Start with the agreement attached to your account. Windsurf ownership, the contracting entity, the model provider, and the party processing your data are related questions with different answers. A product name or privacy toggle cannot establish all four.
Reviewed September 13, 2026 against the vendor sources below. This is a document review, not an independent security audit or verification of your account. The former Free, Enterprise, ownership, and data-handling checklists are consolidated here.
Which agreement applies?
- Self-serve account: confirm the accepted platform terms, plan, privacy controls and any assignment notice.
- Existing Exafunction license: check whether you received notice assigning the license to Cognition.
- Enterprise purchase: read the signed order form, incorporated agreement, DPA, amendments and covered services.
- Older Windsurf contract: use its actual terms and migration notices; do not substitute a newer website agreement automatically.
Cognition’s platform terms, updated June 30, 2026, explicitly retain Exafunction as the referenced entity for certain licenses until assignment notice. Under §3.3, customer data may be used for training; paid customers can opt out, and a Teams administrator controls that election. Opt-out enables provider ZDR. Safety, abuse review and legal-process exceptions remain. This is not a promise that every data category disappears immediately.
The enterprise MSA, updated June 8, 2026, instead requires express prior written consent for customer-data training (§3.3). Its services are defined through the order form. Section 4.3 incorporates a DPA and restricts sensitive personal data unless a separate written agreement permits the use. Confirm that this MSA actually governs your purchase before relying on it.
What the public evidence resolves
| Question | Documented answer | Still account-specific |
|---|---|---|
| Who is named? | The privacy policy, updated March 9, 2026, names Cognition AI, Inc. and expressly includes Windsurf | Contracting entity, controller/processor roles and any assignment |
| Is there a fixed retention period? | Privacy-policy §5 gives purpose-dependent retention, including legal and security needs | Dataset-specific deletion schedules, logs, backups and legal holds |
| Is processing confined to one country? | Privacy-policy §7 describes international processing | Your contracted region and actual service configuration |
| Are all processors known for my workload? | A general privacy policy cannot establish your complete data path | Current processor list, chosen models, integrations and their terms |
AIHackers has not verified a signed customer agreement, a complete account-specific processor list, or a deletion test. Those remain unresolved, rather than evidence that no safeguards exist.
Before sending sensitive code
- Record the product, plan, agreement version and legal entity your organization approved.
- Have the account owner confirm the effective training setting and who can change it. Keep that confirmation with the approval record.
- Request the applicable DPA, processor list, storage regions and retention schedule. Include logs, support uploads and backups in the question.
- Inventory model routes, extensions, MCP servers and other integrations separately. Approval of the editor does not approve every connected service.
- Use a nonsensitive test repository while unresolved requirements are being checked. Review generated changes and terminal actions before trusting the result.
Decision rule: if a required contractual or technical control cannot be demonstrated for your account, keep restricted material out of that workflow. Ownership change alone is neither proof of unsafe handling nor proof of compliance.
Ownership history and product routing
Cognition’s July 14, 2025 announcement described a definitive agreement covering Windsurf’s product, IP, brand and people, with integration investment planned. It does not support the old blanket claim that the entire engineering team left or that no integration direction was published.
Our February acquisition analysis remains historical context. Its predictions do not establish today’s contract. Current Windsurf usage links resolve to Devin Desktop documentation, which still distinguishes self-serve and enterprise billing. That routing observation does not establish every existing account’s migration or entitlements.
For product evaluation, use the Windsurf guide and Cursor comparison. For the evidence standard and approval context, see verification methodology and the risk rubric. Recheck this assessment when your agreement, settings, model route or vendor documents change.
Replayable legal sources
The cited clauses were also checked in these archived pages: platform terms, September 13, 2026 at 12:52:32 UTC, enterprise MSA, September 11, 2026 at 09:37:40 UTC, and privacy policy, September 13, 2026 at 10:44:28 UTC. These preserve the document wording; they do not establish your account’s agreement or settings.