Codeium vs GitHub Copilot for Self-Hosted Environments

Regulated industries can't send proprietary code to an external server, full stop, no matter what the contract says about retention. That single constraint splits the AI coding assistant market into two camps: tools that only run inference in someone else's cloud, and tools that can run inference inside your own perimeter. GitHub Copilot and Codeium's Windsurf sit on opposite sides of that split, and the gap between them comes down to architecture. It's architecture, and for a defense contractor or a hospital system, architecture is the whole ballgame.

Start with the threat model. Defense contractors, hospital networks, banks, and government agencies operate under rules that treat "the vendor promises not to retain your data" as an insufficient answer. GitHub or Microsoft misusing a snippet of proprietary code was never the concern. What matters is whether that snippet ever left the building. Two separate concerns get flattened into one conversation, and they shouldn't be: data residency (where code gets processed and stored) and air-gap capability (whether a tool works with zero outbound internet at all). A tool can nail one and fail the other completely.

Contractual guarantees and architectural controls get treated very differently by security teams, and for good reason. A promise that data isn't retained still concedes that data crossed the perimeter to begin with. Once code leaves a network boundary and hits an external inference endpoint, the trust model shifts from "our systems control this" to "we trust a third party's word on this." For frameworks like FedRAMP High, ITAR, CMMC, and HIPAA, that shift alone can disqualify a tool, independent of how well-intentioned or well-audited the vendor is. Naming those frameworks matters here, because they define the ceiling for what's even possible. Not every tool clears that ceiling, and the sections below spell out which does what.

The fundamental architectural divide: cloud-only inference versus deployable engine

GitHub Copilot's IDE plugin talks to GitHub and Microsoft cloud inference endpoints. There's no on-premises inference engine you can stand up instead, based on the sources reviewed here. Every suggestion, every completion, every agentic action runs through infrastructure Microsoft controls, not infrastructure the customer controls.

Windsurf's enterprise tier works differently: the AI engine itself can deploy inside a customer's own VPC or on-premises hardware. Code doesn't cross the security boundary because there's no boundary to cross, the inference happens where the code already lives.

It's a design decision baked into how each product was built, one that can't be retrofitted after the fact. It's a design decision baked into how each product was built, and it can't be retrofitted after the fact. Given that Copilot is estimated to account for something like a quarter to half of code written in practice, the data-residency question is a live, material concern for any organization running it at scale, not a hypothetical edge case.

What GitHub Copilot's "self-hosted" options cover

Nothing on offer today gives Copilot a true on-premises inference path. What exists is HTTP proxy support and custom certificate configuration, both of which route inference back to GitHub and Microsoft's cloud regardless. Copilot for Business and Enterprise is a cloud-managed offering, and seat allocation plus policy management stay cloud-managed throughout.

Self-hosted GitHub Actions runners, known as ARC, add a wrinkle worth understanding closely. As of October 28, 2025, organizations can configure Copilot's coding agent to run development environment tasks on their own runner infrastructure, which gives the agent reach into internal resources. By April 2026, organizations will reportedly be able to set a self-hosted runner as the default for the Copilot cloud agent across every repository at once.

Giving the agent access to internal resources means disabling GitHub's firewall. Not narrowing it, not adding an allowlist, disabling it. That firewall understands public package registries and cloud metadata endpoints just fine, but it has zero awareness of internal resources, a private npm mirror, a staging API that only resolves inside a VPC, anything like that. So the "self-hosted" runner moves compute onto customer infrastructure, sure, but the agent's actual security posture now depends on a firewall that's switched off. The agent's actual security posture now depends on a firewall that's switched off.

Running agentic workflows against a GitHub Enterprise Server (GHES) repository causes the API proxy to misroute Copilot API requests to the GHES API endpoint instead, an active instability that is a documented bug, not a theoretical risk. The Copilot CLI inside the agent container then fails outright, throwing "Error loading models: Failed to list models: 400 Bad Request," and the agent never starts. That's the current state of GHES plus Copilot's agent, combined.

On the roadmap: GitHub is developing on-premises Copilot inference aimed at air-gapped environments, a direct response to demand from defense and government customers. It's in technical preview for all GHES customers as of GHES 3.22. This is expected and planned, but it is not a shipping feature as of the sources reviewed.

What Windsurf's self-hosted deployment covers

Windsurf structures deployment across multiple tiers up to a fully self-hosted option that can run without any outbound internet traffic at all, except to a trusted LLM endpoint, AWS Bedrock in GovCloud being the example given. Offline install and update support come with it.

Zero Data Retention, or ZDR, ships enabled by default on Enterprise plans. That's a policy layer sitting on top of the architectural layer, belt and suspenders. Enterprise controls round out the picture: SSO and SCIM, role-based access control, audit logs, attribution filtering.

The FedRAMP High authorization is the detail that separates marketing language from a checkable fact. Windsurf's government offering is delivered via Palantir FedStart on AWS GovCloud, so the infrastructure underneath the self-hosted option carries its own compliance certification, not just the software layered on top of it.

Compliance certifications and their practical meaning for regulated buyers

Windsurf's compliance stack reads like a checklist built specifically for federal and defense buyers: FedRAMP High authorized, DoD IL4, IL5, and IL6 compliant, ITAR compliant, aligned to NIST SP 800-53 and NIST SP 800-171 with mapping to CMMC 2.0, continuous vulnerability scanning, end-to-end encryption, delivered through Palantir FedStart on AWS GovCloud for government customers. An organization bound by CMMC, HIPAA, FedRAMP, or ITAR can adopt Windsurf's on-premises option without opening a new data-egress path, because the compliance lives in the architecture, not just in a signed agreement.

GitHub Copilot's stack looks different in kind, not just in degree. Copilot Business and Enterprise carry SOC 2 attestation, along with SAML SSO and audit logs at the Enterprise tier. There's no publicly documented FedRAMP High, DoD IL5, or ITAR compliance as of the sources reviewed. Copilot's controls govern how Microsoft handles data once it's in the cloud. They don't govern whether the data leaves the customer's perimeter in the first place, because by design, it already has.

That's the distinction a security team actually cares about. SOC 2 answers one question: does the vendor handle data responsibly inside their own cloud? That's a fine answer for plenty of commercial regulated industries. FedRAMP High, IL5, and ITAR answer a different question entirely: can this run without data ever leaving a controlled environment? Federal and defense work demands the second answer, and no amount of SOC 2 rigor substitutes for it. A tool can have excellent SOC 2 controls and still be flatly ineligible for an IL5 workload, and those two facts aren't in tension because they're just answering different questions.

Adoption tells its own story here. Windsurf and Codeium have been picked up by more than 7,000 companies across SaaS and self-hosted enterprise setups, and the self-hosted growth in particular is concentrated in verticals where architecture, not policy, decides what's usable.

Data handling promises versus data handling architecture

Windsurf's promise: no training on code from paid plan users. For Enterprise self-hosted deployments, the promise is stronger than a policy, code never reaches Windsurf's servers because the deployment runs entirely inside the customer's own security boundary.

Copilot's promise, for Business and Enterprise tiers: GitHub commits to data handling protections covering retention and model training. That's a real commitment, and it's worth taking seriously, but it's a contractual guarantee applied to data that has already been processed externally.

Windsurf's self-hosted guarantee gets enforced by architecture, there's simply no network path for the code to travel outward. Windsurf's self-hosted guarantee gets enforced by architecture, there's simply no network path for the code to travel outward. Copilot's guarantee gets enforced by contract and policy, the code goes out, gets processed, and then (per the agreement) gets discarded. For a security team building a threat model, those aren't cosmetic differences. One approach eliminates the risk. The other mitigates it by asking the organization to extend trust to a vendor's internal controls.

Neither approach is dishonest, and neither vendor is cutting corners here. They're built for different risk tolerances, and the job of any buyer is to figure out which tolerance actually matches their compliance obligations, not to assume one architecture is universally correct.

Pricing structures for teams evaluating self-hosted options

Windsurf's tiers: Free gives 25 prompt credits. Pro runs $15 a month for 500 credits. Teams costs $30 per user per month. Enterprise runs $60 per user per month, and that's the tier carrying self-hosted deployment, FedRAMP High, SSO, and audit logs. Large self-hosted deployments aren't publicly priced, and organizations needing custom compliance terms or larger seat counts get routed to a sales conversation instead. Windsurf's pricing is now identically matched, tier for tier, against Cursor, which makes cross-tool comparison a lot more straightforward than it used to be.

GitHub Copilot's tiers: Business runs $19 per user per month. Enterprise runs $39 per user per month, with higher premium request allowances baked in. As of June 1, 2026, GitHub shifted all new and monthly Copilot plans to usage-based billing, though some existing subscribers remained on prior billing arrangements during the transition. Functionally, the seat price stopped being a fixed cap and became a usage meter instead. Once an organization burns through its pooled credits, additional usage bills on top of the seat fee, and organizations running heavy agentic workflows should plan for real overage costs, not treat the sticker price as the ceiling. Copilot Enterprise also requires GitHub Enterprise Cloud underneath it.

At list price, Copilot Business at $19 undercuts Windsurf Enterprise at $60 by a wide margin, but that comparison is misleading on its face, because self-hosted capability isn't available at Copilot's Business tier at any price. The comparison that actually matters for self-hosted use cases is Copilot Enterprise at $39 (cloud-only inference, usage-based overages) against Windsurf Enterprise at $60 (self-hosted inference included, custom sales conversation for large deployments). And for any organization that needs FedRAMP High or IL5, the price comparison doesn't even apply, because Copilot doesn't offer a compliant deployment path at any price point.

Which environment each tool is viable for

Windsurf's self-hosted option is the viable, arguably the only, path for federal agencies and contractors bound by FedRAMP High, DoD IL4 through IL6, or ITAR. The same holds for organizations with genuine air-gap requirements, meaning zero outbound internet from the development environment, and for teams under CMMC 2.0 where code leaving the perimeter is itself the compliance violation, not a side effect of one. It's also the stronger fit for organizations that want to fine-tune a model against their own private codebase to sharpen suggestion quality on proprietary frameworks or legacy stacks nobody outside the company has ever seen. And for teams that can't standardize on a single editor, Windsurf's plugin coverage across VS Code, JetBrains, Vim and NeoVim, and others means the self-hosted deployment doesn't force an IDE migration on top of everything else.

GitHub Copilot remains the stronger fit for organizations already standardized on GitHub Enterprise Cloud, comfortable with cloud inference, and operating under commercial compliance regimes like SOC 2 rather than federal ones. For those teams, Copilot's tighter GitHub integration, its agentic workflows, and its lower entry price at the Business tier make it a reasonable, well-supported choice, right up until the moment a compliance requirement demands that code never leave the building. At that point, the choice is dictated by the architecture. It's an architecture question, and only one of these two tools currently has an answer.