Are Windsurf (formerly Codeium)'s AI features covered by the BAA?

Cascade agent, Windsurf Tab and other IDE AI features: coverage not stated.

Does Windsurf (formerly Codeium) sign a BAA?

Q: Does Windsurf (formerly Codeium) sign a HIPAA BAA?

Not confirmed. None of Windsurf's or Cognition's current official pages says whether Windsurf signs a BAA. The old Windsurf security page now redirects to Cognition's Devin docs, which do not mention HIPAA.

Not confirmed

None of Windsurf's or Cognition's current official pages says whether Windsurf signs a BAA. The old Windsurf security page now redirects to Cognition's Devin docs, which do not mention HIPAA.

Based on 5 sources, all from Cognition (Windsurf, formerly Codeium) unless marked.

Business associate: Cognition (Windsurf, formerly Codeium)
Tool: Windsurf (formerly Codeium)
Plans with a BAA: Not stated
Checked: Oct 11, 2026

Not confirmed

No BAA offer found on Cognition (Windsurf, formerly Codeium)'s own pages.

By plan

Plan	BAA	How to get it	Conditions
Free / Pro / Teams	Not confirmed	Not stated	The pricing page does not mention HIPAA, BAAs or zero data retention for any plan.[1]
Enterprise	Not confirmed	Not stated	Enterprise is sales-led ('Let's talk'). No current official page says whether a BAA is available. Cognition's trust center lists SOC 2 Type 2, ISO/IEC 27001:2022 and CCPA, but not HIPAA.[2],[3],[1]
Windsurf for Government (FedRAMP)	Not confirmed	Not stated	The government page claims FedRAMP High, DoW IL4-IL6 and ITAR, but does not mention HIPAA or BAAs.[4]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Cognition (Windsurf, formerly Codeium) says about each one.

AI feature	Under the BAA	Details
Cascade agent, Windsurf Tab and other IDE AI featuresEnterprise	Not stated	No official page addresses BAA coverage for any Windsurf AI feature.[2],[1]

AI coding tools that offer a BAA

Claude CodeBAA on: Claude Console API key (Commercial org) with zero data retention, Claude Enterprise (HIPAA-ready)Some plans only
CursorBAA on: EnterpriseSome plans only
OpenAI CodexBAA on: ChatGPT for Healthcare / ChatGPT for Clinicians / Enterprise or Edu with Regulated Workspace, OpenAI API (API key sign-in) with Modified RetentionSome plans only

All BAA-ready alternatives to Windsurf (formerly Codeium)

Sources

Windsurf PricingWindsurf, Documentation. Checked Oct 11, 2026.
Security at Cognition - Devin DocsCognition, Documentation. Checked Oct 11, 2026.
Cognition Trust CenterCognition, Trust center. Checked Oct 11, 2026.
Windsurf for Government | WindsurfWindsurf, Documentation. Checked Oct 11, 2026.
Is Windsurf HIPAA Compliant? athenahealth's AnswerHIPAA Vault, Third party. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.