Compare Coding assistants
Verdicts and the data-handling fields already on each tool page, from the vendor's published pages. Unknown means that page did not answer.
Share this comparison: /categories/coding/compare?tools=cursor,devin,fireworks-ai,github-copilot-business
| Field | CursorAnysphere | DevinCognition | Fireworks AIFireworks.ai, Inc. | GitHub Copilot Business and EnterpriseGitHub |
|---|---|---|---|---|
| Verdict | Careful | Careful | Safe | Safe |
| Trains on your data by default | Unknown | Yes | No | No |
| Training detail | If Privacy Mode is enabled, customer data is not used for training. If it is turned off, Cursor may use codebase data, prompts, and code snippets to train its models. The default for a new personal account is not stated. | The security page says: by default, Cognition may use your data for model training to improve the services. After a paid-plan opt-out, data is not used for training. | The Terms of Service, last updated July 10, 2026, say Fireworks will not use your Content (inputs and outputs) to train its own models or to improve the Service. The Data Processing Addendum incorporated into those terms prohibits Fireworks from using Covered Data, which includes customer prompts, model inputs, and outputs, to train, fine-tune, or otherwise improve any shared or foundational model. The enterprise product page says neither inference data nor training data is ever used to train Fireworks-owned or shared models, and the Secure Training docs say training data is never used to train Fireworks-owned or shared models. The privacy notice, which states that it is not a contract, uses slightly softer wording: Fireworks does not use prompts, training data, or API inputs to train or improve its AI models without explicit opt-in. The pages we read do not describe a published control that turns that training use on. Usage Data is defined separately from Content. The Terms allow Fireworks to use Usage Data to improve products and to share analytics only in de-identified or aggregated form that does not include your Content. The DPA says Usage Data does not include customer prompts, model inputs, or outputs. If Nexus Auto sends a turn to Anthropic, OpenAI, or Amazon Bedrock on your own provider account, or if you connect MCP servers or web search, those third parties' data policies apply. | The Copilot Business page says GitHub does not use Copilot Business or Enterprise data to train its models. The March 2026 policy update says those plans are not affected. |
| How to opt out | Enable Privacy Mode in settings. A team or enterprise admin can set it, and new members inherit the team's setting. Even with your own API key, requests still go through Cursor's backend. | On a paid plan, opt out on the Data Controls settings page. On a team, an admin may be the person who can change it. Enterprise does not rely on that toggle: training requires express prior written consent. | No opt-out is required for the no-training rule in the Terms and the Data Processing Addendum. The privacy notice mentions training only with explicit opt-in, but the pages we read do not describe a settings toggle that turns training on. For data storage, ordinary open-model chat completions are zero-retention by default. On the Responses API, storage is on by default (store=true); set store=false to keep that request out of storage, or delete a stored response immediately with the DELETE endpoint and the response_id. Enterprise account admins can turn on the Zero Data Retention policy in the console under Settings, then Governances, then Zero Data Retention, or with firectl or the API. That policy is off by default and, when enforced, rejects requests and jobs that would persist or log customer content, including stored Responses API calls, batch jobs, and training. Turning the policy on does not delete data already stored on the account. | No opt-out is required for training. It is already excluded. |
| Data retention | With Privacy Mode on, Cursor says providers do not store or train on your data, except that abuse-detected prompts may be stored for investigation. Cached file contents are temporary and are not training data while Privacy Mode is on. A day count for ordinary prompts is not stated. | The Cognition privacy policy says personal information is kept as needed to provide the service, meet legal duties, or protect interests. A single retention period for code is not stated there. Opting out is tied to zero data retention with model providers on the security page. | For open-model inference, Fireworks says prompts and generations exist only in volatile memory for the duration of the request and are not written to persistent storage. If prompt caching is on, some prompt data and KV caches can remain in volatile memory for several minutes. Request metadata, such as token counts, is logged to operate and bill the service. The Responses API is an exception: when store=true, which is the default, conversation data including prompts, responses, and tool calls is kept for up to 30 days and automatically deleted no later than that, though cached stored responses may be evicted earlier, often within about an hour. You can delete a stored response immediately. The Batch API requires dataset storage. For training, managed datasets stay until you delete them; checkpoints and traces are retained for 30 days, then deleted, and can be deleted earlier on request. Customers can keep datasets in their own bucket or use the Training API so no dataset file is stored on Fireworks. Fireworks' November 9, 2026 security update says a subset of datasets and incomplete model weights were accessed for certain customers in the October 2026 incident, and that Fireworks has not detected impact to Inference, the Training SDK, or Nexus, which it describes as zero-data-retention by default. Notion says chat transcripts used for its Insights classification jobs were in a stored dataset that Fireworks later confirmed. The privacy notice does not state one retention period for ordinary account data; it says information is kept as long as reasonably necessary, and that if you delete your account, Fireworks aims to delete your personal information from its servers within 30 days. After the service ends, the DPA says Fireworks will, if asked within 30 days, provide a copy of Covered Data, and will then delete remaining Covered Data, other than Administration Data and Usage Data processed for Fireworks' own controller purposes. Fireworks may still retain data where required by law or to prevent abuse. | Unknown. The pages we read do not state how long prompts are stored. |
| BAA / HIPAA | Unknown | Unknown | Enterprise only | Unknown |
| BAA detail | The security and data-use pages do not mention a business associate agreement. | The pages we read do not mention a business associate agreement. | The standard Data Processing Addendum treats personal health information under HIPAA as prohibited personal data unless the customer has entered into a separate agreement for that processing. The Fireworks for enterprise page says Fireworks is HIPAA compliant and signs BAAs. The docs glossary says Fireworks supports HIPAA-compliant deployments for covered entities and tells you to contact sales for BAA details. The public pages we read do not say a BAA is available on self-serve plans, and they do not spell out which product surfaces a signed BAA would cover. The Terms and DPA also say Fireworks is not PCI compliant. Do not send protected health information until a BAA is in place. | GitHub says customers can enter a data protection agreement for GDPR and similar laws. HIPAA is not mentioned on the pages we read. |
| Certifications | SOC 2 Type II; ISO/IEC 27001:2022; ISO/IEC 42001:2023; AIUC-1 | SOC 2 Type II (since September 2024, as stated on the Devin security page) | SOC 2 Type II; ISO 27001; ISO 27701; ISO 42001 | Unknown |
| Enterprise and admin controls | Team and enterprise admins can enforce Privacy Mode. New team members inherit it. Reports are requested through trust.cursor.com. | Enterprise customers are not trained on without written consent. Paid users get a data-controls opt-out. The security page says Devin can be used from the web app, GitHub, or Slack, and processing depends on which one you use. | Many of the stronger controls are Enterprise only. Enterprise account admins can enforce an account-wide Zero Data Retention policy that rejects features which store content, and can pin inference and dedicated training to a region, starting with US-only endpoints at us.api.fireworks.ai. Data residency is off by default, which means requests can run on the global api.fireworks.ai endpoint. Enterprise also adds custom SSO (SAML 2.0 or OIDC), SCIM from Okta, Microsoft Entra ID, or Google Workspace, a model access policy, and audit and access logs. Training customers can use bring-your-own-bucket storage and customer-managed encryption keys for datasets and checkpoints. Dedicated workloads are described as logically isolated, and Fireworks Sovereign, in private preview for Enterprise, runs Fireworks-managed inference on GPUs in the customer's cloud or data center. Nexus, the product that connects coding tools to Fireworks models, is zero-data-retention on every plan for prompts, responses, and traces, and keeps only service metadata, which it says is de-identified after 30 days. Nexus Enterprise adds SSO, SCIM, model access, data residency, spend limits, and audit logs. Closed-model turns in Nexus Auto run on your own Anthropic, OpenAI, or Amazon Bedrock account. Fireworks says it encrypts data in transit with TLS 1.2+ and at rest with AES-256. The Data Processing Addendum and Standard Contractual Clauses are incorporated into the Terms, and the authorized subprocessor list is published at the Trust Center. In its November 9, 2026 incident update, Fireworks says it revoked and replaced credentials and service accounts, isolated affected systems, tightened access to data storage and analytics systems, and enhanced logging and monitoring. It also disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while it investigates. Fireworks says the Training SDK remains available with zero data retention, and that Fireworks Lab-based training operates in an isolated environment with additional network and storage protection. | Business and Enterprise are organization products. The pages we read do not spell out each admin switch. They do say organization-owned repositories and these plans are outside the individual training program. |
| Last checked | 10 Nov 2026 | 10 Nov 2026 | 13 Nov 2026 | 10 Nov 2026 |