Windsurf
Windsurf (now Devin Desktop)
Provider: Cognition AI, Inc. · Based in: Cognition AI, Inc., 550 Third Street, San Francisco, CA 94107, USA · Provider website
- Plans
- 5
- Sources
- 13
- As of
- 18 Oct
As of 18 Oct 2026. Based on our research on this date and the process described in the methodology. No guarantee of accuracy, not legal advice. The provider’s current documents take precedence. Found an error? Report a correction.
Incomplete. 6 points could not be verified in any provider source (see open points). This does not mean the matter is unproblematic; it means we have not checked it.
At a glance
- Hosting
- US only: Free, Pro, Max, Teamsnot publicly documented: Enterprise
- Training on inputs
- yes: Freeopt-out available: Pro, Max, Teamsno: Enterprise
- DPA
- yes: all 5 plans
- Provider
- Cognition AI, Inc.
- Based in
- Cognition AI, Inc., 550 Third Street, San Francisco, CA 94107, USA (address according to the Platform Terms and DPA, q4, q6). For users who registered with Exafunction, Inc. in the past, Exafunction, Inc. is the contracting party according to the Terms unless notice of assignment to Cognition was given (q4).
Values from 5 plans, each listed with the plans it applies to. Details and evidence are in the plan table.
Compare Windsurf
Compare with another toolCompared plan by plan with other tools in the category Software development:
Details per plan
Short values per plan. Click a feature to open the evidence and notes for all plans; sources with retrieval dates are under “Evidence”.
| Feature | FreeCompare Windsurf Free with another tool | ProCompare Windsurf Pro with another tool | MaxCompare Windsurf Max with another tool | TeamsCompare Windsurf Teams with another tool | EnterpriseCompare Windsurf Enterprise with another tool |
|---|---|---|---|---|---|
| differs by plan | 0 USD/mo | 20 USD/mo | 200 USD/mo | 80 USD/mo… (further prices in the details) | custom |
| Details: Price | 0 USD per month (pricing page) | 20 USD per month (pricing page, no information on taxes); extra usage at API pricing. Quotas refresh daily and weekly (FAQ). | 200 USD per month (pricing page, no information on taxes); extra usage at API pricing. | 80 USD per month for the team plan plus 40 USD per month per full dev seat (pricing page, no information on taxes); up to 200 users. | Price on request (pricing page: "Let's talk") |
| yes | yes | yes | yes | yes | |
| Details: AI features included | yes (light quota for agents, limited model availability, unlimited inline edits and Tab completions) | yes (Free plus higher quotas with frontier models from OpenAI, Claude, Gemini and SpaceXAI as well as open-source models, full model availability, SWE-2, cloud agents (Devin Cloud), extra usage at API pricing) | yes (Pro plus significantly higher quotas) | yes (Pro plus up to 200 users, sharing and collaboration, centralised billing, admin dashboard with analytics, priority support; according to the FAQ, Devin Desktop only with a full seat, each full seat with 40 USD of usage per month across all Devin products) | yes (highest priority support, dedicated account management, SAML/OIDC SSO, centralised enterprise admin controls, teamspace isolation, dedicated deployment option or deployment in the customer's VPC, custom terms) |
| yes | yes | yes | yes | yes | |
| Details: DPA | yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum) Provider’s DPA | yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum) Provider’s DPA | yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum) Provider’s DPA | yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum) Provider’s DPA | yes (Enterprise Terms 4.3: the Data Processing Addendum at cognition.com/dpa is incorporated into the agreement; EU SCCs Module Two/Three, UK Addendum) Provider’s DPA |
| differs by plan | yes | opt-out available | opt-out available | opt-out available | no |
| Details: Training on inputs | Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. An opt-out is only available on paid plans ("If you subscribe to a paid Service Tier, you may opt out of this use"); no opt-out is documented for Free. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law. | Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. Default according to the documentation: training enabled, opt-out at any time in the Data Controls settings. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law. | Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. Default according to the documentation: training enabled, opt-out at any time in the Data Controls settings. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law. | Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. On paid plans, an opt-out is available; after that, the data is not used for any other purpose including training, and Zero Data Retention (ZDR) is enabled with the model providers. On the Teams plan, only an administrator can exercise the opt-out. Default according to the documentation: training enabled. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law. | Enterprise Terms (as of 2026-06-08) 3.3: Cognition does not use, or permit any third party to use, Customer Data to train AI models without the customer's express prior written consent; Usage Data may be used for internal analytics. Documentation: "If you are an Enterprise customer, we will never train on your data without your express prior written consent." DPA (as of 2026-07-23) section 4: sub-processors are subject to equivalent restrictions. |
| DPA | DPA | DPA | DPA | DPA | |
| Details: Data retention | DPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. Without opt-out, ZDR with model providers is not committed; specific retention periods for prompts and code not publicly documented. | DPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented. | DPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented. | DPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. After opt-out: Zero Data Retention with model providers (data not persistently stored and deleted once the output is generated, Platform Terms 1.8). Without opt-out, specific retention periods not publicly documented. | DPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. Specific retention periods for prompts and code in Enterprise agreements not publicly documented. |
| differs by plan | US only | US only | US only | US only | not publicly documented |
| Details: Hosting | DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented. | DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented. | DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented. | DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented. | Standard SaaS according to DPA Appendix C (as of 2026-07-23) with sub-processors in the United States, support workflow in India. Pricing page: Enterprise with "Dedicated deployment option" and deployment in the customer's own VPC; documentation: FedRAMP deployment on AWS GovCloud. Regions of the dedicated or VPC deployment not publicly documented; an EU region is not documented. |
| list available | list available | list available | list available | list available | |
| Details: Sub-processors |
|
|
|
|
|
| differs by plan | 5 sources | 5 sources | 5 sources | 6 sources | 5 sources |
| Details: Sources with retrieval date |
|
|
|
|
|
Compare Windsurf Free with another tool
Price and scope
- differs by plan
- 0 USD/mo
0 USD per month (pricing page)
- yes
yes (light quota for agents, limited model availability, unlimited inline edits and Tab completions)
Contract and data use
- yes
yes (Platform Terms 4.2: where personal data is processed, the Data Processing Addendum at cognition.ai/dpa applies; EU SCCs Module Two/Three, UK Addendum)
Provider’s DPA- differs by plan
- yes
Platform Terms (as of 2026-06-30) 3.3.1: Cognition may use Customer Data for model training and to improve the Services. An opt-out is only available on paid plans ("If you subscribe to a paid Service Tier, you may opt out of this use"); no opt-out is documented for Free. Exceptions under 3.3.3: ZDR does not preclude retention or disclosure of data flagged by abuse-detection classifiers, needed for safety, security and AUP compliance review, or compelled by law.
- DPA
- DPA (as of 2026-07-23): processing during the term of the agreement and for 30 days after termination; sub-processors delete within 30 days of termination. Privacy Policy: retention as long as needed to provide the Service or for legal reasons, without specific periods. Without opt-out, ZDR with model providers is not committed; specific retention periods for prompts and code not publicly documented.
Hosting and sharing
- differs by plan
- US only
DPA (as of 2026-07-23), Appendix C: all named sub-processors for core processing, profile data, logs and model inference are located in the United States; support workflow via Agumbe (Cognition India) in India. Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer and process data throughout the world, including the EU, UK and US. A selectable EU region is not documented.
- list available
- Microsoft Azure, AWS and Google Cloud: core processing, for AWS and Google Cloud also profile data, logs and indices (United States)
- Auth0 (profile data); Hex, Sentry and Datadog (system logs) (United States)
- Zendesk and Pylon (support contacts), Decagon (support chatbot) (United States); Agumbe (Cognition India, support workflow) (India)
- Model providers, to the extent inputs contain personal data: OpenAI, Anthropic, Microsoft/Azure, Google/Vertex (United States); Databricks, xAI, Snowflake only if enabled in Devin Desktop (United States)
Evidence
- differs by plan
- 5 sources
- Plans and Pricing (windsurf.com/pricing redirects here)Pricing page, retrieved 18 Oct 2026
- Platform Terms of Service (Last updated: 2026-06-30)Terms and conditions, retrieved 18 Oct 2026
- Data Processing Addendum (Last updated: 2026-07-23, with sub-processor list in Appendix C)DPA, retrieved 18 Oct 2026
- Privacy Policy (Last updated: 2026-03-09)Privacy notice, retrieved 18 Oct 2026
- Docs: Security at Cognition (windsurf.com/security redirects here)Documentation, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
Third-country transfers
Privacy Policy (as of 2026-03-09): Cognition and its service providers may transfer personal data throughout the world, including the EU, UK and US; for the EEA, Switzerland and the UK, Cognition relies "in some cases" on the EU standard contractual clauses and local clauses such as the UK International Data Transfer Addendum. DPA (as of 2026-07-23): EU standard contractual clauses of 4 June 2021, Module Two and Module Three, law and courts of the EU member state of the data exporter; UK Addendum; Swiss adjustments. Sub-processors in the United States and India (DPA Appendix C). EU-U.S. Data Privacy Framework: on 2026-10-18 the DPF List returned only the unrelated Cognition Financial for "Cognition" and no result for "Exafunction".
- Data Processing Addendum (Last updated: 2026-07-23, with sub-processor list in Appendix C) (DPA), retrieved 18 Oct 2026
- Privacy Policy (Last updated: 2026-03-09) (Privacy notice), retrieved 18 Oct 2026
- Data Privacy Framework List (search 'Cognition' and 'Exafunction') (Official register), retrieved 18 Oct 2026
Certifications (as stated by the provider)
Documentation (Security at Cognition): SOC 2 Type II since September 2024. Trust Center (SafeBase): CCPA, SOC 2 Type 2 and ISO/IEC 27001:2022 listed; SOC 2 report, bridge letter, pentest report and ISO certificate only after an access request and NDA. DPA Appendix B: SOC 2 Type II. The documentation describes a FedRAMP deployment of Devin Desktop on AWS GovCloud; the authorisation level is not stated there.
- Data Processing Addendum (Last updated: 2026-07-23, with sub-processor list in Appendix C) (DPA), retrieved 18 Oct 2026
- Docs: Security at Cognition (windsurf.com/security redirects here) (Documentation), retrieved 18 Oct 2026
- Cognition Trust Center (SafeBase) (Trust Center), retrieved 18 Oct 2026
- Docs: FedRAMP Security Admin Guide (Devin Desktop) (Documentation), retrieved 18 Oct 2026
AI Act
Functions: AI code editor (formerly Windsurf) with Agent Command Center (Spaces, Kanban view, multi-agent management), Cascade or the local agent Devin Local, Tab completion and inline edits, models from OpenAI, Anthropic, Google, SpaceXAI and open-source models, its own SWE-2 model, and cloud agents (Devin Cloud), DeepWiki and Devin API (pricing page, product page, documentation).
Provider’s statement: not publicly documented(the EU AI Act is not mentioned on the retrieved pages). Acceptable Use Policy (as of 2026-06-30): the Services must not be used as the sole basis for decisions that materially affect individuals (including legal, financial, employment, housing, insurance or educational decisions); "High Risk Activities" such as life support systems or air traffic control only with a separate written agreement.
Classification (for review, not legal advice): To be reviewed: customer typically a deployer (Art. 3(4) AI Act) of the assistance system; obligations depend on the purpose of the systems developed with it (check Annex III). With third-party models, the user also chooses the model and provider. As a deployer, observe Art. 4 AI Act (AI literacy); assess agent features (Devin Cloud, Devin Local) separately. Not legal advice.
- Plans and Pricing (windsurf.com/pricing redirects here) (Pricing page), retrieved 18 Oct 2026
- Devin Desktop with FAQ (windsurf.com redirects here) (Product page), retrieved 18 Oct 2026
- Docs: Devin Desktop FAQ (transition from Windsurf) (Documentation), retrieved 18 Oct 2026
- Acceptable Use Policy (Last updated: 2026-06-30) (Acceptable use policy), retrieved 18 Oct 2026
Current notes 2026
Since 2026-06-02, Windsurf has been called "Devin Desktop"; windsurf.com redirects to devin.ai. According to the FAQ, plans and pricing remain unchanged, including for legacy Windsurf Enterprise plans; the Windsurf plugin for JetBrains is in maintenance mode. Platform Terms 2026-06-30 (the previous version still applies for 30 days after posting), Enterprise Terms 2026-06-08, DPA 2026-07-23; a Windsurf DPA dated 2026-03-09 is also available at devin.ai/windsurf/dpa. Pricing page (retrieved 2026-10-19): Pro with "Free use of SWE-2"; the page states no time limit.
Provider structure
Windsurf/Devin Desktop is a product of Cognition AI, Inc. (USA); according to the Terms, legacy contracts may still be with Exafunction, Inc. No EU establishment or EU representative is named on the retrieved pages.
Open points of the review
- No selectable EU region documented; regions of the dedicated or VPC deployment for Enterprise not documented.
- Specific retention periods for prompts and code without opt-out (Free and paid plans without opt-out) not documented.
- Two DPA versions published (Windsurf DPA 2026-03-09, Cognition DPA 2026-07-23); which one applies to legacy Windsurf contracts with Exafunction is not documented.
- SOC 2 report and ISO certificate only after NDA; whether Devin Desktop/Windsurf is within the audit scope has not been checked.
- Prices only in USD, without information on taxes; euro prices not documented.
- Legal notice (Impressum)/EU representative not found; provider statement on the AI Act not found.
Frequently asked questions
Where does Windsurf store data?
US only (plans: Free, Pro, Max, Teams); not publicly documented (plans: Enterprise). Based on our research, as of 18 Oct 2026.
Is there a DPA for Windsurf?
yes in: Free, Pro, Max, Teams, Enterprise. According to the provider, as of 18 Oct 2026.
Does Windsurf use inputs for AI training?
yes in: Free; opt-out available in: Pro, Max, Teams; no in: Enterprise. According to the provider, as of 18 Oct 2026.
Where is the provider based?
Cognition AI, Inc., 550 Third Street, San Francisco, CA 94107, USA. For users who registered with Exafunction, Inc. in the past, Exafunction, Inc. is the contracting party according to the Terms unless notice of assignment to Cognition was given. According to the provider, as of 18 Oct 2026.
All sources
- 01Plans and Pricing (windsurf.com/pricing redirects here)Pricing page · retrieved 18 Oct 2026
- 02Devin Desktop with FAQ (windsurf.com redirects here)Product page · retrieved 18 Oct 2026
- 03Docs: Devin Desktop FAQ (transition from Windsurf)Documentation · retrieved 18 Oct 2026
- 04Platform Terms of Service (Last updated: 2026-06-30)Terms and conditions · retrieved 18 Oct 2026
- 05Enterprise Terms of Service (Last updated: 2026-06-08)Terms and conditions · retrieved 18 Oct 2026
- 06Data Processing Addendum (Last updated: 2026-07-23, with sub-processor list in Appendix C)DPA · retrieved 18 Oct 2026
- 07Windsurf Data Processing Addendum (Last updated: 2026-03-09; windsurf.com/dpa redirects here)DPA · retrieved 18 Oct 2026
- 08Privacy Policy (Last updated: 2026-03-09)Privacy notice · retrieved 18 Oct 2026
- 09Docs: Security at Cognition (windsurf.com/security redirects here)Documentation · retrieved 18 Oct 2026
- 10Cognition Trust Center (SafeBase)Trust Center · retrieved 18 Oct 2026
- 11Acceptable Use Policy (Last updated: 2026-06-30)Acceptable use policy · retrieved 18 Oct 2026
- 12Data Privacy Framework List (search 'Cognition' and 'Exafunction')Official register · retrieved 18 Oct 2026
- 13Docs: FedRAMP Security Admin Guide (Devin Desktop)Documentation · retrieved 18 Oct 2026
More tools in Software development with an EU hosting option (in at least one plan)
- Amazon Q Developer · Based in: Depending on the account country: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg
- GitHub Copilot · Based in: According to the GitHub General Privacy Statement
- IONOS AI Model Hub · Based in: IONOS Cloud GmbH, Elgendorfer Straße 57, 56410 Montabaur, Germany
- Lovable · Based in: Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden
All tools in Software development · Tools with an EU hosting option
Further reading
All tools in the category: Software development. Figures across all tools: Data report.