Windsurf Security for Enterprise Teams and AI Coding Agents
Windsurf is now documented by Cognition, the company behind Devin, and the enterprise controls are real: organization rules for terminal commands, limits on which modes members can choose, SOC 2 Type II and zero data retention on paid plans. This page reads those docs, shows where each control stops, and says when a team needs a second one.
Direct answer
Windsurf security for enterprises rests on Cognition's SOC 2 Type II certification, encryption in transit and at rest, zero data retention with model providers on paid plans that opt out of training, and admin rules that allow, ask on or deny terminal commands for every member. Those controls govern the editor and the vendor. They do not decide whether an approved tool call, such as a deploy or a record update, should run after the agent read hostile text.
Try it live
Watch AgentShield block an attack in real time.
Pick a scenario and drive the inspection lane yourself. No signup needed.
Run a request
Runs the live engine on your text. Nothing is stored, no account needed.
Inspection lane
INSPECTINGPolicy trace
High-risk action held for approval
Audit trail
- § · → → →
The risk
A platform team rolls Windsurf out to eighty engineers with a deny rule on destructive git commands and a short MCP allow list. It is a sound policy. Then one engineer connects a ticketing server and a deploy tool so the agent can ship small fixes, and a poisoned issue comment tells the agent to push to a protected branch through the approved tool. The editor policy was followed. Nobody decided that this particular call was wrong.
How AgentShield handles it
Start with the admin rules and the vendor certifications, because they cover the machine and the contract. Then route the agent calls that reach systems of record through an AgentShield gateway. Rules check the arguments of each call, hold deploys, bulk changes and access grants for a named approver, and write one attributed record of what was allowed, denied and approved.
The controls
The controls that secure which terminal commands and MCP calls a Windsurf agent may run, and which ones wait for a named approver.
What Windsurf and Cognition give an organization
The honest summary is that Windsurf gives administrators solid control over the editor and a credible vendor security posture, and it leaves the decision about each downstream action to your own tooling. The facts below come from Cognition's security and terminal documentation, read on November 1, 2026. Windsurf documentation now lives on docs.devin.ai, so check the current pages before you sign anything.
| Control | What the documentation says | Where it stops |
|---|---|---|
| Certification | Cognition states it has been SOC 2 Type II certified since September 2024, with data encrypted in transit and at rest | Covers the vendor's operations, not your agents' actions |
| Zero data retention | Available to paid plan users who opt out of training, with zero retention enabled at the model providers | About what the vendor stores, not what an agent does |
| Training on your data | On by default, with paid users able to opt out. Enterprise terms say Cognition will not train without express prior written consent | A contract term, so read your order form |
| Terminal rules | Admins set allow, ask and deny rules for every member. Organization deny and ask rules take priority over a member's own rules | Rules match commands, not the intent behind them |
| Mode limits | Admins can limit which modes members select, including the mode that runs commands without asking | Does not govern MCP tools that run through an approved server |
Cognition's security page does not describe deployment options, data residency, audit logs or single sign-on, and points readers to its trust center. Ask for those in writing during procurement.
Where Windsurf security controls stop
None of these gaps is a flaw in the product. They are the normal shape of a client-side control, where the decision sits on the machine that is also reading untrusted text.
| Gap | Why it matters in a rollout |
|---|---|
| Approved commands run with the engineer's access | An injected instruction that reaches an allowed command inherits everything that account can reach |
| MCP servers are trusted by configuration | An allowed server can still return hostile instructions in a tool result |
| Rules match text, not intent | A deny rule on one command does not stop another command that does the same thing |
| Vendor certification is not your audit | Your auditor tests who approved a production change, which a vendor SOC 2 report cannot show |
| Agents that run outside the editor | Automated runs and cloud agents need controls on the call path, not on a laptop |
If your team also uses other assistants, the same questions apply to Cursor AI security and Claude Code enterprise security, and the broader pattern is covered on coding agents.
Windsurf enterprise security checklist for US platform and security teams
- Request the SOC 2 Type II report from the vendor trust center and read the exceptions.
- Confirm in the order form that zero data retention is on and that training on your code is off.
- Set organization deny rules for destructive commands and ask rules for anything that changes shared state.
- Limit which modes members can select so the most permissive mode is not available by default.
- List the MCP servers you allow and remove everything else.
- Decide, in writing, which production actions an agent may never take alone. Deploys, payments, access grants and bulk deletes are the usual list.
- Ask the vendor for audit log, single sign-on and data residency terms, since the security page does not document them.
Steps one to five cost administration time. Step six is the one that needs a mechanism, and it is where teams look for a second control.
Where a second control earns its place
An AgentShield gateway sits on the paths your agents use to reach systems of record, such as a deploy API, a ticket system, a database tool or a payment service. It does not replace the Windsurf admin rules. It adds a decision on each action, outside the model and outside the laptop.
| Risk | Windsurf control | Second control |
|---|---|---|
| Engineer runs an unreviewed MCP server | Allow list | None needed. Use the list |
| Agent runs a destructive command | Organization deny rules | None needed for the local machine |
| Injected text triggers a production deploy | Approved tool, so it runs | Rule on the target and arguments, held for a named approver |
| Bulk change to tickets, records or repositories | Developer permission only | Count limit per run and per day, approval above it |
| Customer data leaves in a tool call | None documented | Content scan on outbound arguments |
| Proof for a customer security review | Vendor certification | One attributed record of allowed, denied and approved actions |
The gateway works for agents you build or route yourself. It cannot sit inside a vendor client that talks straight to a third party, so for those the editor rules remain your control. The enforcement mechanics are on tool permissions and the approval flow on human in the loop AI agents.
When to buy nothing, use Windsurf controls, or add AgentShield
| Your situation | What to do |
|---|---|
| Engineers use Windsurf on application code and nothing else | Buy nothing. Admin rules and the vendor certification are enough |
| You need to restrict commands and modes | Use organization rules and mode limits |
| You need a vendor assurance report for procurement | Request the SOC 2 report from the trust center |
| Agents call deploy, billing, identity or customer data tools | Add argument rules and approval on those calls |
| An auditor wants proof of who approved what | Add the gateway record |
Two of five rows end without a purchase from us. That is deliberate, because a control you do not need is not worth selling.
FAQ
Common questions about windsurf security.
Is Windsurf secure for enterprise use?
Windsurf is backed by Cognition's SOC 2 Type II certification, encryption in transit and at rest, zero data retention on paid plans that opt out of training, and admin rules for terminal commands. Those cover the vendor and the editor. They do not decide whether an approved tool call to a deploy or records system should run, so high-impact calls need a separate control.
Is Windsurf SOC 2 compliant?
Cognition states that it has been SOC 2 Type II certified since September 2024. Request the report from the vendor trust center and read the exceptions. The certification covers the vendor's own operations, not how your agents use their access, which your auditor tests separately.
Does Windsurf train on my code?
Training on your data is on by default, and paid users can opt out in the data controls settings. Enterprise customers are told Cognition will not train on their data without express prior written consent. Confirm the opt-out and the zero data retention setting in your order form rather than relying on defaults.
How do I control which terminal commands Windsurf can run?
Administrators set allow, ask and deny rules for every member, and can limit which modes members select. Organization deny and ask rules take priority over a member's own rules. Rules match commands as written, so pair them with a sandbox or a gateway for actions that matter.
Can Windsurf agents be hijacked by prompt injection?
Any coding agent that reads issues, pages or repository files can be steered by hostile text in them. Editor rules limit what runs locally, but an approved tool can still be misused. Rules on tool call arguments, with approval for risky actions, limit the damage when the model is fooled.
Does AgentShield work with Windsurf?
Yes, for agents that call tools through a gateway endpoint, where it checks the arguments of each call and holds risky ones for approval. It does not replace the Windsurf admin rules and cannot intercept traffic that a vendor client sends straight to a third party.
More use cases