Tabnine vs. Windsurf: data protection per plan
Tabnine (2 plans) and Windsurf (5 plans) side by side: DPA, training on inputs, hosting and data retention per plan, based on the providers’ public documents. Without rating.
Last updated: (latest review date of the tools shown)
At a glance
Each value is listed with the plans it applies to. Pick a tier to see only plans of that tier; if plans are chosen in the plan comparison below, the table shows exactly those.
All plans: each value is listed with the plans it applies to.
| Feature | Tabnine | Windsurf |
|---|---|---|
| Provider based in | Tabnine Ltd., Israel | Cognition AI, Inc., 550 Third Street, San Francisco, CA 94107, USA |
| Plans recorded | 2 | 5 |
| Hosting | not documented: all 2 plans | US only: Free, Pro, Max, Teamsnot documented: Enterprise |
| Training on inputs | no: all 2 plans | yes: Freeopt-out available: Pro, Max, Teamsno: Enterprise |
| DPA | not documented: all 2 plans | yes: all 5 plans |
| As of | 18 Oct 2026 | 18 Oct 2026 |
Plans compared
Comparing: Tabnine Enterprise vs. Windsurf Enterprise
| Feature | TabnineEnterprise (SaaS) | WindsurfEnterprise |
|---|---|---|
| differs by plan | not publicly documented | yes |
| Details: DPA available | not publicly documented (Trust Center lists a Master Services Agreement, no DPA; Privacy Policy describes Tabnine as processor when used for organisations, but does not refer to any DPA) | yes (Enterprise Terms 4.3: the Data Processing Addendum at cognition.com/dpa is incorporated into the agreement; EU SCCs Module Two/Three, UK Addendum) Provider’s DPA |
| no | no | |
| Details: Training on inputs | Docs 'Privacy': 'no-train-no-retain' policy for Tabnine models; Tabnine does not store code, does not share code with third parties and does not train on customer code. Tabnine's code completion and Protected Chat model are stated to be trained only on open-source code under permissive licences; private fine-tuned models (team opt-in) accessible only to the team. Optional third-party chat models: privacy rules and protection may differ (Docs 'AI Models'). Terms of Use (as of 2024-07-25): Tabnine uses code developed during use only to improve the service for that specific customer, not for other users; "Tailor Made" models only at express request. | Enterprise Terms (as of 2026-06-08) 3.3: Cognition does not use, or permit any third party to use, Customer Data to train AI models without the customer's express prior written consent; Usage Data may be used for internal analytics. Documentation: "If you are an Enterprise customer, we will never train on your data without your express prior written consent." DPA (as of 2026-07-23) section 4: sub-processors are subject to equivalent restrictions. |
| not publicly documented | not publicly documented | |
| Details: Data residency | Security documentation: SaaS on AWS (North Virginia, USA) and Google Cloud (Council Bluffs, Iowa, USA), plus Heroku (Virginia, USA) as main locations. Docs 'Deployment options': Secure SaaS is 'hosted, managed, and monitored by Tabnine', without stating a location. The Trust Center names Google Cloud Platform under 'Infrastructure'. An EU region or choice of region is not documented. | Standard SaaS according to DPA Appendix C (as of 2026-07-23) with sub-processors in the United States, support workflow in India. Pricing page: Enterprise with "Dedicated deployment option" and deployment in the customer's own VPC; documentation: FedRAMP deployment on AWS GovCloud. Regions of the dedicated or VPC deployment not publicly documented; an EU region is not documented. |
| list available | list available | |
| Details: List published |
|
|
| differs by plan | Docs: context | DPA |
| Details: Data retention | Docs: context (code snippets, chat history) is deleted immediately after the response (ephemeral processing); operational metrics and logs of the Tabnine cluster are retained for one week; stored data is encrypted with AES-256. Privacy Policy (as of 2024-09-12): personal data only as long as necessary for the services and legitimate business/legal purposes; specific retention periods not stated. | DPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. Specific retention periods for prompts and code in Enterprise agreements not publicly documented. |
| differs by plan | not publicly documented | custom |
| Details: Price | not publicly documented (tabnine.com/pricing redirects to the Tricentis contact form; Terms: fees in USD, excluding taxes) | Price on request (pricing page: "Let's talk") |
| yes | yes | |
| Details: AI features included | yes (code completion, chat, agent, CLI, context engine; Tabnine's own models as well as optional third-party models) | yes (highest priority support, dedicated account management, SAML/OIDC SSO, centralised enterprise admin controls, teamspace isolation, dedicated deployment option or deployment in the customer's VPC, custom terms) |
| 9 sources | 5 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- differs by plan
- Tabnine Enterprisenot publicly documented
- Windsurf Enterpriseyes
- Tabnine Enterprise
not publicly documented (Trust Center lists a Master Services Agreement, no DPA; Privacy Policy describes Tabnine as processor when used for organisations, but does not refer to any DPA)
Windsurf Enterpriseyes (Enterprise Terms 4.3: the Data Processing Addendum at cognition.com/dpa is incorporated into the agreement; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA
Training
- Tabnine Enterpriseno
- Windsurf Enterpriseno
- Tabnine Enterprise
Docs 'Privacy': 'no-train-no-retain' policy for Tabnine models; Tabnine does not store code, does not share code with third parties and does not train on customer code. Tabnine's code completion and Protected Chat model are stated to be trained only on open-source code under permissive licences; private fine-tuned models (team opt-in) accessible only to the team. Optional third-party chat models: privacy rules and protection may differ (Docs 'AI Models'). Terms of Use (as of 2024-07-25): Tabnine uses code developed during use only to improve the service for that specific customer, not for other users; "Tailor Made" models only at express request.
Windsurf EnterpriseEnterprise Terms (as of 2026-06-08) 3.3: Cognition does not use, or permit any third party to use, Customer Data to train AI models without the customer's express prior written consent; Usage Data may be used for internal analytics. Documentation: "If you are an Enterprise customer, we will never train on your data without your express prior written consent." DPA (as of 2026-07-23) section 4: sub-processors are subject to equivalent restrictions.
Hosting
- Tabnine Enterprisenot publicly documented
- Windsurf Enterprisenot publicly documented
- Tabnine Enterprise
Security documentation: SaaS on AWS (North Virginia, USA) and Google Cloud (Council Bluffs, Iowa, USA), plus Heroku (Virginia, USA) as main locations. Docs 'Deployment options': Secure SaaS is 'hosted, managed, and monitored by Tabnine', without stating a location. The Trust Center names Google Cloud Platform under 'Infrastructure'. An EU region or choice of region is not documented.
Windsurf EnterpriseStandard SaaS according to DPA Appendix C (as of 2026-07-23) with sub-processors in the United States, support workflow in India. Pricing page: Enterprise with "Dedicated deployment option" and deployment in the customer's own VPC; documentation: FedRAMP deployment on AWS GovCloud. Regions of the dedicated or VPC deployment not publicly documented; an EU region is not documented.
Sub-processors
- Tabnine Enterpriselist available
- Windsurf Enterpriselist available
- Tabnine Enterprise
- Hosting providers according to the security documentation: Amazon Web Services (main data centre North Virginia, USA), Google Cloud Platform (Council Bluffs, Iowa, USA), Heroku (Virginia, USA)
- Google Cloud Identity (identity management according to the security documentation)
- Optional third-party chat models (depending on selection): Anthropic Claude, OpenAI GPT, Google Gemini and others; according to the documentation, privacy rules of these models may differ
- According to the Privacy Policy, also payment service providers, analytics and marketing service providers as well as affiliated companies (e.g. Tabnine Inc.), without names
- Complete sub-processor list: not publicly documented (tabnine.com/subprocessors still returns HTTP 502 when retrieved on 2026-10-18; the Trust Center contains no sub-processor list)
Windsurf Enterprise- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
Retention
- differs by plan
- Tabnine EnterpriseDocs: context
- Windsurf EnterpriseDPA
- Tabnine EnterpriseDocs: context (code snippets, chat history) is deleted immediately after the response (ephemeral processing); operational metrics and logs of the Tabnine cluster are retained for one week; stored data is encrypted with AES-256. Privacy Policy (as of 2024-09-12): personal data only as long as necessary for the services and legitimate business/legal purposes; specific retention periods not stated.Windsurf EnterpriseDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. Specific retention periods for prompts and code in Enterprise agreements not publicly documented.
Price
- differs by plan
- Tabnine Enterprisenot publicly documented
- Windsurf Enterprisecustom
- Tabnine Enterprise
not publicly documented (tabnine.com/pricing redirects to the Tricentis contact form; Terms: fees in USD, excluding taxes)
Windsurf EnterprisePrice on request (pricing page: "Let's talk")
- Tabnine Enterpriseyes
- Windsurf Enterpriseyes
- Tabnine Enterprise
yes (code completion, chat, agent, CLI, context engine; Tabnine's own models as well as optional third-party models)
Windsurf Enterpriseyes (highest priority support, dedicated account management, SAML/OIDC SSO, centralised enterprise admin controls, teamspace isolation, dedicated deployment option or deployment in the customer's VPC, custom terms)
Evidence
- Tabnine Enterprise9 sources
- Windsurf Enterprise5 sources
- Tabnine Enterprise
- Docs: PrivacyDocumentation, retrieved 14 Oct 2026
- Docs: SecurityDocumentation, retrieved 14 Oct 2026
- Docs: Enterprise (SaaS)Documentation, retrieved 14 Oct 2026
- Docs: AI ModelsDocumentation, retrieved 18 Oct 2026
- Tabnine Trust Center (SafeBase)Trust Center, retrieved 18 Oct 2026
- Tabnine Privacy Policy (as of 2024-09-12, PDF; redirect from tabnine.com/privacy)Privacy notice, retrieved 14 Oct 2026
- Tabnine Terms of Use incl. Multi-Model Addendum (as of 2024-07-25, PDF; redirect from tabnine.com/terms-of-use)Terms and conditions, retrieved 14 Oct 2026
- Docs: Deployment optionsDocumentation, retrieved 18 Oct 2026
- Docs: Subscription plansDocumentation, retrieved 18 Oct 2026
Windsurf Enterprise- Plans and Pricing (windsurf.com/pricing redirects here)Pricing page, retrieved 18 Oct 2026
- Enterprise Terms of Service (Last updated: 2026-06-08)Terms and conditions, retrieved 18 Oct 2026
- Data Processing Addendum (Last updated: 2026-07-23, with sub-processor list in Appendix C)DPA, retrieved 18 Oct 2026
- Docs: Security at Cognition (windsurf.com/security redirects here)Documentation, retrieved 18 Oct 2026
- Docs: FedRAMP Security Admin Guide (Devin Desktop)Documentation, retrieved 18 Oct 2026
| Feature | Tabnine | Windsurf |
|---|---|---|
| differs by tool | not publicly documentedall 2 plans | yesall 5 plans |
| Details: DPA available |
|
|
| differs by tool | noall 2 plans |
|
| Details: Training on inputs |
|
|
| differs by tool | not publicly documentedall 2 plans |
|
| Details: Data residency |
|
|
| list availableall 2 plans | list availableall 5 plans | |
| Details: List published |
|
|
| differs by tool | Docs: contextall 2 plans | DPAall 5 plans |
| Details: Data retention |
|
|
| differs by tool | not publicly documentedall 2 plans |
|
| Details: Price |
|
|
| yesall 2 plans | yesall 5 plans | |
| Details: AI features included |
|
|
| 10 sources | 8 sources | |
| Details: Sources with retrieval date |
|
|
Contract / DPA
- differs by tool
- Tabninenot publicly documentedall 2 plans
- Windsurfyesall 5 plans
- Tabnine
- Enterprise (SaaS)
not publicly documented (Trust Center lists a Master Services Agreement, no DPA; Privacy Policy describes Tabnine as processor when used for organisations, but does not refer to any DPA)
- Enterprise (private installation: VPC or on-premises)
not publicly documented (Trust Center lists a Master Services Agreement, no DPA; Privacy Policy describes Tabnine as processor when used for organisations, but does not refer to any DPA)
Windsurf- Free
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Pro
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Max
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Teams
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA - Enterprise
yes (Enterprise Terms 4.3: the Data Processing Addendum at cognition.com/dpa is incorporated into the agreement; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA
- Enterprise (SaaS)
Training
- differs by tool
- Tabninenoall 2 plans
- Windsurf
- yesFree
- opt-out availablePro, Max, Teams
- noEnterprise
- Tabnine
- Enterprise (SaaS)
Docs 'Privacy': 'no-train-no-retain' policy for Tabnine models; Tabnine does not store code, does not share code with third parties and does not train on customer code. Tabnine's code completion and Protected Chat model are stated to be trained only on open-source code under permissive licences; private fine-tuned models (team opt-in) accessible only to the team. Optional third-party chat models: privacy rules and protection may differ (Docs 'AI Models'). Terms of Use (as of 2024-07-25): Tabnine uses code developed during use only to improve the service for that specific customer, not for other users; "Tailor Made" models only at express request.
- Enterprise (private installation: VPC or on-premises)
Docs 'Privacy': 'no-train-no-retain' policy for Tabnine models; Tabnine does not store code, does not share code with third parties and does not train on customer code. Tabnine's code completion and Protected Chat model are stated to be trained only on open-source code under permissive licences; private fine-tuned models (team opt-in) accessible only to the team. Optional third-party chat models: privacy rules and protection may differ (Docs 'AI Models'). Docs: even with private deployment, code in the context window remains ephemeral; in self-hosted operation, clusters send metrics and logs to Tabnine servers, in air-gapped operation they do not. According to the Docs, no code and no PII are sent in the process. Terms of Use (as of 2024-07-25): Tabnine uses code developed during use only to improve the service for that specific customer, not for other users; "Tailor Made" models only at express request.
Windsurf- Free
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. An opt-out is only available on paid plans ("If you subscribe to a paid Service Tier, you may opt out of this use"); no opt-out is documented for Free. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Pro
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. Default according to the documentation: training enabled, opt-out at any time in the Data Controls settings. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Max
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. Default according to the documentation: training enabled, opt-out at any time in the Data Controls settings. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Teams
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. On the Teams plan, only an administrator can exercise the opt-out. Default according to the documentation: training enabled. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- Enterprise
Enterprise Terms (as of 2026-06-08) 3.3: Cognition does not use, or permit any third party to use, Customer Data to train AI models without the customer's express prior written consent; Usage Data may be used for internal analytics. Documentation: "If you are an Enterprise customer, we will never train on your data without your express prior written consent." DPA (as of 2026-07-23) section 4: sub-processors are subject to equivalent restrictions.
- Enterprise (SaaS)
Hosting
- differs by tool
- Tabninenot publicly documentedall 2 plans
- Windsurf
- US onlyFree, Pro, Max, Teams
- not publicly documentedEnterprise
- Tabnine
- Enterprise (SaaS)
Security documentation: SaaS on AWS (North Virginia, USA) and Google Cloud (Council Bluffs, Iowa, USA), plus Heroku (Virginia, USA) as main locations. Docs 'Deployment options': Secure SaaS is 'hosted, managed, and monitored by Tabnine', without stating a location. The Trust Center names Google Cloud Platform under 'Infrastructure'. An EU region or choice of region is not documented.
- Enterprise (private installation: VPC or on-premises)
Operation and location are the customer's responsibility (data centre or supported cloud provider). Telemetry: in self-hosted operation, metrics, logs and client telemetry go to Tabnine servers, location not documented.
Windsurf- Free
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Pro
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Max
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Teams
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- Enterprise
Standard SaaS according to DPA Appendix C (as of 2026-07-23) with sub-processors in the United States, support workflow in India. Pricing page: Enterprise with "Dedicated deployment option" and deployment in the customer's own VPC; documentation: FedRAMP deployment on AWS GovCloud. Regions of the dedicated or VPC deployment not publicly documented; an EU region is not documented.
- Enterprise (SaaS)
Sub-processors
- Tabninelist availableall 2 plans
- Windsurflist availableall 5 plans
- Tabnine
- Enterprise (SaaS)
- Hosting providers according to the security documentation: Amazon Web Services (main data centre North Virginia, USA), Google Cloud Platform (Council Bluffs, Iowa, USA), Heroku (Virginia, USA)
- Google Cloud Identity (identity management according to the security documentation)
- Optional third-party chat models (depending on selection): Anthropic Claude, OpenAI GPT, Google Gemini and others; according to the documentation, privacy rules of these models may differ
- According to the Privacy Policy, also payment service providers, analytics and marketing service providers as well as affiliated companies (e.g. Tabnine Inc.), without names
- Complete sub-processor list: not publicly documented (tabnine.com/subprocessors still returns HTTP 502 when retrieved on 2026-10-18; the Trust Center contains no sub-processor list)
- Enterprise (private installation: VPC or on-premises)
- No operation by Tabnine; optionally connected third-party models via private endpoints at the customer's choice
- Telemetry recipient: Tabnine servers (hosting as for SaaS according to the security documentation: AWS, GCP, Heroku in the USA)
Windsurf- Free
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Pro
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Max
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Teams
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Enterprise
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
- Enterprise (SaaS)
Retention
- differs by tool
- TabnineDocs: contextall 2 plans
- WindsurfDPAall 5 plans
- Tabnine
- Enterprise (SaaS)Docs: context (code snippets, chat history) is deleted immediately after the response (ephemeral processing); operational metrics and logs of the Tabnine cluster are retained for one week; stored data is encrypted with AES-256. Privacy Policy (as of 2024-09-12): personal data only as long as necessary for the services and legitimate business/legal purposes; specific retention periods not stated.
- Enterprise (private installation: VPC or on-premises)Docs: context (code snippets, chat history) is deleted immediately after the response (ephemeral processing); operational metrics and logs of the Tabnine cluster are retained for one week; stored data is encrypted with AES-256. Privacy Policy (as of 2024-09-12): personal data only as long as necessary for the services and legitimate business/legal purposes; specific retention periods not stated.
Windsurf- FreeDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. Without opt-out, ZDR with model providers is not committed; specific retention periods for prompts and code not publicly documented.
- ProDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented.
- MaxDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented.
- TeamsDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented.
- EnterpriseDPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. Specific retention periods for prompts and code in Enterprise agreements not publicly documented.
Price
- differs by tool
- Tabninenot publicly documentedall 2 plans
- Windsurf
- 0 USD/moFree
- 20 USD/moPro
- 200 USD/moMax
- 80 USD/mo… (further prices in the details)Teams
- customEnterprise
- Tabnine
- Enterprise (SaaS)
not publicly documented (tabnine.com/pricing redirects to the Tricentis contact form; Terms: fees in USD, excluding taxes)
- Enterprise (private installation: VPC or on-premises)
not publicly documented (tabnine.com/pricing redirects to the Tricentis contact form)
Windsurf- Free
0 USD per month (pricing page)
- Pro
20 USD per month (pricing page, no information on taxes); extra usage at API pricing. Quotas refresh daily and weekly (FAQ).
- Max
200 USD per month (pricing page, no information on taxes); extra usage at API pricing.
- Teams
80 USD per month for the team plan plus 40 USD per month per full dev seat (pricing page, no information on taxes); up to 200 users.
- Enterprise
Price on request (pricing page: "Let's talk")
- Enterprise (SaaS)
- Tabnineyesall 2 plans
- Windsurfyesall 5 plans
- Tabnine
- Enterprise (SaaS)
yes (code completion, chat, agent, CLI, context engine; Tabnine's own models as well as optional third-party models)
- Enterprise (private installation: VPC or on-premises)
yes (as SaaS; models run in the customer's own data centre or VPC, private endpoints for further models)
Windsurf- Free
yes (light quota for agents, limited model availability, unlimited inline edits and Tab completions)
- Pro
yes (Free plus higher quotas with frontier models from OpenAI, Claude, Gemini and SpaceXAI as well as open-source models, full model availability, SWE-2, cloud agents (Devin Cloud), extra usage at API pricing)
- Max
yes (Pro plus significantly higher quotas)
- Teams
yes (Pro plus up to 200 users, sharing and collaboration, centralised billing, admin dashboard with analytics, priority support; according to the FAQ, Devin Desktop only with a full seat, each full seat with 40 USD of usage per month across all Devin products)
- Enterprise
yes (highest priority support, dedicated account management, SAML/OIDC SSO, centralised enterprise admin controls, teamspace isolation, dedicated deployment option or deployment in the customer's VPC, custom terms)
- Enterprise (SaaS)
Evidence
- Tabnine10 sources
- Windsurf8 sources
- Tabnine
- Docs: PrivacyDocumentation, retrieved 14 Oct 2026
- Docs: SecurityDocumentation, retrieved 14 Oct 2026
- Docs: Enterprise (SaaS)Documentation, retrieved 14 Oct 2026
- Docs: Enterprise (private installation)Documentation, retrieved 14 Oct 2026
- Docs: AI ModelsDocumentation, retrieved 18 Oct 2026
- Tabnine Trust Center (SafeBase)Trust Center, retrieved 18 Oct 2026
- Tabnine Privacy Policy (as of 2024-09-12, PDF; redirect from tabnine.com/privacy)Privacy notice, retrieved 14 Oct 2026
- Tabnine Terms of Use incl. Multi-Model Addendum (as of 2024-07-25, PDF; redirect from tabnine.com/terms-of-use)Terms and conditions, retrieved 14 Oct 2026
- Docs: Deployment optionsDocumentation, retrieved 18 Oct 2026
- Docs: Subscription plansDocumentation, retrieved 18 Oct 2026
Windsurf- Plans and Pricing (windsurf.com/pricing redirects here)Pricing page, retrieved 18 Oct 2026
- Docs: Devin Desktop FAQ (transition from Windsurf)Documentation, retrieved 18 Oct 2026
- Platform Terms of Service (Last updated: 2026-06-30)Terms and conditions, retrieved 18 Oct 2026
- Enterprise Terms of Service (Last updated: 2026-06-08)Terms and conditions, retrieved 18 Oct 2026
- Data Processing Addendum (Last updated: 2026-07-23, with sub-processor list in Appendix C)DPA, retrieved 18 Oct 2026
- Privacy Policy (Last updated: 2026-03-09)Privacy notice, retrieved 18 Oct 2026
- Docs: Security at Cognition (windsurf.com/security redirects here)Documentation, retrieved 18 Oct 2026
- Docs: FedRAMP Security Admin Guide (Devin Desktop)Documentation, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
No guarantee of accuracy, not legal advice. Each entry is valid as of the date shown. Open points are listed on the detail pages.
More comparisons
Tabnine compared with
Individual pages: Tabnine, Windsurf. All tools in the category: Software development.