- Deployment
- hosted
- Hq Country
- United States
- Hq City
- San Francisco
- Ownership
- private
- Founded
- 2023
- Training Default
- opt-out-clear
- Residency Options
- "Cognition, our third-party partners, and service providers may transfer, store, and process your personal information throughout the world, including the EU, UK and the US" — no EU-only option is published
- Gov Access Exposure
- us-cloud-act
- Eu Ai Act Role
- deployer
- Certs
- SOC 2 Type II
- DPA available
- yes
- Zero Retention Available
- Yes
- Self Host Option
- Yes
- Retention Default
- "By default, we may use your data for model training purposes to improve and enhance the Services. After you opt out, your data will not be used for training and Zero Data Retention will be enabled with our model providers." Enterprise customers are treated differently: "we will never train on your data without your express prior written consent".
- Retention Exceptions
- Training and zero retention are the same switch — a user who has not opted out has neither. Cognition's security exhibit states that for some services the data plane can be deployed in the customer's own cloud account, in which case "Licensor cannot access Customer Data stored on the Customer Data Plane"; customer data under Cognition's control is deleted within 90 days of request or contract termination.
- Subprocessors
- not published — windsurf.com/subprocessors returns HTTP 200 with the body "This page does not exist"
- Subprocessor Count
- 0
- Transfer Mechanism
- sccs
- Eu Procurement Ready
- conditional
- Eu Procurement Reason
- Windsurf is the only assistant in this batch whose default setting trains on your code, and the switch that turns training off is the same one that turns zero data retention on — so an individual developer who never opens the settings has both. Enterprise flips the default, with a written commitment never to train without prior written consent, SOC 2 Type II, and a customer-managed data plane that Cognition states it cannot read. The disclosure gap is the sharpest in the registry: windsurf.com/subprocessors returns HTTP 200 and the words "This page does not exist". That is not a blocked crawl or a JS-rendered table, it is a link in the footer of a company that acquired Windsurf and never wired the page up. For a product that ingests entire repositories, an unnamed set of third-party model providers behind a missing sub-processor page is the whole risk in one sentence.
- Training Claim Basis
- stated
- Training Confidence
- high
- Residency Claim Basis
- stated
- Residency Confidence
- high
- Retention Claim Basis
- stated
- Retention Confidence
- high
- Residency Class
- non-eu-only
- Portability / Exit Path
- proprietary-only
- Subprocessor Jurisdiction
- undisclosed
- Underlying model providers
- third-party LLM providers, unnamed in the published terms
