Windsurf / Devin Desktop and the GDPR: AI training, data location and DPA

Trains on your data unless you switch it off.

Yes, unless an admin opts out. Cognition may use customer data for model training by default; paid plans (including Teams) can opt out, and only an administrator can do so on Teams.

Vendor's wording: “Cognition may use Customer Data for model training purposes and to improve and enhance the Services. If you subscribe to a paid Service Tier, you may opt out of this use”

Source: windsurf.comPlatform Terms of Service, 3.3.1 Use of Customer DataSecond source: windsurf.comChecked on 19 October 2026

You can switch the training off.

Paid plan: opt out on the Data Controls settings page. On Teams only an administrator can switch it on. After opt-out, data is not used for training and zero data retention is enabled with model providers.

Vendor's wording: “If you’re on a paid plan, you can opt out at any time on the Data Controls settings page.”

Source: windsurf.comPrivacy & Intellectual Property, 'How is your data used to improve Devin?'Checked on 19 October 2026

United States. DPA Appendix C lists the cloud hosts: Google Cloud (marked Windsurf only) and Microsoft Azure and AWS (marked Devin only); every hosting row is located in the United States.

Vendor's wording: “Core processing, profile data, logs, and indices”

Source: windsurf.comAppendix C: List of SubprocessorsChecked on 19 October 2026

DPA in the terms.

Yes. The Data Processing Addendum is incorporated into the customer agreement and applies when personal data is processed; it includes EU standard contractual clauses.

Vendor's wording: “and is hereby incorporated into the Agreement”

Source: windsurf.comData Processing Addendum, opening paragraphChecked on 19 October 2026

Published.

Yes, published as Appendix C of the DPA (https://windsurf.com/dpa): 17 rows, 15 companies. AI providers: OpenAI, Anthropic, Google/Vertex, AWS/Bedrock, xAI, Databricks, Snowflake (some only if enabled).

Vendor's wording: “The following entities to the extent Customer Personal Data is included in the Customer Data submitted as input to The Cognition Platform.”

Source: windsurf.comAppendix C: List of SubprocessorsChecked on 19 October 2026

Not listed.

No listing found for search term 'Cognition AI', 'Exafunction'

Source: dataprivacyframework.govSearch 'Cognition AI', 'Exafunction' returned 'Query returned no results'Checked on 19 October 2026

Customer data is kept for the duration of the customer relationship; with ZDR (after opt-out) it is not saved to disk and is deleted once the output is generated. Subprocessors delete within 30 days of DPA termination.

Vendor's wording: “Cognition only retains data processed through Devin for the duration of the relationship with a given Customer”

Source: windsurf.comPrivacy & Intellectual Property, 'What data retention policy does Cognition maintain?'Checked on 19 October 2026

SOC 2 Type II (since September 2024). No ISO certification named on the page read.

Vendor's wording: “Cognition has been SOC 2 Type II certified since September 2024.”

Source: windsurf.comSecurity, Third-party audits and certificationChecked on 19 October 2026

Yes. On Teams and Enterprise, admins can restrict which AI models members use and switch individual AI features on or off (for example quick review, Codemaps, DeepWiki, MCP servers).

Vendor's wording: “Which models are available to members in Cascade, Devin Local, Command, and Devin CLI.”

Source: docs.devin.aiDevin Desktop admin controls reference, tableChecked on 19 October 2026