Windsurf (Codeium) procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “To facilitate our operations, Cognition, our third-party partners, and service providers may transfer, store, and process your personal information throughout the world, including the EU, UK and the US. If you reside in the EEA, Switzerland, or the United Kingdom, we rely upon certain legal mechanisms to facilitate these transfers of your personal information, including in some cases the European Commission's Standard Contractual Clauses and relevant local clauses (e.g., the UK's International Data Transfer Addendum) to facilitate the international and onward transfer of European personal data to third countries. You can contact us at the address below to view a copy or request more information about these mechanisms.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “We retain your personal information as needed to provide our Service to you, comply with legal obligations, or protect ours or others interests. How long we retain personal information includes considerations such as when the information was collected or created, whether it is necessary in order to continue offering you our Services, whether we are required to hold the information to comply with our legal obligations, or information preservation requirements. We also keep certain information where necessary to protect the safety, security, and integrity of our Services or users.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “In line with these considerations, we delete information that is no longer needed for the above purposes or when you request deletion of your information.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Personal information does not include information that has been de-identified, anonymized or aggregated. When data is de-identified or anonymized, we maintain it in that form and do not attempt to re-identify the information.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ you elect to use a model labeled "(no ZDR)", we or the provider may store User Content solely to provide the Service to you, and if you enable features that explicitly require persistent code snippets or conversation history (e.g., Memories, Rules, or similar features), you acknowledge that the associated User Content will be stored as necessary to provide those features.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain your personal information as needed to provide our Service to you, comply with legal obligations, or protect ours or others interests. How long we retain personal information includes considerations such as when the information was collected or created, whether it is necessary in order to continue offering you our Services, whether we are required to hold the information to comply with our legal obligations, or information preservation requirements. We also keep certain information where necessary to protect the safety, security, and integrity of our Services or users. In line with these considerations, we delete information that is no longer needed for the above purposes or when you request deletion of your information.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Asset Transfer or Company Acquisition — We may choose to buy or sell assets, and may share and/or transfer information about our users in connection with the evaluation of and entry into such transactions. Also, if we (or our assets) are acquired, merged, reorganized, or if we go out of business, enter bankruptcy, or go through some other change of control or similar event, your personal information could be transferred in connection with that transaction.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We do not sell or share your personal information with third parties for targeted advertising purposes, nor have we done so in the past 12 months. We also do not have actual knowledge that we sell or share for targeted advertising purposes personal information about individuals under 16 years old. We work with service providers and other third parties to help us provide our Services, and as a result we need to provide certain information with these third parties as described below. We disclose, and in the past 12 months, we've disclosed, the categories of personal data set forth in Section 1 with the following categories of third parties: Third Party Service Providers — We provide personal information to third party service providers who help us provide our Services. Other Third Parties — Certain features allow you to display or share information with other users or third parties. For example, you may share Devin AI conversations with other users via shared links. Be sure you trust any user or third party with whom you share information. Professional Advisors, authorities, and regulators — We share your information with our advisors, regulators, tax authorities, law enforcement, and government agencies to: Respond pursuant to applicable law or regulations, court orders, legal process or government requests; Comply with our reporting and information sharing obligations and regulatory authorities; Detect, investigate, prevent, or address fraud and other illegal activity or security and technical issues; and Protect the rights, property, safety of us, our users, or others, including to prevent death or imminent bodily harm.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ circumstances, we may preserve and share your information: in response to requests from third parties, law enforcement, or other governmental authorities; to promote the safety, security, and integrity of the Services, network, our users, employees, and the public Basic Information, Account Information, Communications, App, browser, and device information, Services usage data Legitimate Interests — specifically, it is in our interest and the interest of the general public to prevent and address fraud, unauthorized use of the Services, violations of our terms or policies, or other harmful or illegal activity; to protect ourselves (including our personnel and property or the Service) our users or others, to defend our legal rights and resolve disputes, to secure our platform and network, to verify accounts and activity, to combat harmful conduct, to prevent and address fraud, abuse and other bad experiences, to prevent death or imminent bodily harm To research and innovate Basic Information, Account Information, Communications, Service Usage Data Legitimate Interests — specifically, it is in our interest and our users interest to improve and iterate our Services through information obtained from users, surveys, reviews, and feedback ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Your Notification of Claimed Infringement may be shared by Exafunction with the user alleged to have infringed a right you own or control as well as with the operators of publicly available databases that track notifications of claimed infringement, and you consent to Exafunction making such disclosures. You should consult with your own lawyer or see 17 U.S.C. § 512 to confirm your obligations to provide a valid notice of claimed infringement. 14.4. Repeat Infringers. Exafunction's policy is to: (a) remove or disable access to material that Exafunction believes in good faith, upon notice from an intellectual property rights owner or authorized agent, is infringing the intellectual property rights of a third party by being made available through the Service; and (b) in appropriate circumstances, to terminate the accounts of and block access to the Service by any user who repeatedly or egregiously infringes other people's copyright or other intellectual property rights. Exafunction will terminate the accounts of users that are determined by Exafunction to be repeat infringers. Exafunction reserves the right, however, to suspend or terminate accounts of users in our sole discretion. 14.5. Counter Notification. If you receive a notification from Exafunction that material made available by you on or through the Service has been the subject of a Notification of Claimed Infringement, then you will have the right to provide Exafunction with what is called a "Counter Notification." To be effective, a Counter Notification must be in writing, provided to Exafunction's Designated Agent through one of the methods identified in Section 14.2, and include substantially the following information: your physical or electronic signature; identification of the material” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “To our affiliates or others within our corporate group , as a matter of our legitimate interests to efficiently provide the Services.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Exafunction may provide tools through the Service that enable you to export information, including User Content, to third-party services. By using one of these tools, you hereby authorize Exafunction to transfer that information to the applicable third-party service. Third-party services are not under Exafunction's control, and, to the fullest extent permitted by law, Exafunction is not responsible for any third-party service's use of your exported information.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “The information that you share with Third Party Sites will be governed by the specific privacy policies and terms of service of the Third Party Sites and not by this Privacy Policy. By providing these links we do not imply that we endorse or have reviewed these sites. Please contact the Third Party Sites directly for information on their privacy practices and policies.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “By enabling a Third-Party Platform to interact with the Service, you permit the Service to exchange User Content with such Third-Party Platform.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 8.1. Third-Party Services and Linked Websites. Exafunction may provide tools through the Service that enable you to export information, including User Content, to third-party services. By using one of these tools, you hereby authorize Exafunction to transfer that information to the applicable third-party service. Third-party services are not under Exafunction's control, and, to the fullest extent permitted by law, Exafunction is not responsible for any third-party service's use of your exported information. The Service may also contain links to third-party websites. Linked websites are not under Exafunction's control, and Exafunction is not responsible for their content. Please be sure to review the terms of use and privacy policy of any third-party services before you share any User Content or information with such third-party services. Once sharing occurs, Exafunction will have no control over the information that has been shared. 8.2. Third-Party Platforms. You may elect to use or integrate platforms, add-ons, services, or products not provided by Exafunction ("Third-Party Platforms") (e.g. User IDE's, Web Search, MCP Servers) subject to your agreement with the relevant provider and not this Agreement. We do not control nor shall we have liability for such integrations, including their security, functionality, operation, availability, or interoperability with the Service or how they or their providers use User Content. By enabling a Third-Party Platform to interact with the Service, you permit the Service to exchange User Content with such Third-Party Platform.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Third Party Service Providers — We provide personal information to third party service providers who help us provide our Services.” | Captured 2026-06-07Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ Interested in Teams? Check out the Teams Terms of Service .” | Captured 2026-06-07Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.