renamed Devin Desktop in June 2026; the JetBrains plugin keeps the Windsurf name and legacy Windsurf Enterprise plans are honored. windsurf.com now redirects to devin.ai.
Key facts
- Vendor: Cognition AI — https://devin.ai/desktop
- Trains on customer data by default: configurable (Cognition paid/Teams default allows training until opted out; Enterprise: no without written consent)
- Source for the training answer: https://docs.devin.ai/admin/security
- Last verified: 2026-07-29
What certifications does Windsurf hold?
- SOC 2 Type II
- ISO/IEC 27001:2022
Security, DPA, and subprocessor links
- Security / trust page: https://trust.cognition.ai/
- Data processing agreement (DPA): https://cognition.com/legal/data-processing-statement
What is your EU AI Act role when you build on Windsurf?
Deployer of a third-party AI coding tool; Cognition is the provider. Given the acquisition churn and default-on training for non-Enterprise plans, re-verify vendor terms at renewal — the risk profile changed materially post-acquisition.
What to record in your AI registry
- Provider: Cognition AI (Windsurf/Devin Desktop)
- Model type: third party api
- Data typically flowing to the vendor: source code, prompts and chat, codebase context/index, usage telemetry
Sources
- https://docs.devin.ai/admin/security
- https://trust.cognition.ai/
- https://devin.ai/desktop
- https://docs.devin.ai/desktop/security
Disclaimer
Curated from vendor-published pages on the date above. Vendor terms change - verify against the cited sources before relying on a profile for a procurement decision. Last verified 2026-07-29.
Frequently asked questions
Does Windsurf train AI models on your data?
Depends — varies by plan or setting. Vendor-stated default: configurable (Cognition paid/Teams default allows training until opted out; Enterprise: no without written consent). Cognition's current data practices page states: 'By default, we may use your data for model training purposes to improve and enhance the Services.' Paid-plan users can opt out — 'After you opt out, your data will not be used for training and Zero Data Retention will be enabled with our model providers.' On Teams plans 'only an administrator can exercise the opt-out.' For Enterprise, Cognition states it 'will never train on your data without your express prior written consent.' Caveat: this page is written around Devin; how it maps to legacy Windsurf plan terms is not clearly documented on a public page — confirm the training/ZDR position in your order form or via trust.cognition.ai (detailed docs are NDA-gated).
What certifications does Windsurf hold?
Per the vendor's published pages as of 2026-07-29: SOC 2 Type II; ISO/IEC 27001:2022.
What is your EU AI Act role when you build on Windsurf?
Deployer of a third-party AI coding tool; Cognition is the provider. Given the acquisition churn and default-on training for non-Enterprise plans, re-verify vendor terms at renewal — the risk profile changed materially post-acquisition.
