Devin
Cognition
Careful
Cognition's Devin security docs say that, by default, it may use your data for model training. Paid plans can opt out, and opting out also turns on zero data retention with model providers. Enterprise is the exception: Cognition says it will never train on Enterprise data without prior written consent. The Windsurf privacy and security URLs we requested now serve these Cognition and Devin pages. Use Enterprise, or opt out on a paid plan, before pointing Devin at private code. A personal or unpaid default is not a business setup.
Last checked 2026-11-10
Data-safety checklist
Trains on your data by default
Yes
The security page says: by default, Cognition may use your data for model training to improve the services. After a paid-plan opt-out, data is not used for training.How to opt out
Steps
On a paid plan, opt out on the Data Controls settings page. On a team, an admin may be the person who can change it. Enterprise does not rely on that toggle: training requires express prior written consent.Data retention
What they keep
The Cognition privacy policy says personal information is kept as needed to provide the service, meet legal duties, or protect interests. A single retention period for code is not stated there. Opting out is tied to zero data retention with model providers on the security page.BAA / HIPAA
Unknown
The pages we read do not mention a business associate agreement.Certifications
1 listed
- SOC 2 Type II (since September 2024, as stated on the Devin security page)
Enterprise and admin controls
Controls
Enterprise customers are not trained on without written consent. Paid users get a data-controls opt-out. The security page says Devin can be used from the web app, GitHub, or Slack, and processing depends on which one you use.Sources
2 pages