# Windsurf

## Kurzbeschreibung
**"Built to Keep You in Flow State"**


**Windsurf **is an AI-powered coding assistant, or rather an agentic IDE for software development.


The Windsurf Editor combines the local agent Cascade with the cloud agent Devin, supports model routing via Adaptive, offers IDE integrations, MCP connections, previews, and team/enterprise features for governance, security, and deployment. The tool is aimed primarily at developers, technical teams, and companies, not general office users.

## Claim
Built to Keep You in Flow State

## Geeignet für
- Automation / Workflows
- Programming / Software Development
- Websites / Landing Pages

## Kernfunktionen
- App Development
- AI agents
- Programming

## Preismodell
- **free:** Light Usage Allowance, Tab, Previews/Deploys depending on the limit and getting started in Windsurf.
- **subscription:** **Pro** Standard Usage Allowance, unlimited core features, additional usage at the API price.


**Max** Heavy Usage Allowance for power users and high agent/coding usage.
- **other:** **Teams **Team plan with centralized billing, admin dashboard, analytics, support, and team features.

**Enterprise** SSO, access controls, RBAC, volume discounts, hybrid deployment, account management, and custom deployment.

## DSGVO und Datenschutz
**Gesamteinschätzung:** Conditional

**On-Prem / local hosting: partial**

The documentation mentions a 'Self-Hosted Plan' for enterprise customers. However, the website does not specifically describe whether this means the solution runs entirely on the customer's own hardware and, in the strictest sense, whether the model also runs locally.

**Private cloud / data center: covered**

The enterprise page mentions deployment in the customer's Virtual Private Cloud. In addition, the security page mentions EU servers in Frankfurt for enterprise/hybrid deployments.

**EU SaaS / managed: partial**

The security page mentions an EU option with servers in Frankfurt managed by Windsurf. However, the privacy policy states that the services generally use servers in the USA. Continuous EU data residency for general SaaS use in the EU/EEA is not clearly documented on the website.

**Hybrid: covered**

The security page explicitly describes a hybrid tier for enterprise and states that no code snippets or code-derived information are stored on Windsurf servers or by subprocessors in this setup.

**DPA / Data Processing Agreement: covered**

A DPA is linked on the website. In addition, the security page mentions that documents are available through the Trust Center.

**No training: partial**

For Devin Enterprise, the enterprise page explicitly states that data is never used for training. For the general Windsurf SaaS variant, the website does not document an equally clear, generally applicable exclusion or a universal opt-out.

**Open source / transparency path: partial**

There is a transparency and sovereignty path via the Self-Hosted Plan, hybrid, and VPC deployment. The website does not provide specific information on open-source components or openly available self-hostable core components.

**Data processing**

The website describes several operating models: general services that, according to the privacy policy, use US servers; enterprise/hybrid models with an EU option in Frankfurt; hybrid operation with reduced data retention on Windsurf's side; and VPC deployment in the customer's controlled environment. For enterprise, it is also stated that data is stored in the customer's controlled environment and is not used for training. A list of subprocessors is not provided on the website.

**Conclusion**

For the EU/EEA as a whole, Windsurf is not generally documented as straightforwardly GDPR-compliant in the standard SaaS variant. Positive aspects include the DPA, enterprise VPC, hybrid, self-hosted references, EU servers in Frankfurt, and SOC 2 Type II. For more reliable GDPR-compliant use in Europe, the enterprise route with EU/controlled deployment therefore appears more suitable than general standard use.

**Sources**

- [https://windsurf.com/privacy-policy](https://windsurf.com/privacy-policy)
- [https://windsurf.com/security](https://windsurf.com/security)
- [https://windsurf.com/docs/DPA.pdf](https://windsurf.com/docs/DPA.pdf)
- [https://docs.windsurf.com/de/plugins/getting-started](https://docs.windsurf.com/de/plugins/getting-started)
- [https://windsurf.com/enterprise](https://windsurf.com/enterprise)

For users in the EU/EEA region, GDPR-compliant use is not clearly documented for the general standard SaaS variant, as the privacy policy mentions processing on servers in the USA. At the same time, the website mentions EU servers in Frankfurt for enterprise/hybrid deployments as well as self-hosted and VPC options. This means that GDPR-compliant use in the European region appears possible only under certain, rather enterprise-oriented conditions.

**Positive**

The website links to a privacy policy and a DPA. In addition, EU servers in Frankfurt are mentioned for certain enterprise deployments. There are references to hybrid deployment, a self-hosted plan, VPC deployment, as well as SOC 2 Type II.

**Negative**

The privacy policy mentions servers in the USA and international transfers including, among others, to the USA. General EU data residency for all plans is not documented on the website. A list of subprocessors is not provided on the website. An explicit, generally applicable opt-out for AI training is not clearly documented on the website for all product variants.

**Server location**

By default, the privacy policy mentions servers in the USA. For enterprise/hybrid deployments, the security page mentions EU servers in Frankfurt, Germany. No other specific data center locations in the EU/EEA region are provided on the website.

## Hosting und Daten
- **On-Prem / lokales Hosting:** teilweise / indirekt
- **Private Cloud / Rechenzentrum:** abgedeckt
- **EU SaaS / Managed:** teilweise / indirekt
- **Hybrid:** abgedeckt
- **AVV / DPA:** abgedeckt
- **Kein Training auf Kundendaten:** teilweise / indirekt
- **Open-Source / Transparenz-Pfad:** teilweise / indirekt

## Standort
**Land:** USA

**Taxonomie:** USA

The Terms of Service name Exafunction, Inc., 900 Villa Street, Mountain View, CA 94041, USA; the Privacy Policy names Exafunction, Inc., 990 Villa St., Mountain View, CA 94041, USA.

## Vorteile
- Very strong focus on software development with deep codebase context.
- Combination of local work and cloud agents (Devin).
- Broad model support including proprietary SWE models and adaptive routers.
- Enterprise focus with RBAC, SSO, hybrid, EU region, and zero-data-retention options.
- MCP support and integration path for proprietary tools/services.

## Nachteile
- For data protection and data residency, standard SaaS usage is not automatically ideal, since according to Privacy/Security, standard servers are located in the USA and certain features may require retention or third-party access.
- Self-hosted is possible, but according to the Security page, it does not fully support many of the most modern Windsurf features such as the Windsurf Editor or Cascade.
- Self-Serve costs are usage-based; Extra Usage is billed at API list prices and is therefore less predictable.
- According to Troubleshooting, premium models may occasionally run into rate limits.
- New Teams plans no longer include SSO; it is now Enterprise-only.

## Quellen
- Offizielle Website: https://windsurf.com/

## Letzter Datenstand
2026-04-27

## Originalseite
https://kifox.ai/en/ki-tools/windsurf-en/