Replit vs. Windsurf: data protection per plan
Replit (4 plans) and Windsurf (5 plans) side by side: DPA, training on inputs, hosting and data retention per plan, based on the providers’ public documents. Without rating.
Last updated: (latest review date of the tools shown)
At a glance
Each value is listed with the plans it applies to. Pick a tier to see only plans of that tier; if plans are chosen in the plan comparison below, the table shows exactly those.
All plans: each value is listed with the plans it applies to.
| Feature | Replit | Windsurf |
|---|---|---|
| Provider based in | Replit, Inc., 1001 E Hillsdale Blvd, Suite 400, Foster City, CA 94404, USA | Cognition AI, Inc., 550 Third Street, San Francisco, CA 94107, USA |
| Plans recorded | 4 | 5 |
| Hosting | US only: Startermixed: Core, Pro, Enterprise | US only: Free, Pro, Max, Teamsnot documented: Enterprise |
| Training on inputs | not documented: Starter, Coreopt-out available: Prono: Enterprise | yes: Freeopt-out available: Pro, Max, Teamsno: Enterprise |
| DPA | not documented: Starter, Coreyes: Pro, Enterprise | yes: all 5 plans |
| As of | 18 Oct 2026 | 18 Oct 2026 |
Plans compared
Comparing: Replit Pro vs. Windsurf Teams
| Feature | ReplitPro | WindsurfTeams |
|---|---|---|
| yes | yes | |
| Details: DPA available | yes (DPA forms part of the Replit Commercial Agreement; EU SCCs Module Two/Three, UK Addendum; general authorisation for sub-processors) Provider’s DPA | yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum) Provider’s DPA |
| opt-out available | opt-out available | |
| Details: Training on inputs | Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. Documentation 'Model improvement' (q7): opt-out from the use of content for model development only for Pro users (Settings > Personalization > Model Improvement); for Enterprise, Replit does not use customer content for training. Default setting not documented. According to the documentation, the opt-out applies only to new content and does not delete any data; processing for operation, security and troubleshooting continues. | Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. On the Teams plan, only an administrator can exercise the opt-out. Default according to the documentation: training enabled. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law. |
| differs by plan | mixed | US only |
| Details: Data residency | Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Pro: workspace and publishing region selectable (including EU). | DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented. |
| list available | list available | |
| Details: List published |
|
|
| differs by plan | DPA: customer may request return or… | DPA |
| Details: Data retention | DPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': paid subscriptions are not terminated for inactivity. Pricing page: database rollback up to 28 days. | DPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented. |
| differs by plan | 100 USD/mo… (further prices in the details) | 80 USD/mo… (further prices in the details) |
| Details: Price | 100 USD per month or 90 USD per month with annual payment (pricing page; plus taxes depending on location). The pricing page shows further Pro tiers at 225, 440, 850 and 2,050 USD per month (with annual payment 215, 425, 825 and 2,000 USD per month); monthly credits according to the FAQ 'starting at $100 for Pro'. Additional usage under Effort-Based Pricing (pay-as-you-go) or via credit packs; budgets can be set as a hard cap. | 80 USD per month for the team plan plus 40 USD per month per full dev seat (pricing page, no information on taxes); up to 200 users. |
| yes | yes | |
| Details: AI features included | yes (10 parallel Agents, USD 100 credit for the most powerful models, up to 15 collaborators, premium support) | yes (Pro plus up to 200 users, sharing and collaboration, centralised billing, admin dashboard with analytics, priority support; according to the FAQ, Devin Desktop only with a full seat, each full seat with 40 USD of usage per month across all Devin products) |
| 11 sources | 6 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- Replit Proyes
- Windsurf Teamsyes
- Replit Pro
yes (DPA forms part of the Replit Commercial Agreement; EU SCCs Module Two/Three, UK Addendum; general authorisation for sub-processors)
Provider’s DPAWindsurf Teamsyes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA
Training
- Replit Proopt-out available
- Windsurf Teamsopt-out available
- Replit Pro
Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. Documentation 'Model improvement' (q7): opt-out from the use of content for model development only for Pro users (Settings > Personalization > Model Improvement); for Enterprise, Replit does not use customer content for training. Default setting not documented. According to the documentation, the opt-out applies only to new content and does not delete any data; processing for operation, security and troubleshooting continues.
Windsurf TeamsPlatform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. On the Teams plan, only an administrator can exercise the opt-out. Default according to the documentation: training enabled. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
Hosting
- differs by plan
- Replit Promixed
- Windsurf TeamsUS only
- Replit Pro
Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Pro: workspace and publishing region selectable (including EU).
Windsurf TeamsDPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
Sub-processors
- Replit Prolist available
- Windsurf Teamslist available
- Replit Pro
- Cloud/hosting: Google (cloud infrastructure and AI models), Microsoft Azure, Cloudflare, HashiCorp Cloud, Neon (database) – all USA
- AI models and infrastructure: Anthropic, OpenAI, OpenRouter, Baseten, Fireworks AI, Parallel Web Systems, Firecrawl, Anima App – all USA
- Others (extract): Stripe, Orb, Verifi, Clazar (payment/billing), Clerk, Stytch, WorkOS (identity/SSO), Datadog, Sentry, Grafana Labs (monitoring), Zendesk, Common Room, Civilized Discourse Construction Kit, IntouchCX (Canada), OWND ApS/Parahelp (support), analytics/marketing services (including Amplitude, Segment, HubSpot, ZoomInfo – USA)
- Full list (around 50 entries) see subprocessorUrl; all except IntouchCX (Canada) located in the USA
Windsurf Teams- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
Retention
- differs by plan
- Replit ProDPA: customer may request return or…
- Windsurf TeamsDPA
- Replit ProDPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': paid subscriptions are not terminated for inactivity. Pricing page: database rollback up to 28 days.Windsurf TeamsDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented.
Price
- differs by plan
- Replit Pro100 USD/mo… (further prices in the details)
- Windsurf Teams80 USD/mo… (further prices in the details)
- Replit Pro
100 USD per month or 90 USD per month with annual payment (pricing page; plus taxes depending on location). The pricing page shows further Pro tiers at 225, 440, 850 and 2,050 USD per month (with annual payment 215, 425, 825 and 2,000 USD per month); monthly credits according to the FAQ 'starting at $100 for Pro'. Additional usage under Effort-Based Pricing (pay-as-you-go) or via credit packs; budgets can be set as a hard cap.
Windsurf Teams80 USD per month for the team plan plus 40 USD per month per full dev seat (pricing page, no information on taxes); up to 200 users.
- Replit Proyes
- Windsurf Teamsyes
- Replit Pro
yes (10 parallel Agents, USD 100 credit for the most powerful models, up to 15 collaborators, premium support)
Windsurf Teamsyes (Pro plus up to 200 users, sharing and collaboration, centralised billing, admin dashboard with analytics, priority support; according to the FAQ, Devin Desktop only with a full seat, each full seat with 40 USD of usage per month across all Devin products)
Evidence
- Replit Pro11 sources
- Windsurf Teams6 sources
- Replit Pro
- PricingPricing page, retrieved 18 Oct 2026
- SecurityTrust Center, retrieved 14 Oct 2026
- Privacy Policy (as of 2026-08-03)Privacy notice, retrieved 14 Oct 2026
- Data Processing Agreement (as of 2026-04-01)DPA, retrieved 18 Oct 2026
- Subprocessors (as of August 2026)Sub-processor list, retrieved 14 Oct 2026
- Terms of Service (as of 2026-08-03)Terms and conditions, retrieved 18 Oct 2026
- Docs: Model improvementDocumentation, retrieved 18 Oct 2026
- Docs: GeographyDocumentation, retrieved 18 Oct 2026
- Replit's Trust CenterTrust Center, retrieved 18 Oct 2026
- Docs: Account InactivityDocumentation, retrieved 18 Oct 2026
- Docs: Deleting your dataDocumentation, retrieved 18 Oct 2026
Windsurf Teams- Plans and Pricing (windsurf.com/pricing redirects here)Pricing page, retrieved 18 Oct 2026
- Docs: Devin Desktop FAQ (transition from Windsurf)Documentation, retrieved 18 Oct 2026
- Platform Terms of Service (Last updated: 2026-06-30)Terms and conditions, retrieved 18 Oct 2026
- Data Processing Addendum (Last updated: 2026-07-23, with sub-processor list in Appendix C)DPA, retrieved 18 Oct 2026
- Privacy Policy (Last updated: 2026-03-09)Privacy notice, retrieved 18 Oct 2026
- Docs: Security at Cognition (windsurf.com/security redirects here)Documentation, retrieved 18 Oct 2026
| Feature | Replit | Windsurf |
|---|---|---|
| differs by tool |
| yesall 5 plans |
| Details: DPA available |
|
|
| differs by tool |
|
|
| Details: Training on inputs |
|
|
| differs by tool |
|
|
| Details: Data residency |
|
|
| list availableall 4 plans | list availableall 5 plans | |
| Details: List published |
|
|
| differs by tool | DPA: customer may request return or…all 4 plans | DPAall 5 plans |
| Details: Data retention |
|
|
| differs by tool |
|
|
| Details: Price |
|
|
| yesall 4 plans | yesall 5 plans | |
| Details: AI features included |
|
|
| 12 sources | 8 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- differs by tool
- Replit
- not publicly documentedStarter (free of charge), Core
- yesPro, Enterprise
- Windsurfyesall 5 plans
- Replit
- Starter (free of charge)
not publicly documented (the DPA forms part of the Replit Commercial Agreement; according to the Terms, this applies to Pro and Enterprise)
- Core
not publicly documented, whether included in the plan (the DPA forms part of the Replit Commercial Agreement; according to the Terms, this applies to Pro and Enterprise)
- Pro
yes (DPA forms part of the Replit Commercial Agreement; EU SCCs Module Two/Three, UK Addendum; general authorisation for sub-processors)
Provider’s DPA - Enterprise
yes (DPA forms part of the Replit Commercial Agreement)
Provider’s DPA
Windsurf- Free
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Pro
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Max
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Teams
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Enterprise
yes (Enterprise Terms 4.3: the Data Processing Addendum at cognition.com/dpa is incorporated into the agreement; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA
- Starter (free of charge)
Training
- differs by tool
- Replit
- not publicly documentedStarter (free of charge), Core
- opt-out availablePro
- noEnterprise
- Windsurf
- yesFree
- opt-out availablePro, Max, Teams
- noEnterprise
- Replit
- Starter (free of charge)
Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. Documentation 'Model improvement' (q7): opt-out from the use of content for model development only for Pro users (Settings > Personalization > Model Improvement); for Enterprise, Replit does not use customer content for training. Default setting not documented. No opt-out is documented for Starter.
- Core
Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. Documentation 'Model improvement' (q7): opt-out from the use of content for model development only for Pro users (Settings > Personalization > Model Improvement); for Enterprise, Replit does not use customer content for training. Default setting not documented. No opt-out is documented for Core.
- Pro
Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. Documentation 'Model improvement' (q7): opt-out from the use of content for model development only for Pro users (Settings > Personalization > Model Improvement); for Enterprise, Replit does not use customer content for training. Default setting not documented. According to the documentation, the opt-out applies only to new content and does not delete any data; processing for operation, security and troubleshooting continues.
- Enterprise
Documentation 'Model improvement' (q7): 'For Enterprise users, Replit does not use customer content to train its models.' Pricing page lists 'Advanced privacy controls' and 'Single-tenant environments' for Enterprise. Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service.
Windsurf- Free
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. An opt-out is only available on paid plans ("If you subscribe to a paid Service Tier, you may opt out of this use"); no opt-out is documented for Free. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Pro
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. Default according to the documentation: training enabled, opt-out at any time in the Data Controls settings. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Max
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. Default according to the documentation: training enabled, opt-out at any time in the Data Controls settings. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Teams
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. On the Teams plan, only an administrator can exercise the opt-out. Default according to the documentation: training enabled. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Enterprise
Enterprise Terms (as of 2026-06-08) 3.3: Cognition does not use, or permit any third party to use, Customer Data to train AI models without the customer's express prior written consent; Usage Data may be used for internal analytics. Documentation: "If you are an Enterprise customer, we will never train on your data without your express prior written consent." DPA (as of 2026-07-23) section 4: sub-processors are subject to equivalent restrictions.
- Starter (free of charge)
Hosting
- differs by tool
- Replit
- US onlyStarter (free of charge)
- mixedCore, Pro, Enterprise
- Windsurf
- US onlyFree, Pro, Max, Teams
- not publicly documentedEnterprise
- Replit
- Starter (free of charge)
Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Starter: no choice of region documented.
- Core
Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Core: publishing region (including EU) selectable, workspace region not.
- Pro
Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Pro: workspace and publishing region selectable (including EU).
- Enterprise
Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Enterprise: publishing region selectable and enforceable organisation-wide; the documentation names the workspace region choice only for Pro.
Windsurf- Free
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Pro
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Max
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Teams
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Enterprise
Standard SaaS according to DPA Appendix C (as of 2026-07-23) with sub-processors in the United States, support workflow in India. Pricing page: Enterprise with "Dedicated deployment option" and deployment in the customer's own VPC; documentation: FedRAMP deployment on AWS GovCloud. Regions of the dedicated or VPC deployment not publicly documented; an EU region is not documented.
- Starter (free of charge)
Sub-processors
- Replitlist availableall 4 plans
- Windsurflist availableall 5 plans
- Replit
- Starter (free of charge)
- Cloud/hosting: Google (cloud infrastructure and AI models), Microsoft Azure, Cloudflare, HashiCorp Cloud, Neon (database) – all USA
- AI models and infrastructure: Anthropic, OpenAI, OpenRouter, Baseten, Fireworks AI, Parallel Web Systems, Firecrawl, Anima App – all USA
- Others (extract): Stripe, Orb, Verifi, Clazar (payment/billing), Clerk, Stytch, WorkOS (identity/SSO), Datadog, Sentry, Grafana Labs (monitoring), Zendesk, Common Room, Civilized Discourse Construction Kit, IntouchCX (Canada), OWND ApS/Parahelp (support), analytics/marketing services (including Amplitude, Segment, HubSpot, ZoomInfo – USA)
- Full list (around 50 entries) see subprocessorUrl; all except IntouchCX (Canada) located in the USA
- Core
- Cloud/hosting: Google (cloud infrastructure and AI models), Microsoft Azure, Cloudflare, HashiCorp Cloud, Neon (database) – all USA
- AI models and infrastructure: Anthropic, OpenAI, OpenRouter, Baseten, Fireworks AI, Parallel Web Systems, Firecrawl, Anima App – all USA
- Others (extract): Stripe, Orb, Verifi, Clazar (payment/billing), Clerk, Stytch, WorkOS (identity/SSO), Datadog, Sentry, Grafana Labs (monitoring), Zendesk, Common Room, Civilized Discourse Construction Kit, IntouchCX (Canada), OWND ApS/Parahelp (support), analytics/marketing services (including Amplitude, Segment, HubSpot, ZoomInfo – USA)
- Full list (around 50 entries) see subprocessorUrl; all except IntouchCX (Canada) located in the USA
- Pro
- Cloud/hosting: Google (cloud infrastructure and AI models), Microsoft Azure, Cloudflare, HashiCorp Cloud, Neon (database) – all USA
- AI models and infrastructure: Anthropic, OpenAI, OpenRouter, Baseten, Fireworks AI, Parallel Web Systems, Firecrawl, Anima App – all USA
- Others (extract): Stripe, Orb, Verifi, Clazar (payment/billing), Clerk, Stytch, WorkOS (identity/SSO), Datadog, Sentry, Grafana Labs (monitoring), Zendesk, Common Room, Civilized Discourse Construction Kit, IntouchCX (Canada), OWND ApS/Parahelp (support), analytics/marketing services (including Amplitude, Segment, HubSpot, ZoomInfo – USA)
- Full list (around 50 entries) see subprocessorUrl; all except IntouchCX (Canada) located in the USA
- Enterprise
- Cloud/hosting: Google (cloud infrastructure and AI models), Microsoft Azure, Cloudflare, HashiCorp Cloud, Neon (database) – all USA
- AI models and infrastructure: Anthropic, OpenAI, OpenRouter, Baseten, Fireworks AI, Parallel Web Systems, Firecrawl, Anima App – all USA
- Others (extract): Stripe, Orb, Verifi, Clazar (payment/billing), Clerk, Stytch, WorkOS (identity/SSO), Datadog, Sentry, Grafana Labs (monitoring), Zendesk, Common Room, Civilized Discourse Construction Kit, IntouchCX (Canada), OWND ApS/Parahelp (support), analytics/marketing services (including Amplitude, Segment, HubSpot, ZoomInfo – USA)
- Full list (around 50 entries) see subprocessorUrl; all except IntouchCX (Canada) located in the USA
Windsurf- Free
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Pro
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Max
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Teams
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Enterprise
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Starter (free of charge)
Retention
- differs by tool
- ReplitDPA: customer may request return or…all 4 plans
- WindsurfDPAall 5 plans
- Replit
- Starter (free of charge)DPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': accounts not used within one year are considered inactive; Replit may terminate inactive accounts and delete data, for free accounts the apps are deleted.
- CoreDPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': paid subscriptions are not terminated for inactivity.
- ProDPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': paid subscriptions are not terminated for inactivity. Pricing page: database rollback up to 28 days.
- EnterpriseDPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': paid subscriptions are not terminated for inactivity.
Windsurf- FreeDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. Without opt-out, ZDR with model providers is not committed; specific retention periods for prompts and code not publicly documented.
- ProDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented.
- MaxDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented.
- TeamsDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented.
- EnterpriseDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. Specific retention periods for prompts and code in Enterprise agreements not publicly documented.
Price
- differs by tool
- Replit
- 0 USDStarter (free of charge)
- 20 USD/mo… (further prices in the details)Core
- 100 USD/mo… (further prices in the details)Pro
- customEnterprise
- Windsurf
- 0 USD/moFree
- 20 USD/moPro
- 200 USD/moMax
- 80 USD/mo… (further prices in the details)Teams
- customEnterprise
- Replit
- Starter (free of charge)
USD 0 (Starter Plan documentation; no longer listed as a separate plan on the pricing page)
- Core
20 USD per month or 18 USD per month with annual payment (pricing page; prices plus taxes depending on location). Included: 20 USD credits per month; additional usage is billed under Effort-Based Pricing (pay-as-you-go) or covered by credit packs; budgets can be set as a hard cap (pricing page, FAQ).
- Pro
100 USD per month or 90 USD per month with annual payment (pricing page; plus taxes depending on location). The pricing page shows further Pro tiers at 225, 440, 850 and 2,050 USD per month (with annual payment 215, 425, 825 and 2,000 USD per month); monthly credits according to the FAQ 'starting at $100 for Pro'. Additional usage under Effort-Based Pricing (pay-as-you-go) or via credit packs; budgets can be set as a hard cap.
- Enterprise
Individual (pricing page: 'Custom')
Windsurf- Free
0 USD per month (pricing page)
- Pro
20 USD per month (pricing page, no information on taxes); extra usage at API pricing. Quotas refresh daily and weekly (FAQ).
- Max
200 USD per month (pricing page, no information on taxes); extra usage at API pricing.
- Teams
80 USD per month for the team plan plus 40 USD per month per full dev seat (pricing page, no information on taxes); up to 200 users.
- Enterprise
Price on request (pricing page: "Let's talk")
- Starter (free of charge)
- Replityesall 4 plans
- Windsurfyesall 5 plans
- Replit
- Starter (free of charge)
yes (daily Agent credits up to a monthly limit, Lite Build, Design Canvas; no Full Build, no Plan Mode, no AI integrations)
- Core
yes (Replit Agent, AI integrations, Plan Mode; USD 20 credit for more powerful models)
- Pro
yes (10 parallel Agents, USD 100 credit for the most powerful models, up to 15 collaborators, premium support)
- Enterprise
yes (SSO/SAML, advanced privacy controls, single-tenant environments, static egress IPs)
Windsurf- Free
yes (light quota for agents, limited model availability, unlimited inline edits and Tab completions)
- Pro
yes (Free plus higher quotas with frontier models from OpenAI, Claude, Gemini and SpaceXAI as well as open-source models, full model availability, SWE-2, cloud agents (Devin Cloud), extra usage at API pricing)
- Max
yes (Pro plus significantly higher quotas)
- Teams
yes (Pro plus up to 200 users, sharing and collaboration, centralised billing, admin dashboard with analytics, priority support; according to the FAQ, Devin Desktop only with a full seat, each full seat with 40 USD of usage per month across all Devin products)
- Enterprise
yes (highest priority support, dedicated account management, SAML/OIDC SSO, centralised enterprise admin controls, teamspace isolation, dedicated deployment option or deployment in the customer's VPC, custom terms)
- Starter (free of charge)
Evidence
- Replit12 sources
- Windsurf8 sources
- Replit
- PricingPricing page, retrieved 18 Oct 2026
- SecurityTrust Center, retrieved 14 Oct 2026
- Privacy Policy (as of 2026-08-03)Privacy notice, retrieved 14 Oct 2026
- Data Processing Agreement (as of 2026-04-01)DPA, retrieved 18 Oct 2026
- Subprocessors (as of August 2026)Sub-processor list, retrieved 14 Oct 2026
- Terms of Service (as of 2026-08-03)Terms and conditions, retrieved 18 Oct 2026
- Docs: Model improvementDocumentation, retrieved 18 Oct 2026
- Docs: Starter PlanDocumentation, retrieved 14 Oct 2026
- Docs: GeographyDocumentation, retrieved 18 Oct 2026
- Replit's Trust CenterTrust Center, retrieved 18 Oct 2026
- Docs: Account InactivityDocumentation, retrieved 18 Oct 2026
- Docs: Deleting your dataDocumentation, retrieved 18 Oct 2026
Windsurf- Plans and Pricing (windsurf.com/pricing redirects here)Pricing page, retrieved 18 Oct 2026
- Docs: Devin Desktop FAQ (transition from Windsurf)Documentation, retrieved 18 Oct 2026
- Platform Terms of Service (Last updated: 2026-06-30)Terms and conditions, retrieved 18 Oct 2026
- Enterprise Terms of Service (Last updated: 2026-06-08)Terms and conditions, retrieved 18 Oct 2026
- Data Processing Addendum (Last updated: 2026-07-23, with sub-processor list in Appendix C)DPA, retrieved 18 Oct 2026
- Privacy Policy (Last updated: 2026-03-09)Privacy notice, retrieved 18 Oct 2026
- Docs: Security at Cognition (windsurf.com/security redirects here)Documentation, retrieved 18 Oct 2026
- Docs: FedRAMP Security Admin Guide (Devin Desktop)Documentation, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
No guarantee of accuracy, not legal advice. Each entry is valid as of the date shown. Open points are listed on the detail pages.
More comparisons
Replit compared with
Individual pages: Replit, Windsurf. All tools in the category: Software development.