Vendor record · windsurf.com
What Codeium promises about your data.
Where Codeium publishes its promises, how long it gives you when it adds a sub-processor, and what has changed.
- Where it publishes
Codeium lists its sub-processors at devin.ai/windsurf/dpa. We last read it on October 15, 2026.
- What has changed
We've read its sub-processor list and data processing agreement since October 1, 2026. Subscribers hear about a change the morning we read it; the public record shows it 30 days later.
- Its window
We couldn't quote a notice window: we haven't found a data processing agreement from Codeium anywhere we've looked.
- Window
- —
- Sub-processors
- 17
- Pages
- 4
- Copies
- 21
no window we can quote yet
sub-processors named
pages we watch
dated copies of all its pages, since August 31, 2026
Codeium DPA
We have not found a data processing agreement published by Codeium anywhere we looked. There is no sub-processor notice window we can quote.
Codeium sub-processors
Codeium publishes a sub-processor list at devin.ai/windsurf/dpa; we last read it on October 15, 2026. It names 17 entries. The first 15, as the list prints them: Agumbe (Cognition India); Anthropic; Auth0; AWS; AWS/Bedrock; Databricks; Datadog; Decagon; Google Cloud; Google/Vertex; Microsoft Azure; OpenAI; Pylon; Sentry; Snowflake; and 2 more in the full table below. The public record holds no change to the list read before September 16, 2026. A change we read after September 16, 2026 is published 30 days after we read it.
17 named · full table
Every public change we have recorded · Where vendors publish their lists
How long Codeium keeps your data
We hold no statement about data retention from Codeium's watched pages. The pages we watch: changelog windsurf.com/changelog; privacy policy windsurf.com/privacy-policy; sub-processor list devin.ai/windsurf/dpa; trust and security page windsurf.com/security. On training with customer data, Codeium's trust and security page (windsurf.com/security, in the copy read October 8, 2026) says: “After you opt out, your data will not be used for training and Zero Data Retention will be enabled with our model providers.”
Training on customer data
“We collect and use your information in order to provide and improve our Services and your experience, protect the security and integrity of our platform, and meet our legal obligations.”
windsurf.com/privacy-policy · read 2026-09-22
Training on customer data
“How is your data used to improve Devin? By default, we may use your data for model training purposes to improve and enhance the Services.”
windsurf.com/security · read 2026-10-08
Retention windows vendors publish · What vendors say about training
What the pages say
Read automatically from the pages below and shown as printed. A missing row is a gap in our reading, not proof it isn’t there.
Sub-processors named · 17 · 4 name an AI provider we list
Agumbe (Cognition India)
Support Workflow
India
AnthropicAI · Anthropic
Core processing
United States
Auth0
Profile data
United States
AWS
Core processing, profile data, logs, and indices
United States
AWS/BedrockAI · AWS Bedrock
Core processing
United States
Databricks
Core processing
United States
Datadog
System logs
United States
Decagon
Support Chatbot
United States
Google Cloud
Core processing, profile data, logs, and indices
United States
Google/Vertex
Core processing
United States
Microsoft Azure
Core processing
United States
OpenAIAI · OpenAI
Core processing
United States
Pylon
Support contacts
United States
Sentry
System logs
United States
Snowflake
Core processing
United States
xAIAI · xAI
Core processing
United States
Zendesk
Support contacts
United States
Certifications the trust page names · SOC 2 Type II
Retirements announced · every vendor's retirements
undated
Product analytics are no longer started before your account status resolves, so telemetry is never collected for accounts that have it turn…
undated
Rules and workflows now use Devin branding, and workflow surfaces explain that workflows are being deprecated in favor of skills and link t…
2026-08-01
The edit, write, apply_patch, and notebook_edit tools in Devin Local now refuse to write through a symlink, so an approved edit can no long…
undated
Windsurf Browser is now deprecated.
undated
With “Agent Diff Zones” turned off, Devin Local no longer opens edited files in the background, and closing the last Devin Local tab now op…
The pages' own stamps: Last updated 2026-03-09 · Last Updated 2026-03-09
The pages we watch
Every page we read, so you can check it. Each is re-read on a schedule, and we keep a dated copy when it changes.
Where we get nothing
What Codeium does not publish where we can read it
Of the 4 public pages we watch for Codeium, these give us nothing right now.
Data processing agreement
we have not found one published anywhere we looked
Before you conclude anything
This only means we couldn’t read it on a public page. Codeium may share it in its agreement, a trust portal, or with any customer who asks.
So treat it as a question to ask them: “Can you send your sub-processor list, and tell us when it changes?”
What this page doesn’t tell you
No score.
Nothing here rates Codeium. A short notice window is a contract term, not a criticism.
Public pages only.
Private notices and negotiated terms are invisible to us. Your agreement may say something different.
Wrong? Tell us.
Corrections are free, always. We reply within 2–3 business days.
How we read a page · The change log
Work at Codeium? With an email at windsurf.com you can claim this record, suggest pages we should watch, and take a free copy of it. Claiming changes nothing we publish.
Is Codeium in your product? Hear the morning we read a change.
You get the lines that moved, in Codeium’s own words, and the date any window closes. No card. Nothing to cancel.