JetBrains AI Assistant vs. Windsurf: data protection per plan

yes (according to the AI terms of use, the Data Processing Addendum forms part of the terms; online version, effective upon order or quote request)

yes (according to the AI terms of use, the Data Processing Addendum forms part of the terms; online version, effective upon order or quote request)

yes (according to the AI terms of use, the Data Processing Addendum forms part of the terms, which apply to legal and natural persons alike; online version, effective upon order or quote request)

yes (according to the AI terms of use, the Data Processing Addendum forms part of the terms, which apply to legal and natural persons alike; online version, effective upon order or quote request)

yes (according to the AI terms of use, the Data Processing Addendum forms part of the terms; online version, effective upon order or quote request)

yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)

yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)

yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)

yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)

yes (Enterprise Terms 4.3: the Data Processing Addendum at cognition.com/dpa is incorporated into the agreement; EU SCCs Module Two/Three, UK Addendum)

AI terms of use (Version 2.1) Section 5c: JetBrains undertakes not to use inputs, data, outputs and suggestions to train language models that generate code, text or other data from which this content could be extracted, unless the customer expressly consents. AI subcontractors must undertake not to use data for training to at least the same extent (5e). Help: detailed data sharing (including the complete communication with the LLM) 'is disabled by default'. Product Data Collection Notice (Version 1.6, 2026-07-07): 'Detailed code-related data can be used for product improvement and training AI models'; default setting by IDE licence, not by AI plan: non-commercial licence – collection by default on the basis of legitimate interest, opt-out in the product settings; commercial individual licence, trial, EAP – only with explicit consent; organisational licence – not allowed by default, only after enablement by administrators or a company contract with JetBrains.

AI terms of use (Version 2.1) Section 5c: JetBrains undertakes not to use inputs, data, outputs and suggestions to train language models that generate code, text or other data from which this content could be extracted, unless the customer expressly consents. AI subcontractors must undertake not to use data for training to at least the same extent (5e). Help: detailed data sharing (including the complete communication with the LLM) 'is disabled by default'. Product Data Collection Notice (Version 1.6, 2026-07-07): 'Detailed code-related data can be used for product improvement and training AI models'; default setting by IDE licence, not by AI plan: non-commercial licence – collection by default on the basis of legitimate interest, opt-out in the product settings; commercial individual licence, trial, EAP – only with explicit consent; organisational licence – not allowed by default, only after enablement by administrators or a company contract with JetBrains.

AI terms of use (Version 2.1) Section 5c: JetBrains undertakes not to use inputs, data, outputs and suggestions to train language models that generate code, text or other data from which this content could be extracted, unless the customer expressly consents. AI subcontractors must undertake not to use data for training to at least the same extent (5e). Help: detailed data sharing (including the complete communication with the LLM) 'is disabled by default'. Product Data Collection Notice (Version 1.6, 2026-07-07): 'Detailed code-related data can be used for product improvement and training AI models'; default setting by IDE licence, not by AI plan: non-commercial licence – collection by default on the basis of legitimate interest, opt-out in the product settings; commercial individual licence, trial, EAP – only with explicit consent; organisational licence – not allowed by default, only after enablement by administrators or a company contract with JetBrains.

AI terms of use (Version 2.1) Section 5c: JetBrains undertakes not to use inputs, data, outputs and suggestions to train language models that generate code, text or other data from which this content could be extracted, unless the customer expressly consents. AI subcontractors must undertake not to use data for training to at least the same extent (5e). Help: detailed data sharing (including the complete communication with the LLM) 'is disabled by default'. Product Data Collection Notice (Version 1.6, 2026-07-07): 'Detailed code-related data can be used for product improvement and training AI models'; default setting by IDE licence, not by AI plan: non-commercial licence – collection by default on the basis of legitimate interest, opt-out in the product settings; commercial individual licence, trial, EAP – only with explicit consent; organisational licence – not allowed by default, only after enablement by administrators or a company contract with JetBrains.

AI terms of use (Version 2.1) Section 5c: JetBrains undertakes not to use inputs, data, outputs and suggestions to train language models that generate code, text or other data from which this content could be extracted, unless the customer expressly consents. AI subcontractors must undertake not to use data for training to at least the same extent (5e). Help: detailed data sharing (including the complete communication with the LLM) 'is disabled by default'. Product Data Collection Notice (Version 1.6, 2026-07-07): 'Detailed code-related data can be used for product improvement and training AI models'; default setting by IDE licence, not by AI plan: non-commercial licence – collection by default on the basis of legitimate interest, opt-out in the product settings; commercial individual licence, trial, EAP – only with explicit consent; organisational licence – not allowed by default, only after enablement by administrators or a company contract with JetBrains.

Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. An opt-out is only available on paid plans ("If you subscribe to a paid Service Tier, you may opt out of this use"); no opt-out is documented for Free. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.

Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. Default according to the documentation: training enabled, opt-out at any time in the Data Controls settings. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.

Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. Default according to the documentation: training enabled, opt-out at any time in the Data Controls settings. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.

Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. On the Teams plan, only an administrator can exercise the opt-out. Default according to the documentation: training enabled. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.

Enterprise Terms (as of 2026-06-08) 3.3: Cognition does not use, or permit any third party to use, Customer Data to train AI models without the customer's express prior written consent; Usage Data may be used for internal analytics. Documentation: "If you are an Enterprise customer, we will never train on your data without your express prior written consent." DPA (as of 2026-07-23) section 4: sub-processors are subject to equivalent restrictions.

'Third-Party Services' (Version 3.15, effective from 2026-09-30), section on AI providers, names data centre locations: OpenAI (US), Google (EU, US and Asia), Anthropic (US), xAI (US), Baseten (US, UK), Tavily (US), Nebius (France, Spain, US). Depending on the service, configuration, model and route, one or more of these providers may process data; JetBrains' own models run on JetBrains infrastructure (location not stated). A selectable EU region for AI requests is not documented. Product Data Collection Notice: collected usage data including detailed code-related data remains stored in the EEA.

'Third-Party Services' (Version 3.15, effective from 2026-09-30), section on AI providers, names data centre locations: OpenAI (US), Google (EU, US and Asia), Anthropic (US), xAI (US), Baseten (US, UK), Tavily (US), Nebius (France, Spain, US). Depending on the service, configuration, model and route, one or more of these providers may process data; JetBrains' own models run on JetBrains infrastructure (location not stated). A selectable EU region for AI requests is not documented. Product Data Collection Notice: collected usage data including detailed code-related data remains stored in the EEA.

'Third-Party Services' (Version 3.15, effective from 2026-09-30), section on AI providers, names data centre locations: OpenAI (US), Google (EU, US and Asia), Anthropic (US), xAI (US), Baseten (US, UK), Tavily (US), Nebius (France, Spain, US). Depending on the service, configuration, model and route, one or more of these providers may process data; JetBrains' own models run on JetBrains infrastructure (location not stated). A selectable EU region for AI requests is not documented. Product Data Collection Notice: collected usage data including detailed code-related data remains stored in the EEA.

'Third-Party Services' (Version 3.15, effective from 2026-09-30), section on AI providers, names data centre locations: OpenAI (US), Google (EU, US and Asia), Anthropic (US), xAI (US), Baseten (US, UK), Tavily (US), Nebius (France, Spain, US). Depending on the service, configuration, model and route, one or more of these providers may process data; JetBrains' own models run on JetBrains infrastructure (location not stated). A selectable EU region for AI requests is not documented. Product Data Collection Notice: collected usage data including detailed code-related data remains stored in the EEA.

'Third-Party Services' (Version 3.15, effective from 2026-09-30), section on AI providers, names data centre locations: OpenAI (US), Google (EU, US and Asia), Anthropic (US), xAI (US), Baseten (US, UK), Tavily (US), Nebius (France, Spain, US). Depending on the service, configuration, model and route, one or more of these providers may process data; JetBrains' own models run on JetBrains infrastructure (location not stated). A selectable EU region for AI requests is not documented. Product Data Collection Notice: collected usage data including detailed code-related data remains stored in the EEA. For 'AI Enterprise (powered by OpenAI/Google/Anthropic)', according to the service provider list only that one provider is involved in each case.

DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.

DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.

DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.

DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.

Standard SaaS according to DPA Appendix C (as of 2026-07-23) with sub-processors in the United States, support workflow in India. Pricing page: Enterprise with "Dedicated deployment option" and deployment in the customer's own VPC; documentation: FedRAMP deployment on AWS GovCloud. Regions of the dedicated or VPC deployment not publicly documented; an EU region is not documented.

• OpenAI (GPT models; data centre location according to 'Third-Party Services': US)
• Google (Gemini models; EU, US and Asia)
• AWS (Amazon Bedrock models; according to the service provider list; not listed as an AI provider in 'Third-Party Services')
• Anthropic (Claude models; directly or via Amazon Bedrock; US)
• SpaceXAI (Grok models; listed in 'Third-Party Services' as xAI, US)
• Models operated by JetBrains itself (Mellum, Mellum2 as well as Qwen3.6-27B, Qwen3-Embedding-4B, Qwen3-Reranker-0.6B from Alibaba Cloud, other open-source models): according to the list, run on JetBrains infrastructure; inputs and outputs are not sent to the model developers
• According to 'Third-Party Services', also Baseten (US, UK), Tavily (US) and Nebius (France, Spain, US) as well as unnamed AI inference intermediaries and optimisation providers

• OpenAI (GPT models; data centre location according to 'Third-Party Services': US)
• Google (Gemini models; EU, US and Asia)
• AWS (Amazon Bedrock models; according to the service provider list; not listed as an AI provider in 'Third-Party Services')
• Anthropic (Claude models; directly or via Amazon Bedrock; US)
• SpaceXAI (Grok models; listed in 'Third-Party Services' as xAI, US)
• Models operated by JetBrains itself (Mellum, Mellum2 as well as Qwen3.6-27B, Qwen3-Embedding-4B, Qwen3-Reranker-0.6B from Alibaba Cloud, other open-source models): according to the list, run on JetBrains infrastructure; inputs and outputs are not sent to the model developers
• According to 'Third-Party Services', also Baseten (US, UK), Tavily (US) and Nebius (France, Spain, US) as well as unnamed AI inference intermediaries and optimisation providers

• OpenAI (GPT models; data centre location according to 'Third-Party Services': US)
• Google (Gemini models; EU, US and Asia)
• AWS (Amazon Bedrock models; according to the service provider list; not listed as an AI provider in 'Third-Party Services')
• Anthropic (Claude models; directly or via Amazon Bedrock; US)
• SpaceXAI (Grok models; listed in 'Third-Party Services' as xAI, US)
• Models operated by JetBrains itself (Mellum, Mellum2 as well as Qwen3.6-27B, Qwen3-Embedding-4B, Qwen3-Reranker-0.6B from Alibaba Cloud, other open-source models): according to the list, run on JetBrains infrastructure; inputs and outputs are not sent to the model developers
• According to 'Third-Party Services', also Baseten (US, UK), Tavily (US) and Nebius (France, Spain, US) as well as unnamed AI inference intermediaries and optimisation providers

• OpenAI (GPT models; data centre location according to 'Third-Party Services': US)
• Google (Gemini models; EU, US and Asia)
• AWS (Amazon Bedrock models; according to the service provider list; not listed as an AI provider in 'Third-Party Services')
• Anthropic (Claude models; directly or via Amazon Bedrock; US)
• SpaceXAI (Grok models; listed in 'Third-Party Services' as xAI, US)
• Models operated by JetBrains itself (Mellum, Mellum2 as well as Qwen3.6-27B, Qwen3-Embedding-4B, Qwen3-Reranker-0.6B from Alibaba Cloud, other open-source models): according to the list, run on JetBrains infrastructure; inputs and outputs are not sent to the model developers
• According to 'Third-Party Services', also Baseten (US, UK), Tavily (US) and Nebius (France, Spain, US) as well as unnamed AI inference intermediaries and optimisation providers

• OpenAI (GPT models; data centre location according to 'Third-Party Services': US)
• Google (Gemini models; EU, US and Asia)
• AWS (Amazon Bedrock models; according to the service provider list; not listed as an AI provider in 'Third-Party Services')
• Anthropic (Claude models; directly or via Amazon Bedrock; US)
• SpaceXAI (Grok models; listed in 'Third-Party Services' as xAI, US)
• Models operated by JetBrains itself (Mellum, Mellum2 as well as Qwen3.6-27B, Qwen3-Embedding-4B, Qwen3-Reranker-0.6B from Alibaba Cloud, other open-source models): according to the list, run on JetBrains infrastructure; inputs and outputs are not sent to the model developers
• According to 'Third-Party Services', also Baseten (US, UK), Tavily (US) and Nebius (France, Spain, US) as well as unnamed AI inference intermediaries and optimisation providers

• Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
• Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
• Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
• Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)

• Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
• Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
• Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
• Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)

• Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
• Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
• Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
• Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)

• Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
• Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
• Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
• Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)

• Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
• Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
• Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
• Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)

0 EUR (pricing page and help: 'Free'; 3 AI Credits per month)

Pricing page (country Germany, individual use; retrieved 2026-10-18): 10 EUR per user per month or 100 EUR per user per year net (11.90 or 119 EUR incl. 19 % VAT; according to the page, the tax rate depends on country, VAT ID and purchase method). Organisations: the pricing page no longer shows an AI Pro licence (only AI Credits and Air Governance); help, tab 'Organizations (per-user model)': 20 USD with 20 AI Credits per 30 days, billing period of the price not stated.

Pricing page (country Germany, individual use; retrieved 2026-10-18): 30 EUR per user per month or 300 EUR per user per year net (35.70 or 357 EUR incl. 19 % VAT); 35 monthly AI Credits.

Pricing page when retrieved on 2026-10-08 (country Germany): business 60 EUR per month or 600 EUR per year net (71.40 or 714 EUR incl. 19 % VAT); when retrieved on 2026-10-18 no longer listed for organisations (only AI Credits and Air Governance). Help, tab 'Organizations (per-user model)': 60 USD with 70 AI Credits per 30 days, billing period of the price not stated.

Help, tab 'Organizations (per-user model)': 60 USD, AI Credits 'On par with AI Ultimate quota, or higher'; billing period not stated. The pricing page for organisations (retrieved 2026-10-18) lists no 'AI Enterprise' plan but AI Credits at API prices as well as Air Governance Basic (free), Business (20 USD per seat per month) and Enterprise (custom).

0 USD per month (pricing page)

20 USD per month (pricing page, no information on taxes); extra usage at API pricing. Quotas refresh daily and weekly (FAQ).

200 USD per month (pricing page, no information on taxes); extra usage at API pricing.

80 USD per month for the team plan plus 40 USD per month per full dev seat (pricing page, no information on taxes); up to 200 users.

Price on request (pricing page: "Let's talk")

yes (3 AI Credits per 30 days; no top-up; according to the help, only in IDEs from version 2025.1)

yes (according to the help, 10 AI Credits per 30 days with a personal licence, 20 with an organisation licence; top-up available, top-up credits valid for 12 months)

yes (according to the help, 35 AI Credits per 30 days with a personal licence, list price 30 USD; top-up available, top-up credits valid for 12 months)

yes (according to the help, 70 AI Credits per 30 days with an organisation licence, list price 60 USD; the organisation's credits can flow into a shared pool via the JetBrains Central Console; top-up available)

yes (according to the help, quota at least at the level of AI Ultimate, exact credits not stated; operation either via JetBrains AI or with a single provider: OpenAI, Google or Anthropic)

yes (light quota for agents, limited model availability, unlimited inline edits and Tab completions)

yes (Free plus higher quotas with frontier models from OpenAI, Claude, Gemini and SpaceXAI as well as open-source models, full model availability, SWE-2, cloud agents (Devin Cloud), extra usage at API pricing)

yes (Pro plus significantly higher quotas)

yes (Pro plus up to 200 users, sharing and collaboration, centralised billing, admin dashboard with analytics, priority support; according to the FAQ, Devin Desktop only with a full seat, each full seat with 40 USD of usage per month across all Devin products)

yes (highest priority support, dedicated account management, SAML/OIDC SSO, centralised enterprise admin controls, teamspace isolation, dedicated deployment option or deployment in the customer's VPC, custom terms)