Windsurf

Still calls home to the Codeium hostname after the rename, which is why blocklists written against the new brand name miss it.

What leaks through it

Repository context plus an agent loop that edits files and runs commands. The same shape as Cursor, on a hostname most policies have not been updated to name.

• server.codeium.com

Guardrails once it is inspected

Alectura intercepts only tools it has been tested against. Everything else is discovered, meaning you get the app, the devices running it and how often, but the content is never decrypted, so content rules cannot run on it yet.

Today Windsurf is discovered: you get the app, the devices running it and how often, without decrypting anything. The rules below are the ones that apply to it, and they run once it is onboarded for inspection.

• MaskNo secrets in inputALC-001

  Tokens in the code context are masked before the request goes out.

• AlertDestructive shell commandsALC-010

  Destructive commands the agent proposes, caught on the tool input rather than after the fact.

• AlertSensitive path accessALC-012

  Agent activity inside repositories or directories you have marked sensitive.

Those are the ones worth spelling out for Windsurf. All 27 rules in the catalog apply, and you can see the full catalog.

What happens to whatever gets through

Model training

Paid tiers are not trained on. The free tier permits use of non-permissive telemetry unless opted out.

Retention

Zero-retention options exist on the enterprise tiers, including self-hosted.

Data residency

US-hosted SaaS, with a self-hosted deployment available.

The vendor’s own controls

• ·SSO
• ·Self-hosted and hybrid deployment
• ·Org-level telemetry policy

Sources

• Windsurf security

Vendor terms last checked August 14, 2026, and summarised from Windsurf (formerly Codeium)’s published documentation. Confirm against the sources above before writing policy around this page.