Windsurf

Cognition AI

Commercial

Standalone coding IDE shaped by major 2025 acquisition turbulence and later Cognition ownership.

Curated by Tiberiu ArvaStale 2026-05-26

Proprietary

Docs Website

Strengths

Standalone IDE
Agentic coding workflows
Enterprise path available

Practitioner note

Can be attractive for teams chasing agentic coding workflows, but ownership churn means larger enterprises should validate roadmap stability before standardizing.

Warning

Windsurf: OpenAI acquisition deal collapsed; Google hired key staff; Cognition acquired remaining product and brand.

Governance posture

Reviewed 2026-05-26

PartialData residency

EU residency via Frankfurt (Enterprise); US default; FedRAMP High via AWS GovCloud.

Source

YesDeployment model

Cloud, Hybrid (customer data + Windsurf compute), and fully self-hosted (Docker/K8s, private LLM). (saas, hybrid, self-hosted)

Source

PartialAudit logging

Audit logging on Enterprise Hybrid and Self-hosted only; not in the cloud SaaS tier.

Source

YesSOC 2

SOC 2 Type II; annual pen testing.

Source

UnknownISO 27001

Not stated on the Windsurf security page; post-Cognition-acquisition status unverified.

UnknownISO 42001

No ISO 42001 certification found for Windsurf/Cognition.

UnknownEU AI Act

Assessed limited-risk by product category; no published vendor EU AI Act conformity assessment. (role: limited-risk)

YesLicense risk

Proprietary SaaS; 2025 ownership turbulence (Cognition acquisition) adds roadmap risk. (high)

Source

EU AI Act obligations

Risk tier: Limited risk · as of 2026-08-23

Source-backed information mapped from Windsurf's tracked risk tier — not legal advice. Obligations depend on how your organisation deploys the system; see the full obligation reference and timeline.

Article 4AI literacy

Providers and deployers must take measures to ensure a sufficient level of AI literacy in staff and other persons operating AI systems on their behalf.

Applies from 2025-02-02

Official text

Article 50Transparency for certain AI systems

People must be informed when they interact with an AI system; synthetic audio, image, video, and text content must be marked as artificially generated, and deepfakes disclosed.

Applies from 2026-08-02

Official text

Explore the category

Compare this tool against the rest of its category and the cloud platform foundation layer.

AI Assistants

Return to the category grid to compare governance posture across every tracked tool.

Platforms

Review Microsoft Foundry, Amazon Bedrock, and Gemini Enterprise Agent Platform as the foundation layer.

Weekly updates

Track releases, deprecations, license changes, and other market movements.