Devin

GDPR overview

GDPR is addressed through documents rather than a marketing claim. The public data processing statement incorporates by reference the standard contractual clauses adopted by the European Commission on 4 June 2021, using module 2 or 3 depending on the customer's role, and defines EU/UK Privacy Laws as GDPR 2016/679, Directive 2002/58/EC, the UK Data Protection Act 2018 and the UK GDPR: "Licensor and Customer each agree to comply with their respective obligations under Data Protection Laws." Transfers to the EU, the UK and the United States rely on those clauses plus the UK IDTA addendum. The privacy policy of 9 March 2026 grants access and portability, erasure, rectification, objection, restriction, consent withdrawal, appeal and complaint rights, exercised at privacy@cognition.ai with possible identity verification. Two gaps: no Article 27 EU representative and no named DPO. The SCC annex lists Cognition AI, Inc. as processor and data importer.

Who owns the data?

Clause 1.2 of the terms defines Customer Data as the inputs you submit plus the data the Service generates and makes available to you, and clause 1.1 states that Cognition IP expressly excludes Customer Data: "For the avoidance of doubt, Cognition IP does not include Customer Data." The Enterprise page is blunt about it: "All inputs and outputs are your intellectual property." Ownership therefore stays with the customer. In return, clause 3.2 grants Cognition, its affiliates, successors and assigns a non-exclusive, worldwide, royalty-free, fully paid and sublicensable licence over that data. Under a VPC deployment, data stays in your controlled environment and Cognition states it cannot access the Customer Data Plane.

Reuse rights

Because inputs and outputs remain the customer's intellectual property, generated code can be reused, modified, shipped and resold without asking Cognition for permission. The reverse direction is where the detail matters. Clause 3.3.1 allows Cognition to use Customer Data to train models and improve the Services, and offers a way out only to paying customers: "If you subscribe to a paid Service Tier, you may opt out of this use (“Opt-Out”). Following an Opt-Out election: (A) Customer Data will not be used for any other purpose, including training language models; and (B) Zero Data Retention will be enabled with our model providers." On Enterprise, data is never used for training, and section 4 of the data processing statement extends equivalent restrictions to subprocessors, by contract or by technical configuration. The privacy policy relies on legitimate interest to train, fine-tune and improve models "depending on the terms that apply to your use of the Services". No data is sold or shared for targeted advertising, neither today nor over the past twelve months, and the privacy choices page adds a CCPA/CPRA opt-out that honours Global Privacy Control and blocks Meta, Reddit, X, LinkedIn, Bing and Google pixels when enabled.

Data retention & training

Hosting summary

Cognition splits the architecture into a Licensor Control Plane, which drives the service, and a Data Plane, which runs the compute. That Data Plane can be a Customer Data Plane inside the customer's own cloud account or a Licensor Data Plane, and Cognition states it cannot access Customer Data stored on the Customer Data Plane. Enterprise customers can deploy inside their own VPC, with support for all major clouds. Appendix C of the data processing statement names every subprocessor and its location: Microsoft Azure, AWS, Google Cloud, Auth0, Hex, Sentry, Datadog, Zendesk, Pylon and Decagon, all in the United States, plus Agumbe, or Cognition India, in India for a support flow. Model providers receiving inputs that contain personal data are OpenAI, Anthropic, Microsoft Azure and Google Vertex in the United States, with Databricks, xAI and Snowflake added only when enabled in Devin Desktop. Cloud and on-site data centres are reviewed regularly for ISO 27001 and SOC 2 conformity, traffic is encrypted with TLS 1.2 or above and data at rest with AES-256 or equivalent, and transfers between the EU, the UK and the United States rely on the standard contractual clauses and the UK IDTA addendum.