STACKIT AI vs. Windsurf: data protection per plan
STACKIT AI (1 plan) and Windsurf (5 plans) side by side: DPA, training on inputs, hosting and data retention per plan, based on the providers’ public documents. Without rating.
Last updated: (latest review date of the tools shown)
At a glance
Each value is listed with the plans it applies to. Pick a tier to see only plans of that tier; if plans are chosen in the plan comparison below, the table shows exactly those.
All plans: each value is listed with the plans it applies to.
| Feature | STACKIT AI | Windsurf |
|---|---|---|
| Provider based in | Schwarz Digits Cloud GmbH & Co. KG, Am Campus 1, 74177 Bad Friedrichshall, Germany | Cognition AI, Inc., 550 Third Street, San Francisco, CA 94107, USA |
| Plans recorded | 1 | 5 |
| Hosting | EU option: AI Model Serving | US only: Free, Pro, Max, Teamsnot documented: Enterprise |
| Training on inputs | no: AI Model Serving | yes: Freeopt-out available: Pro, Max, Teamsno: Enterprise |
| DPA | yes: AI Model Serving | yes: all 5 plans |
| As of | 18 Oct 2026 | 18 Oct 2026 |
Plans compared
Comparing: STACKIT AI AI Model Serving vs. Windsurf Teams
| Feature | STACKIT AIAI Model Serving (usage-based) | WindsurfTeams |
|---|---|---|
| yes | yes | |
| Details: DPA available | yes (data processing agreement STACKIT Cloud Services, version 2.4.2, under Art. 28 GDPR; applies to all STACKIT Cloud Services booked under the terms of use, no product-specific annex for AI Model Serving) Provider’s DPA | yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum) Provider’s DPA |
| differs by plan | no | opt-out available |
| Details: Training on inputs | Product page: 'your data and queries are neither stored nor used to train models' (translated). Documentation FAQ: 'We do not train any models using your data.' Service specification: apart from billing-relevant data, 'no customer data whatsoever is collected or analysed' (translated). DPA section 2.3: usage data (not content) is processed, among other things, to optimise and further develop the services and is anonymised; STACKIT may use anonymised usage data for its own purposes. | Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. On the Teams plan, only an administrator can exercise the opt-out. Default according to the documentation: training enabled. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law. |
| differs by plan | EU option | US only |
| Details: Data residency | Models run in region EU01 (price table and model documentation, API endpoint '...model-serving.eu01.onstackit.cloud'). Service description section 1.2: operation in STACKIT data centres in Germany and Austria (possibly further EU states in future). DPA section 2.5: processing within the EU/EEA; outside only where expressly agreed and Art. 44–49 GDPR are met. | DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented. |
| list available | list available | |
| Details: List published |
|
|
| differs by plan | Service specification | DPA |
| Details: Data retention | Service specification (annex on exportability): customer data is not stored permanently, no backup of requests; e-mail and subject ID are stored temporarily (30 days) in the service logs; changes to authentication tokens are recorded in the STACKIT audit log (retention period not quantified there). Documentation FAQ: 'We do not store any customer data from the requests.' DPA section 10.1: deletion of customer data after the end of the contract, deletion record on request. | DPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented. |
| differs by plan | per token | 80 USD/mo… (further prices in the details) |
| Details: Price | Usage-based per 1 million tokens, region EU01 (product page, as of 2026-10-18; net prices according to terms of use section 11.3), input/output: gpt-oss 20b EUR 0.15/0.25; Gemma 4 31b, gpt-oss 120b, Llama 3.3 70B Instruct FP8, Qwen3-VL 235B (Plus) and Qwen3.8 27B EUR 0.45/0.65 each; Qwen3-VL 235B A22B (Premium) EUR 1.50/1.75. Embeddings (input only): e5 mistral 7b EUR 0.02; Qwen3 VL Embedding 8B EUR 0.08. Free trial access for 30 days after manual review of the registration (no permanently free plan). | 80 USD per month for the team plan plus 40 USD per month per full dev seat (pricing page, no information on taxes); up to 200 users. |
| yes | yes | |
| Details: AI features included | yes (chat and embedding models as shared instances via an OpenAI-compatible REST API with API key; including Qwen3-VL 235B, Qwen3.8 27B, Llama 3.3 70B, gpt-oss 120b/20b, Gemma 4 31b; tool calling, image input for some models; open-source RAG template) | yes (Pro plus up to 200 users, sharing and collaboration, centralised billing, admin dashboard with analytics, priority support; according to the FAQ, Devin Desktop only with a full seat, each full seat with 40 USD of usage per month across all Devin products) |
| 9 sources | 6 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- STACKIT AI AI Model Servingyes
- Windsurf Teamsyes
- STACKIT AI AI Model Serving
yes (data processing agreement STACKIT Cloud Services, version 2.4.2, under Art. 28 GDPR; applies to all STACKIT Cloud Services booked under the terms of use, no product-specific annex for AI Model Serving)
Provider’s DPAWindsurf Teamsyes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA
Training
- differs by plan
- STACKIT AI AI Model Servingno
- Windsurf Teamsopt-out available
- STACKIT AI AI Model Serving
Product page: 'your data and queries are neither stored nor used to train models' (translated). Documentation FAQ: 'We do not train any models using your data.' Service specification: apart from billing-relevant data, 'no customer data whatsoever is collected or analysed' (translated). DPA section 2.3: usage data (not content) is processed, among other things, to optimise and further develop the services and is anonymised; STACKIT may use anonymised usage data for its own purposes.
Windsurf TeamsPlatform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. On the Teams plan, only an administrator can exercise the opt-out. Default according to the documentation: training enabled. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
Hosting
- differs by plan
- STACKIT AI AI Model ServingEU option
- Windsurf TeamsUS only
- STACKIT AI AI Model Serving
Models run in region EU01 (price table and model documentation, API endpoint '...model-serving.eu01.onstackit.cloud'). Service description section 1.2: operation in STACKIT data centres in Germany and Austria (possibly further EU states in future). DPA section 2.5: processing within the EU/EEA; outside only where expressly agreed and Art. 44–49 GDPR are met.
Windsurf TeamsDPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
Sub-processors
- STACKIT AI AI Model Servinglist available
- Windsurf Teamslist available
- STACKIT AI AI Model Serving
- DPA Annex 2 (version 2.4.2), development, operations and consulting support for STACKIT Cloud Services as a whole: Anynines GmbH (DE), CGI Deutschland B.V. & Co. KG (DE), Cloud&Heat Technologies GmbH (DE), Exivity BV (NL), Freiheit.com Technologies GmbH (DE), Inovex GmbH (DE), ISD Feniqs GmbH (DE), Nextevolution GmbH (DE), Rewion GmbH (DE), Schwarz Digits Bulgaria EOOD (BG), Schwarz Digits IT KG (DE), Schwarz Digits Romania S.C.S. (RO), Schwarz IT S.L.U. (ES), SOCIAL BIGDATA COMUNICACION SL (ES)
- Which of these processors are actually used for AI Model Serving is not publicly documented; according to the documentation the model developers are only the source of the models (Hugging Face) and are not named as processors
Windsurf Teams- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
Retention
- differs by plan
- STACKIT AI AI Model ServingService specification
- Windsurf TeamsDPA
- STACKIT AI AI Model ServingService specification (annex on exportability): customer data is not stored permanently, no backup of requests; e-mail and subject ID are stored temporarily (30 days) in the service logs; changes to authentication tokens are recorded in the STACKIT audit log (retention period not quantified there). Documentation FAQ: 'We do not store any customer data from the requests.' DPA section 10.1: deletion of customer data after the end of the contract, deletion record on request.Windsurf TeamsDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented.
Price
- differs by plan
- STACKIT AI AI Model Servingper token
- Windsurf Teams80 USD/mo… (further prices in the details)
- STACKIT AI AI Model Serving
Usage-based per 1 million tokens, region EU01 (product page, as of 2026-10-18; net prices according to terms of use section 11.3), input/output: gpt-oss 20b EUR 0.15/0.25; Gemma 4 31b, gpt-oss 120b, Llama 3.3 70B Instruct FP8, Qwen3-VL 235B (Plus) and Qwen3.8 27B EUR 0.45/0.65 each; Qwen3-VL 235B A22B (Premium) EUR 1.50/1.75. Embeddings (input only): e5 mistral 7b EUR 0.02; Qwen3 VL Embedding 8B EUR 0.08. Free trial access for 30 days after manual review of the registration (no permanently free plan).
Windsurf Teams80 USD per month for the team plan plus 40 USD per month per full dev seat (pricing page, no information on taxes); up to 200 users.
- STACKIT AI AI Model Servingyes
- Windsurf Teamsyes
- STACKIT AI AI Model Serving
yes (chat and embedding models as shared instances via an OpenAI-compatible REST API with API key; including Qwen3-VL 235B, Qwen3.8 27B, Llama 3.3 70B, gpt-oss 120b/20b, Gemma 4 31b; tool calling, image input for some models; open-source RAG template)
Windsurf Teamsyes (Pro plus up to 200 users, sharing and collaboration, centralised billing, admin dashboard with analytics, priority support; according to the FAQ, Devin Desktop only with a full seat, each full seat with 40 USD of usage per month across all Devin products)
Evidence
- STACKIT AI AI Model Serving9 sources
- Windsurf Teams6 sources
- STACKIT AI AI Model Serving
- STACKIT AI Model Serving (product page with price table)Product page, retrieved 18 Oct 2026
- Service specification STACKIT AI Model Serving, version 1.3, valid from 18 September 2025Service description, retrieved 18 Oct 2026
- Service specification STACKIT AI Model Serving, version 1.4, valid from 6 November 2026Service description, retrieved 18 Oct 2026
- Data processing agreement STACKIT Cloud Services, version 2.4.2DPA, retrieved 18 Oct 2026
- Terms of use STACKIT Cloud, version 1.3.2, valid from 4 May 2026Terms and conditions, retrieved 18 Oct 2026
- Service description STACKIT Cloud, version 1.4, valid from 4 May 2026Service description, retrieved 18 Oct 2026
- AI Model Serving – FAQDocumentation, retrieved 18 Oct 2026
- AI Model Serving – Service descriptionDocumentation, retrieved 18 Oct 2026
- Available Shared Models of STACKIT AI Model ServingDocumentation, retrieved 18 Oct 2026
Windsurf Teams- Plans and Pricing (windsurf.com/pricing redirects here)Pricing page, retrieved 18 Oct 2026
- Docs: Devin Desktop FAQ (transition from Windsurf)Documentation, retrieved 18 Oct 2026
- Platform Terms of Service (Last updated: 2026-06-30)Terms and conditions, retrieved 18 Oct 2026
- Data Processing Addendum (Last updated: 2026-07-23, with sub-processor list in Appendix C)DPA, retrieved 18 Oct 2026
- Privacy Policy (Last updated: 2026-03-09)Privacy notice, retrieved 18 Oct 2026
- Docs: Security at Cognition (windsurf.com/security redirects here)Documentation, retrieved 18 Oct 2026
| Feature | STACKIT AI | Windsurf |
|---|---|---|
| yesonly plan | yesall 5 plans | |
| Details: DPA available |
|
|
| differs by tool | noonly plan |
|
| Details: Training on inputs |
|
|
| differs by tool | EU optiononly plan |
|
| Details: Data residency |
|
|
| list availableonly plan | list availableall 5 plans | |
| Details: List published |
|
|
| differs by tool | Service specificationonly plan | DPAall 5 plans |
| Details: Data retention |
|
|
| differs by tool | per tokenonly plan |
|
| Details: Price |
|
|
| yesonly plan | yesall 5 plans | |
| Details: AI features included |
|
|
| 9 sources | 8 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- STACKIT AIyesonly plan
- Windsurfyesall 5 plans
- STACKIT AI
- AI Model Serving (usage-based)
yes (data processing agreement STACKIT Cloud Services, version 2.4.2, under Art. 28 GDPR; applies to all STACKIT Cloud Services booked under the terms of use, no product-specific annex for AI Model Serving)
Provider’s DPA
Windsurf- Free
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Pro
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Max
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Teams
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Enterprise
yes (Enterprise Terms 4.3: the Data Processing Addendum at cognition.com/dpa is incorporated into the agreement; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA
- AI Model Serving (usage-based)
Training
- differs by tool
- STACKIT AInoonly plan
- Windsurf
- yesFree
- opt-out availablePro, Max, Teams
- noEnterprise
- STACKIT AI
- AI Model Serving (usage-based)
Product page: 'your data and queries are neither stored nor used to train models' (translated). Documentation FAQ: 'We do not train any models using your data.' Service specification: apart from billing-relevant data, 'no customer data whatsoever is collected or analysed' (translated). DPA section 2.3: usage data (not content) is processed, among other things, to optimise and further develop the services and is anonymised; STACKIT may use anonymised usage data for its own purposes.
Windsurf- Free
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. An opt-out is only available on paid plans ("If you subscribe to a paid Service Tier, you may opt out of this use"); no opt-out is documented for Free. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Pro
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. Default according to the documentation: training enabled, opt-out at any time in the Data Controls settings. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Max
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. Default according to the documentation: training enabled, opt-out at any time in the Data Controls settings. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Teams
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. On the Teams plan, only an administrator can exercise the opt-out. Default according to the documentation: training enabled. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Enterprise
Enterprise Terms (as of 2026-06-08) 3.3: Cognition does not use, or permit any third party to use, Customer Data to train AI models without the customer's express prior written consent; Usage Data may be used for internal analytics. Documentation: "If you are an Enterprise customer, we will never train on your data without your express prior written consent." DPA (as of 2026-07-23) section 4: sub-processors are subject to equivalent restrictions.
- AI Model Serving (usage-based)
Hosting
- differs by tool
- STACKIT AIEU optiononly plan
- Windsurf
- US onlyFree, Pro, Max, Teams
- not publicly documentedEnterprise
- STACKIT AI
- AI Model Serving (usage-based)
Models run in region EU01 (price table and model documentation, API endpoint '...model-serving.eu01.onstackit.cloud'). Service description section 1.2: operation in STACKIT data centres in Germany and Austria (possibly further EU states in future). DPA section 2.5: processing within the EU/EEA; outside only where expressly agreed and Art. 44–49 GDPR are met.
Windsurf- Free
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Pro
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Max
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Teams
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Enterprise
Standard SaaS according to DPA Appendix C (as of 2026-07-23) with sub-processors in the United States, support workflow in India. Pricing page: Enterprise with "Dedicated deployment option" and deployment in the customer's own VPC; documentation: FedRAMP deployment on AWS GovCloud. Regions of the dedicated or VPC deployment not publicly documented; an EU region is not documented.
- AI Model Serving (usage-based)
Sub-processors
- STACKIT AIlist availableonly plan
- Windsurflist availableall 5 plans
- STACKIT AI
- AI Model Serving (usage-based)
- DPA Annex 2 (version 2.4.2), development, operations and consulting support for STACKIT Cloud Services as a whole: Anynines GmbH (DE), CGI Deutschland B.V. & Co. KG (DE), Cloud&Heat Technologies GmbH (DE), Exivity BV (NL), Freiheit.com Technologies GmbH (DE), Inovex GmbH (DE), ISD Feniqs GmbH (DE), Nextevolution GmbH (DE), Rewion GmbH (DE), Schwarz Digits Bulgaria EOOD (BG), Schwarz Digits IT KG (DE), Schwarz Digits Romania S.C.S. (RO), Schwarz IT S.L.U. (ES), SOCIAL BIGDATA COMUNICACION SL (ES)
- Which of these processors are actually used for AI Model Serving is not publicly documented; according to the documentation the model developers are only the source of the models (Hugging Face) and are not named as processors
Windsurf- Free
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Pro
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Max
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Teams
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Enterprise
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- AI Model Serving (usage-based)
Retention
- differs by tool
- STACKIT AIService specificationonly plan
- WindsurfDPAall 5 plans
- STACKIT AI
- AI Model Serving (usage-based)Service specification (annex on exportability): customer data is not stored permanently, no backup of requests; e-mail and subject ID are stored temporarily (30 days) in the service logs; changes to authentication tokens are recorded in the STACKIT audit log (retention period not quantified there). Documentation FAQ: 'We do not store any customer data from the requests.' DPA section 10.1: deletion of customer data after the end of the contract, deletion record on request.
Windsurf- FreeDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. Without opt-out, ZDR with model providers is not committed; specific retention periods for prompts and code not publicly documented.
- ProDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented.
- MaxDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented.
- TeamsDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented.
- EnterpriseDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. Specific retention periods for prompts and code in Enterprise agreements not publicly documented.
Price
- differs by tool
- STACKIT AIper tokenonly plan
- Windsurf
- 0 USD/moFree
- 20 USD/moPro
- 200 USD/moMax
- 80 USD/mo… (further prices in the details)Teams
- customEnterprise
- STACKIT AI
- AI Model Serving (usage-based)
Usage-based per 1 million tokens, region EU01 (product page, as of 2026-10-18; net prices according to terms of use section 11.3), input/output: gpt-oss 20b EUR 0.15/0.25; Gemma 4 31b, gpt-oss 120b, Llama 3.3 70B Instruct FP8, Qwen3-VL 235B (Plus) and Qwen3.8 27B EUR 0.45/0.65 each; Qwen3-VL 235B A22B (Premium) EUR 1.50/1.75. Embeddings (input only): e5 mistral 7b EUR 0.02; Qwen3 VL Embedding 8B EUR 0.08. Free trial access for 30 days after manual review of the registration (no permanently free plan).
Windsurf- Free
0 USD per month (pricing page)
- Pro
20 USD per month (pricing page, no information on taxes); extra usage at API pricing. Quotas refresh daily and weekly (FAQ).
- Max
200 USD per month (pricing page, no information on taxes); extra usage at API pricing.
- Teams
80 USD per month for the team plan plus 40 USD per month per full dev seat (pricing page, no information on taxes); up to 200 users.
- Enterprise
Price on request (pricing page: "Let's talk")
- AI Model Serving (usage-based)
- STACKIT AIyesonly plan
- Windsurfyesall 5 plans
- STACKIT AI
- AI Model Serving (usage-based)
yes (chat and embedding models as shared instances via an OpenAI-compatible REST API with API key; including Qwen3-VL 235B, Qwen3.8 27B, Llama 3.3 70B, gpt-oss 120b/20b, Gemma 4 31b; tool calling, image input for some models; open-source RAG template)
Windsurf- Free
yes (light quota for agents, limited model availability, unlimited inline edits and Tab completions)
- Pro
yes (Free plus higher quotas with frontier models from OpenAI, Claude, Gemini and SpaceXAI as well as open-source models, full model availability, SWE-2, cloud agents (Devin Cloud), extra usage at API pricing)
- Max
yes (Pro plus significantly higher quotas)
- Teams
yes (Pro plus up to 200 users, sharing and collaboration, centralised billing, admin dashboard with analytics, priority support; according to the FAQ, Devin Desktop only with a full seat, each full seat with 40 USD of usage per month across all Devin products)
- Enterprise
yes (highest priority support, dedicated account management, SAML/OIDC SSO, centralised enterprise admin controls, teamspace isolation, dedicated deployment option or deployment in the customer's VPC, custom terms)
- AI Model Serving (usage-based)
Evidence
- STACKIT AI9 sources
- Windsurf8 sources
- STACKIT AI
- STACKIT AI Model Serving (product page with price table)Product page, retrieved 18 Oct 2026
- Service specification STACKIT AI Model Serving, version 1.3, valid from 18 September 2025Service description, retrieved 18 Oct 2026
- Service specification STACKIT AI Model Serving, version 1.4, valid from 6 November 2026Service description, retrieved 18 Oct 2026
- Data processing agreement STACKIT Cloud Services, version 2.4.2DPA, retrieved 18 Oct 2026
- Terms of use STACKIT Cloud, version 1.3.2, valid from 4 May 2026Terms and conditions, retrieved 18 Oct 2026
- Service description STACKIT Cloud, version 1.4, valid from 4 May 2026Service description, retrieved 18 Oct 2026
- AI Model Serving – FAQDocumentation, retrieved 18 Oct 2026
- AI Model Serving – Service descriptionDocumentation, retrieved 18 Oct 2026
- Available Shared Models of STACKIT AI Model ServingDocumentation, retrieved 18 Oct 2026
Windsurf- Plans and Pricing (windsurf.com/pricing redirects here)Pricing page, retrieved 18 Oct 2026
- Docs: Devin Desktop FAQ (transition from Windsurf)Documentation, retrieved 18 Oct 2026
- Platform Terms of Service (Last updated: 2026-06-30)Terms and conditions, retrieved 18 Oct 2026
- Enterprise Terms of Service (Last updated: 2026-06-08)Terms and conditions, retrieved 18 Oct 2026
- Data Processing Addendum (Last updated: 2026-07-23, with sub-processor list in Appendix C)DPA, retrieved 18 Oct 2026
- Privacy Policy (Last updated: 2026-03-09)Privacy notice, retrieved 18 Oct 2026
- Docs: Security at Cognition (windsurf.com/security redirects here)Documentation, retrieved 18 Oct 2026
- Docs: FedRAMP Security Admin Guide (Devin Desktop)Documentation, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
No guarantee of accuracy, not legal advice. Each entry is valid as of the date shown. Open points are listed on the detail pages.
More comparisons
STACKIT AI compared with
Individual pages: STACKIT AI, Windsurf. All tools in the category: Software development.