GitHub Copilot vs. Windsurf: data protection per plan
GitHub Copilot (7 plans) and Windsurf (5 plans) side by side: DPA, training on inputs, hosting and data retention per plan, based on the providers’ public documents. Without rating.
Last updated: (latest review date of the tools shown)
At a glance
Each value is listed with the plans it applies to. Pick a tier to see only plans of that tier; if plans are chosen in the plan comparison below, the table shows exactly those.
All plans: each value is listed with the plans it applies to.
| Feature | GitHub Copilot | Windsurf |
|---|---|---|
| Provider based in | According to the GitHub General Privacy Statement | Cognition AI, Inc., 550 Third Street, San Francisco, CA 94107, USA |
| Plans recorded | 7 | 5 |
| Hosting | mixed: Free, Student, Pro, Pro+, MaxEU option: Business, Enterprise | US only: Free, Pro, Max, Teamsnot documented: Enterprise |
| Training on inputs | opt-out available: Free, Pro, Pro+, Maxnot documented: Studentno: Business, Enterprise | yes: Freeopt-out available: Pro, Max, Teamsno: Enterprise |
| DPA | not documented: Free, Student, Pro, Pro+, Maxyes: Business, Enterprise | yes: all 5 plans |
| As of | 18 Oct 2026 | 18 Oct 2026 |
Plans compared
Comparing: GitHub Copilot Business vs. Windsurf Teams
| Feature | GitHub CopilotBusiness | WindsurfTeams |
|---|---|---|
| yes | yes | |
| Details: DPA available | yes: Copilot is covered by the GitHub Data Protection Agreement, which applies to all generally available (GA) Copilot features and the previews listed in 'GitHub DPA-Covered Previews' (q8); GitHub and customers 'can enter a Data Protection Agreement that supports compliance with the GDPR' (q1). For purchases directly from GitHub, the GitHub Generative AI Services Terms apply; for purchases via Microsoft, the Microsoft Product Terms apply (q8). Provider’s DPA | yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum) Provider’s DPA |
| differs by plan | no | opt-out available |
| Details: Training on inputs | "No. GitHub does not use either Copilot Business or Enterprise data to train its models." (q1); q3: "GitHub does not use Copilot Business or Copilot Enterprise customer data to train AI models." Third-party models: according to q3, OpenAI, among others, "do not train models on customer business data", Google/Gemini does not use prompts for training, zero data retention agreements with OpenAI, Anthropic, xAI and Fireworks AI (details per provider in q3). q14: "Copilot Business and Copilot Enterprise customers' data is protected under GitHub's Data Protection Agreement, which prohibits such use without customer authorization." | Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. On the Teams plan, only an administrator can exercise the opt-out. Default according to the documentation: training enabled. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law. |
| differs by plan | EU option | US only |
| Details: Data residency | Default on github.com: storage in the USA (q7). EU data residency via GitHub Enterprise Cloud with GHE.com: Copilot Business or Enterprise can be assigned there (q7). With the policy 'Restrict Copilot to data residency compliant models', according to q6, 'all inference processing and associated data' remain in the selected region (EU or USA); policy disabled by default, additional consumption +10 % AI Credits (q6). Without this policy, according to q5, Copilot data and logs are 'by default stored outside your region'. Inline suggestions: models hosted on Azure (q3). | DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented. |
| list available | list available | |
| Details: List published |
|
|
| differs by plan | Default settings according to q1: access… | DPA |
| Details: Data retention | Default settings according to q1: access via IDE (chat and code completions): prompts and suggestions "Not retained"; User Engagement Data two years; Feedback Data "as long as needed for its intended purpose". All other access routes (including github.com, Mobile, CLI): prompts and suggestions 28 days; User Engagement Data two years. DPA (October 2025 version), Section 8: after the end of the services, GitHub deletes the Customer Personal Data or returns it at the customer's choice and deletes existing copies "in accordance with our retention and deletion policy" (q13). Unlike q1, the Copilot Trust Center FAQ (q16) assigns Copilot CLI to IDE access: inputs and outputs "Not retained by default" (exception: time-limited retention in the event of confirmed violations of the Acceptable Use Policies or Terms of Service); other access: "Retained for up to 28 days by default". | DPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented. |
| differs by plan | 19 USD/user/mo | 80 USD/mo… (further prices in the details) |
| Details: Price | 19 USD per assigned seat/month (q2) | 80 USD per month for the team plan plus 40 USD per month per full dev seat (pricing page, no information on taxes); up to 200 users. |
| yes | yes | |
| Details: AI features included | yes (1,900 AI Credits per user/month, access to premium models; q2) | yes (Pro plus up to 200 users, sharing and collaboration, centralised billing, admin dashboard with analytics, priority support; according to the FAQ, Devin Desktop only with a full seat, each full seat with 40 USD of usage per month across all Devin products) |
| 11 sources | 6 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- GitHub Copilot Businessyes
- Windsurf Teamsyes
- GitHub Copilot Business
yes: Copilot is covered by the GitHub Data Protection Agreement, which applies to all generally available (GA) Copilot features and the previews listed in 'GitHub DPA-Covered Previews' (q8); GitHub and customers 'can enter a Data Protection Agreement that supports compliance with the GDPR' (q1). For purchases directly from GitHub, the GitHub Generative AI Services Terms apply; for purchases via Microsoft, the Microsoft Product Terms apply (q8).
Provider’s DPAWindsurf Teamsyes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA
Training
- differs by plan
- GitHub Copilot Businessno
- Windsurf Teamsopt-out available
- GitHub Copilot Business
"No. GitHub does not use either Copilot Business or Enterprise data to train its models." (q1); q3: "GitHub does not use Copilot Business or Copilot Enterprise customer data to train AI models." Third-party models: according to q3, OpenAI, among others, "do not train models on customer business data", Google/Gemini does not use prompts for training, zero data retention agreements with OpenAI, Anthropic, xAI and Fireworks AI (details per provider in q3). q14: "Copilot Business and Copilot Enterprise customers' data is protected under GitHub's Data Protection Agreement, which prohibits such use without customer authorization."
Windsurf TeamsPlatform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. On the Teams plan, only an administrator can exercise the opt-out. Default according to the documentation: training enabled. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
Hosting
- differs by plan
- GitHub Copilot BusinessEU option
- Windsurf TeamsUS only
- GitHub Copilot Business
Default on github.com: storage in the USA (q7). EU data residency via GitHub Enterprise Cloud with GHE.com: Copilot Business or Enterprise can be assigned there (q7). With the policy 'Restrict Copilot to data residency compliant models', according to q6, 'all inference processing and associated data' remain in the selected region (EU or USA); policy disabled by default, additional consumption +10 % AI Credits (q6). Without this policy, according to q5, Copilot data and logs are 'by default stored outside your region'. Inline suggestions: models hosted on Azure (q3).
Windsurf TeamsDPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
Sub-processors
- GitHub Copilot Businesslist available
- Windsurf Teamslist available
- GitHub Copilot Business
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- GitHub subsidiaries as per the list: GitHub Australia Pty Ltd, GitHub BV (NL), GitHub Canada ULC, GitHub Germany GmbH, GitHub India Pty Ltd, npm Inc, Semmle Inc
Windsurf Teams- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
Retention
- differs by plan
- GitHub Copilot BusinessDefault settings according to q1: access…
- Windsurf TeamsDPA
- GitHub Copilot BusinessDefault settings according to q1: access via IDE (chat and code completions): prompts and suggestions "Not retained"; User Engagement Data two years; Feedback Data "as long as needed for its intended purpose". All other access routes (including github.com, Mobile, CLI): prompts and suggestions 28 days; User Engagement Data two years. DPA (October 2025 version), Section 8: after the end of the services, GitHub deletes the Customer Personal Data or returns it at the customer's choice and deletes existing copies "in accordance with our retention and deletion policy" (q13). Unlike q1, the Copilot Trust Center FAQ (q16) assigns Copilot CLI to IDE access: inputs and outputs "Not retained by default" (exception: time-limited retention in the event of confirmed violations of the Acceptable Use Policies or Terms of Service); other access: "Retained for up to 28 days by default".Windsurf TeamsDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented.
Price
- differs by plan
- GitHub Copilot Business19 USD/user/mo
- Windsurf Teams80 USD/mo… (further prices in the details)
- GitHub Copilot Business
19 USD per assigned seat/month (q2)
Windsurf Teams80 USD per month for the team plan plus 40 USD per month per full dev seat (pricing page, no information on taxes); up to 200 users.
- GitHub Copilot Businessyes
- Windsurf Teamsyes
- GitHub Copilot Business
yes (1,900 AI Credits per user/month, access to premium models; q2)
Windsurf Teamsyes (Pro plus up to 200 users, sharing and collaboration, centralised billing, admin dashboard with analytics, priority support; according to the FAQ, Devin Desktop only with a full seat, each full seat with 40 USD of usage per month across all Devin products)
Evidence
- GitHub Copilot Business11 sources
- Windsurf Teams6 sources
- GitHub Copilot Business
- GitHub Copilot: Plans & pricing incl. FAQ (Privacy, Retention, Training)Pricing page / provider FAQ, retrieved 18 Oct 2026
- Plans for GitHub Copilot (GitHub Docs)Official documentation, retrieved 14 Oct 2026
- Hosting of models for GitHub Copilot (GitHub Docs)Official documentation, retrieved 18 Oct 2026
- GitHub SubprocessorsSub-processor list, retrieved 14 Oct 2026
- About storage of your data with data residency (GHE.com)Official documentation, retrieved 14 Oct 2026
- GitHub Copilot with data residencyOfficial documentation, retrieved 14 Oct 2026
- About GitHub Enterprise Cloud with data residencyOfficial documentation, retrieved 14 Oct 2026
- Resources for getting approval of GitHub CopilotOfficial documentation, retrieved 14 Oct 2026
- GitHub Data Protection Agreement (DPA), version October 2025DPA, retrieved 14 Oct 2026
- Managing GitHub Copilot policies as an individual subscriber (GitHub Docs)Documentation, retrieved 18 Oct 2026
- GitHub Copilot Trust Center: FAQ (Privacy, Security, Commercial)Trust Center / provider FAQ, retrieved 18 Oct 2026
Windsurf Teams- Plans and Pricing (windsurf.com/pricing redirects here)Pricing page, retrieved 18 Oct 2026
- Docs: Devin Desktop FAQ (transition from Windsurf)Documentation, retrieved 18 Oct 2026
- Platform Terms of Service (Last updated: 2026-06-30)Terms and conditions, retrieved 18 Oct 2026
- Data Processing Addendum (Last updated: 2026-07-23, with sub-processor list in Appendix C)DPA, retrieved 18 Oct 2026
- Privacy Policy (Last updated: 2026-03-09)Privacy notice, retrieved 18 Oct 2026
- Docs: Security at Cognition (windsurf.com/security redirects here)Documentation, retrieved 18 Oct 2026
| Feature | GitHub Copilot | Windsurf |
|---|---|---|
| differs by tool |
| yesall 5 plans |
| Details: DPA available |
|
|
| differs by tool |
|
|
| Details: Training on inputs |
|
|
| differs by tool |
|
|
| Details: Data residency |
|
|
| list availableall 7 plans | list availableall 5 plans | |
| Details: List published |
|
|
| differs by tool |
| DPAall 5 plans |
| Details: Data retention |
|
|
| differs by tool |
|
|
| Details: Price |
|
|
| yesall 7 plans | yesall 5 plans | |
| Details: AI features included |
|
|
| 13 sources | 8 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- differs by tool
- GitHub Copilot
- not publicly documentedFree, Student, Pro, Pro+, Max
- yesBusiness, Enterprise
- Windsurfyesall 5 plans
- GitHub Copilot
- Free
not publicly documented: according to q1, Copilot Free/Pro/Pro+/Max involve data processing by GitHub as controller (reference to Terms of Service and Privacy Statement); the DPA is mentioned in q1/q8 only in connection with Business/Enterprise
- Student
not publicly documented: according to q1, Copilot Free/Pro/Pro+/Max involve data processing by GitHub as controller (reference to Terms of Service and Privacy Statement); the DPA is mentioned in q1/q8 only in connection with Business/Enterprise
- Pro
not publicly documented: according to q1, Copilot Free/Pro/Pro+/Max involve data processing by GitHub as controller (reference to Terms of Service and Privacy Statement); the DPA is mentioned in q1/q8 only in connection with Business/Enterprise
- Pro+
not publicly documented: according to q1, Copilot Free/Pro/Pro+/Max involve data processing by GitHub as controller (reference to Terms of Service and Privacy Statement); the DPA is mentioned in q1/q8 only in connection with Business/Enterprise
- Max
not publicly documented: according to q1, Copilot Free/Pro/Pro+/Max involve data processing by GitHub as controller (reference to Terms of Service and Privacy Statement); the DPA is mentioned in q1/q8 only in connection with Business/Enterprise
- Business
yes: Copilot is covered by the GitHub Data Protection Agreement, which applies to all generally available (GA) Copilot features and the previews listed in 'GitHub DPA-Covered Previews' (q8); GitHub and customers 'can enter a Data Protection Agreement that supports compliance with the GDPR' (q1). For purchases directly from GitHub, the GitHub Generative AI Services Terms apply; for purchases via Microsoft, the Microsoft Product Terms apply (q8).
Provider’s DPA - Enterprise
yes: as Business (GitHub Data Protection Agreement for GA features and listed DPA previews; q8, q1).
Provider’s DPA
Windsurf- Free
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Pro
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Max
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Teams
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Enterprise
yes (Enterprise Terms 4.3: the Data Processing Addendum at cognition.com/dpa is incorporated into the agreement; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA
- Free
Training
- differs by tool
- GitHub Copilot
- opt-out availableFree, Pro, Pro+, Max
- not publicly documentedStudent
- noBusiness, Enterprise
- Windsurf
- yesFree
- opt-out availablePro, Max, Teams
- noEnterprise
- GitHub Copilot
- Free
GitHub Docs "Managing Copilot policies as an individual subscriber" (q14): "Starting on April 24, 2026, if you have a Copilot Free, Copilot Pro, Copilot Pro+, or Copilot Max plan, GitHub may use your interactions with GitHub features and services—including inputs, outputs, code snippets, and associated context—to train and improve AI models." Opt-out via the setting "Allow GitHub to use my data for AI model training" = Disabled (q14) or https://github.com/settings/copilot/features: "Individual subscribers can opt out of having their data used for AI model training at any time." (q1). q3: the same applies to Copilot Free, Pro, Pro+ and Max "in accordance with our GitHub General Privacy Statement and applicable user settings".
- Student
q1, q3 and q14 expressly state the training rule for Copilot Free, Pro, Pro+ and Max (q14: "Starting on April 24, 2026, if you have a Copilot Free, Copilot Pro, Copilot Pro+, or Copilot Max plan ..."). Copilot Student is not mentioned in these sentences; the retrieved primary sources contain no separate statement on Student. The Copilot Trust Center FAQ (q16) likewise states the training rule only for "Individual (Free/Pro/Pro+/Max) Subscribers"; the documentation page on Copilot Student (q17) contains no statement on training.
- Pro
GitHub Docs "Managing Copilot policies as an individual subscriber" (q14): "Starting on April 24, 2026, if you have a Copilot Free, Copilot Pro, Copilot Pro+, or Copilot Max plan, GitHub may use your interactions with GitHub features and services—including inputs, outputs, code snippets, and associated context—to train and improve AI models." Opt-out via the setting "Allow GitHub to use my data for AI model training" = Disabled (q14) or https://github.com/settings/copilot/features: "Individual subscribers can opt out of having their data used for AI model training at any time." (q1). q3: the same applies to Copilot Free, Pro, Pro+ and Max "in accordance with our GitHub General Privacy Statement and applicable user settings".
- Pro+
GitHub Docs "Managing Copilot policies as an individual subscriber" (q14): "Starting on April 24, 2026, if you have a Copilot Free, Copilot Pro, Copilot Pro+, or Copilot Max plan, GitHub may use your interactions with GitHub features and services—including inputs, outputs, code snippets, and associated context—to train and improve AI models." Opt-out via the setting "Allow GitHub to use my data for AI model training" = Disabled (q14) or https://github.com/settings/copilot/features: "Individual subscribers can opt out of having their data used for AI model training at any time." (q1). q3: the same applies to Copilot Free, Pro, Pro+ and Max "in accordance with our GitHub General Privacy Statement and applicable user settings".
- Max
GitHub Docs "Managing Copilot policies as an individual subscriber" (q14): "Starting on April 24, 2026, if you have a Copilot Free, Copilot Pro, Copilot Pro+, or Copilot Max plan, GitHub may use your interactions with GitHub features and services—including inputs, outputs, code snippets, and associated context—to train and improve AI models." Opt-out via the setting "Allow GitHub to use my data for AI model training" = Disabled (q14) or https://github.com/settings/copilot/features: "Individual subscribers can opt out of having their data used for AI model training at any time." (q1). q3: the same applies to Copilot Free, Pro, Pro+ and Max "in accordance with our GitHub General Privacy Statement and applicable user settings".
- Business
"No. GitHub does not use either Copilot Business or Enterprise data to train its models." (q1); q3: "GitHub does not use Copilot Business or Copilot Enterprise customer data to train AI models." Third-party models: according to q3, OpenAI, among others, "do not train models on customer business data", Google/Gemini does not use prompts for training, zero data retention agreements with OpenAI, Anthropic, xAI and Fireworks AI (details per provider in q3). q14: "Copilot Business and Copilot Enterprise customers' data is protected under GitHub's Data Protection Agreement, which prohibits such use without customer authorization."
- Enterprise
"GitHub does not use either Copilot Business or Enterprise data to train its models." (q1, q3). q14: "Copilot Business and Copilot Enterprise customers' data is protected under GitHub's Data Protection Agreement, which prohibits such use without customer authorization."
Windsurf- Free
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. An opt-out is only available on paid plans ("If you subscribe to a paid Service Tier, you may opt out of this use"); no opt-out is documented for Free. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Pro
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. Default according to the documentation: training enabled, opt-out at any time in the Data Controls settings. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Max
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. Default according to the documentation: training enabled, opt-out at any time in the Data Controls settings. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Teams
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. On the Teams plan, only an administrator can exercise the opt-out. Default according to the documentation: training enabled. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Enterprise
Enterprise Terms (as of 2026-06-08) 3.3: Cognition does not use, or permit any third party to use, Customer Data to train AI models without the customer's express prior written consent; Usage Data may be used for internal analytics. Documentation: "If you are an Enterprise customer, we will never train on your data without your express prior written consent." DPA (as of 2026-07-23) section 4: sub-processors are subject to equivalent restrictions.
- Free
Hosting
- differs by tool
- GitHub Copilot
- mixedFree, Student, Pro, Pro+, Max
- EU optionBusiness, Enterprise
- Windsurf
- US onlyFree, Pro, Max, Teams
- not publicly documentedEnterprise
- GitHub Copilot
- Free
GitHub General Privacy Statement (q11): "GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations." q7: "By default, GitHub stores data for GitHub.com in the USA." Regional data residency (EU) is available only via GitHub Enterprise Cloud with GHE.com; there, "Copilot Individual" is not available to managed users (q7). q3: models are hosted by OpenAI, Azure, Anthropic, Google and others; inline suggestions on the Free and Student plans run on Fireworks AI.
- Student
GitHub General Privacy Statement (q11): "GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations." q7: "By default, GitHub stores data for GitHub.com in the USA." Regional data residency (EU) is available only via GitHub Enterprise Cloud with GHE.com; there, "Copilot Individual" is not available to managed users (q7). q3: models are hosted by OpenAI, Azure, Anthropic, Google and others; inline suggestions on the Free and Student plans run on Fireworks AI.
- Pro
GitHub General Privacy Statement (q11): "GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations." q7: "By default, GitHub stores data for GitHub.com in the USA." Regional data residency (EU) is available only via GitHub Enterprise Cloud with GHE.com; there, "Copilot Individual" is not available to managed users (q7). q3: models are hosted by OpenAI, Azure, Anthropic, Google and others; inline suggestions on the Free and Student plans run on Fireworks AI.
- Pro+
GitHub General Privacy Statement (q11): "GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations." q7: "By default, GitHub stores data for GitHub.com in the USA." Regional data residency (EU) is available only via GitHub Enterprise Cloud with GHE.com; there, "Copilot Individual" is not available to managed users (q7). q3: models are hosted by OpenAI, Azure, Anthropic, Google and others; inline suggestions on the Free and Student plans run on Fireworks AI.
- Max
GitHub General Privacy Statement (q11): "GitHub stores and processes Personal Data in a variety of locations, including your local region, the United States, and other countries where GitHub, its affiliates, subsidiaries, or subprocessors have operations." q7: "By default, GitHub stores data for GitHub.com in the USA." Regional data residency (EU) is available only via GitHub Enterprise Cloud with GHE.com; there, "Copilot Individual" is not available to managed users (q7). q3: models are hosted by OpenAI, Azure, Anthropic, Google and others; inline suggestions on the Free and Student plans run on Fireworks AI.
- Business
Default on github.com: storage in the USA (q7). EU data residency via GitHub Enterprise Cloud with GHE.com: Copilot Business or Enterprise can be assigned there (q7). With the policy 'Restrict Copilot to data residency compliant models', according to q6, 'all inference processing and associated data' remain in the selected region (EU or USA); policy disabled by default, additional consumption +10 % AI Credits (q6). Without this policy, according to q5, Copilot data and logs are 'by default stored outside your region'. Inline suggestions: models hosted on Azure (q3).
- Enterprise
As Business: default USA (q7); EU data residency via GHE.com with the policy 'Restrict Copilot to data residency compliant models' (q6, q5). q6 lists models of the GPT and Claude series for the EU; according to q6, model availability per region changes continuously. Not all Copilot features are available on GHE.com (q7).
Windsurf- Free
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Pro
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Max
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Teams
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Enterprise
Standard SaaS according to DPA Appendix C (as of 2026-07-23) with sub-processors in the United States, support workflow in India. Pricing page: Enterprise with "Dedicated deployment option" and deployment in the customer's own VPC; documentation: FedRAMP deployment on AWS GovCloud. Regions of the dedicated or VPC deployment not publicly documented; an EU region is not documented.
- Free
Sub-processors
- GitHub Copilotlist availableall 7 plans
- Windsurflist availableall 5 plans
- GitHub Copilot
- Free
- According to q4, the list applies to 'GitHub services governed by the GitHub Data Protection Agreement' (Enterprise customers); not expressly assigned to individual plans without a DPA. No separate list reference found for individual plans (reference to Privacy Statement q11).
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- Student
- According to q4, the list applies to 'GitHub services governed by the GitHub Data Protection Agreement' (Enterprise customers); not expressly assigned to individual plans without a DPA. No separate list reference found for individual plans (reference to Privacy Statement q11).
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- Pro
- According to q4, the list applies to 'GitHub services governed by the GitHub Data Protection Agreement' (Enterprise customers); not expressly assigned to individual plans without a DPA. No separate list reference found for individual plans (reference to Privacy Statement q11).
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- Pro+
- According to q4, the list applies to 'GitHub services governed by the GitHub Data Protection Agreement' (Enterprise customers); not expressly assigned to individual plans without a DPA. No separate list reference found for individual plans (reference to Privacy Statement q11).
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- Max
- According to q4, the list applies to 'GitHub services governed by the GitHub Data Protection Agreement' (Enterprise customers); not expressly assigned to individual plans without a DPA. No separate list reference found for individual plans (reference to Privacy Statement q11).
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- Business
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- GitHub subsidiaries as per the list: GitHub Australia Pty Ltd, GitHub BV (NL), GitHub Canada ULC, GitHub Germany GmbH, GitHub India Pty Ltd, npm Inc, Semmle Inc
- Enterprise
- Third-party providers as per the list (as retrieved 2026-10-07): Amazon Web Services Inc (AWS) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States United States; Anthropic PBC AI Inference and AI Services United States United States; Cerebras Systems Inc. AI Inference and AI Services United States United States; Cloudflare Content delivery service United States United States; DataDome Solutions, Inc. Security management United States, France United States; Elasticsearch, Inc. Cloud Hosted Infrastructure United States United States; Fastly Content delivery service United States United States; Fireworks AI AI Inference and AI Services United States, Germany, Iceland United States; FullStory, Inc. Customer support ticketing analysis United States United States; Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore United States; Hewlett-Packard Limited Cloud Hosted Infrastructure United States United States; LambdaTest Cloud Hosted Infrastructure United States United States; Microsoft (Azure) Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services United States, Canada, Chile, Mexico United States; Microsoft (Azure) Cognitive Services and customer support ticketing analysis United States United States; Microsoft Technical Services United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom United States; Moveworks Customer support ticketing analysis United States United States; NexMo Inc (aka Vonage) SMS notification provider for 2 Factor Authentication United States United States; Obsidian Security Security management United States United States; OpenAI AI Inference and AI Services United States United States; Oracle America, Inc. Cloud Hosted Infrastructure United States United States; Pusher Building and managing real-time infrastructure for web and mobile applications United States United States; Tines Automation Inc. Security management United States United States; Twilio (SendGrid) SMS notification provider for 2 Factor Authentication United States United States; xAI AI Inference and AI Services United States United States; Zendesk Customer support ticketing system United States United States
- GitHub subsidiaries as per the list: GitHub Australia Pty Ltd, GitHub BV (NL), GitHub Canada ULC, GitHub Germany GmbH, GitHub India Pty Ltd, npm Inc, Semmle Inc
Windsurf- Free
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Pro
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Max
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Teams
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Enterprise
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Free
Retention
- differs by tool
- GitHub Copilot
- not publicly documentedFree, Student, Pro, Pro+, Max
- Default settings according to q1: access…Business, Enterprise
- WindsurfDPAall 5 plans
- GitHub Copilot
- Freenot publicly documented: q1 states default retention only for Business/Enterprise ('The default settings for Copilot Business and Enterprise Customers are as follows'); no period for individual plans on the retrieved pages. Copilot Trust Center FAQ (q16): GitHub uses Copilot data from individual subscribers "for all the operational purposes described above for Business/Enterprise subscribers"; the FAQ gives no period for individual plans; Feedback Data "is retained as long as necessary".
- Studentnot publicly documented: q1 states default retention only for Business/Enterprise ('The default settings for Copilot Business and Enterprise Customers are as follows'); no period for individual plans on the retrieved pages. Copilot Trust Center FAQ (q16): GitHub uses Copilot data from individual subscribers "for all the operational purposes described above for Business/Enterprise subscribers"; the FAQ gives no period for individual plans; Feedback Data "is retained as long as necessary".
- Pronot publicly documented: q1 states default retention only for Business/Enterprise ('The default settings for Copilot Business and Enterprise Customers are as follows'); no period for individual plans on the retrieved pages. Copilot Trust Center FAQ (q16): GitHub uses Copilot data from individual subscribers "for all the operational purposes described above for Business/Enterprise subscribers"; the FAQ gives no period for individual plans; Feedback Data "is retained as long as necessary".
- Pro+not publicly documented: q1 states default retention only for Business/Enterprise ('The default settings for Copilot Business and Enterprise Customers are as follows'); no period for individual plans on the retrieved pages. Copilot Trust Center FAQ (q16): GitHub uses Copilot data from individual subscribers "for all the operational purposes described above for Business/Enterprise subscribers"; the FAQ gives no period for individual plans; Feedback Data "is retained as long as necessary".
- Maxnot publicly documented: q1 states default retention only for Business/Enterprise ('The default settings for Copilot Business and Enterprise Customers are as follows'); no period for individual plans on the retrieved pages. Copilot Trust Center FAQ (q16): GitHub uses Copilot data from individual subscribers "for all the operational purposes described above for Business/Enterprise subscribers"; the FAQ gives no period for individual plans; Feedback Data "is retained as long as necessary".
- BusinessDefault settings according to q1: access via IDE (chat and code completions): prompts and suggestions "Not retained"; User Engagement Data two years; Feedback Data "as long as needed for its intended purpose". All other access routes (including github.com, Mobile, CLI): prompts and suggestions 28 days; User Engagement Data two years. DPA (October 2025 version), Section 8: after the end of the services, GitHub deletes the Customer Personal Data or returns it at the customer's choice and deletes existing copies "in accordance with our retention and deletion policy" (q13). Unlike q1, the Copilot Trust Center FAQ (q16) assigns Copilot CLI to IDE access: inputs and outputs "Not retained by default" (exception: time-limited retention in the event of confirmed violations of the Acceptable Use Policies or Terms of Service); other access: "Retained for up to 28 days by default".
- EnterpriseDefault settings according to q1: access via IDE (chat and code completions): prompts and suggestions "Not retained"; User Engagement Data two years; Feedback Data "as long as needed for its intended purpose". All other access routes (including github.com, Mobile, CLI): prompts and suggestions 28 days; User Engagement Data two years. DPA (October 2025 version), Section 8: after the end of the services, GitHub deletes the Customer Personal Data or returns it at the customer's choice and deletes existing copies "in accordance with our retention and deletion policy" (q13). Unlike q1, the Copilot Trust Center FAQ (q16) assigns Copilot CLI to IDE access: inputs and outputs "Not retained by default" (exception: time-limited retention in the event of confirmed violations of the Acceptable Use Policies or Terms of Service); other access: "Retained for up to 28 days by default".
Windsurf- FreeDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. Without opt-out, ZDR with model providers is not committed; specific retention periods for prompts and code not publicly documented.
- ProDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented.
- MaxDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented.
- TeamsDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented.
- EnterpriseDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. Specific retention periods for prompts and code in Enterprise agreements not publicly documented.
Price
- differs by tool
- GitHub Copilot
- 0 USDFree, Student
- 10 USD/moPro
- 39 USD/moPro+
- 100 USD/moMax
- 19 USD/user/moBusiness
- 39 USD/user/moEnterprise
- Windsurf
- 0 USD/moFree
- 20 USD/moPro
- 200 USD/moMax
- 80 USD/mo… (further prices in the details)Teams
- customEnterprise
- GitHub Copilot
- Free
0 USD (q2)
- Student
0 USD for verified students (q2)
- Pro
10 USD/month (q2; free of charge for some user groups)
- Pro+
39 USD/month (q2)
- Max
100 USD/month (q2)
- Business
19 USD per assigned seat/month (q2)
- Enterprise
39 USD per assigned seat/month (q2)
Windsurf- Free
0 USD per month (pricing page)
- Pro
20 USD per month (pricing page, no information on taxes); extra usage at API pricing. Quotas refresh daily and weekly (FAQ).
- Max
200 USD per month (pricing page, no information on taxes); extra usage at API pricing.
- Teams
80 USD per month for the team plan plus 40 USD per month per full dev seat (pricing page, no information on taxes); up to 200 users.
- Enterprise
Price on request (pricing page: "Let's talk")
- Free
- GitHub Copilotyesall 7 plans
- Windsurfyesall 5 plans
- GitHub Copilot
- Free
yes (limited: according to q2, an allowance of GitHub AI Credits, automatic model selection; according to q1, 2000 completions and 50 chat requests)
- Student
yes (allowance of GitHub AI Credits, automatic model selection, without third-party agents; q2)
- Pro
yes (base 1,000 AI Credits; q2)
- Pro+
yes (base 3,900 AI Credits, access to premium models; q2)
- Max
yes (base 10,000 AI Credits, priority access to premium models; q2)
- Business
yes (1,900 AI Credits per user/month, access to premium models; q2)
- Enterprise
yes (3,900 AI Credits per user/month, priority access to premium models; q2; requires GitHub Enterprise Cloud)
Windsurf- Free
yes (light quota for agents, limited model availability, unlimited inline edits and Tab completions)
- Pro
yes (Free plus higher quotas with frontier models from OpenAI, Claude, Gemini and SpaceXAI as well as open-source models, full model availability, SWE-2, cloud agents (Devin Cloud), extra usage at API pricing)
- Max
yes (Pro plus significantly higher quotas)
- Teams
yes (Pro plus up to 200 users, sharing and collaboration, centralised billing, admin dashboard with analytics, priority support; according to the FAQ, Devin Desktop only with a full seat, each full seat with 40 USD of usage per month across all Devin products)
- Enterprise
yes (highest priority support, dedicated account management, SAML/OIDC SSO, centralised enterprise admin controls, teamspace isolation, dedicated deployment option or deployment in the customer's VPC, custom terms)
- Free
Evidence
- GitHub Copilot13 sources
- Windsurf8 sources
- GitHub Copilot
- GitHub Copilot: Plans & pricing incl. FAQ (Privacy, Retention, Training)Pricing page / provider FAQ, retrieved 18 Oct 2026
- Plans for GitHub Copilot (GitHub Docs)Official documentation, retrieved 14 Oct 2026
- Hosting of models for GitHub Copilot (GitHub Docs)Official documentation, retrieved 18 Oct 2026
- GitHub SubprocessorsSub-processor list, retrieved 14 Oct 2026
- About storage of your data with data residency (GHE.com)Official documentation, retrieved 14 Oct 2026
- GitHub Copilot with data residencyOfficial documentation, retrieved 14 Oct 2026
- About GitHub Enterprise Cloud with data residencyOfficial documentation, retrieved 14 Oct 2026
- Resources for getting approval of GitHub CopilotOfficial documentation, retrieved 14 Oct 2026
- GitHub General Privacy Statement (effective 2026-04-27)Privacy notices, retrieved 14 Oct 2026
- GitHub Data Protection Agreement (DPA), version October 2025DPA, retrieved 14 Oct 2026
- Managing GitHub Copilot policies as an individual subscriber (GitHub Docs)Documentation, retrieved 18 Oct 2026
- GitHub Copilot Trust Center: FAQ (Privacy, Security, Commercial)Trust Center / provider FAQ, retrieved 18 Oct 2026
- Access GitHub Copilot for free as a student (GitHub Docs)Official documentation, retrieved 18 Oct 2026
Windsurf- Plans and Pricing (windsurf.com/pricing redirects here)Pricing page, retrieved 18 Oct 2026
- Docs: Devin Desktop FAQ (transition from Windsurf)Documentation, retrieved 18 Oct 2026
- Platform Terms of Service (Last updated: 2026-06-30)Terms and conditions, retrieved 18 Oct 2026
- Enterprise Terms of Service (Last updated: 2026-06-08)Terms and conditions, retrieved 18 Oct 2026
- Data Processing Addendum (Last updated: 2026-07-23, with sub-processor list in Appendix C)DPA, retrieved 18 Oct 2026
- Privacy Policy (Last updated: 2026-03-09)Privacy notice, retrieved 18 Oct 2026
- Docs: Security at Cognition (windsurf.com/security redirects here)Documentation, retrieved 18 Oct 2026
- Docs: FedRAMP Security Admin Guide (Devin Desktop)Documentation, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
No guarantee of accuracy, not legal advice. Each entry is valid as of the date shown. Open points are listed on the detail pages.
More comparisons
GitHub Copilot compared with
Individual pages: GitHub Copilot, Windsurf. All tools in the category: Software development.